remcos | 5cf43e00a1153ac34c3b440d4e320af1497833ab9dc6e60d2760cbc34545efe5

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 05:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
Size 1.6MB
Sample260818-fpfcqsem4s
SHA256 5cf43e00a1153ac34c3b440d4e320af1497833ab9dc6e60d2760cbc34545efe5
MD5 501864109cf4bd49066385ee35dda0d4
SHA1 38817f51f1a8d8e5dd835caba29d23a0e8df48ac
SHA512 a849428973decedffe07ae4f5353500fec1267ba4ffd38e30f21413b5fb2e250a9c05150fb24e87a2e951160f4bf42bfec33b247a42d67ba541d24a5982732e4
SSDEEP 12288:pNTm5FFykEJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHF:pQbYksdCN/j2GLl3iFSE33b9s
TLSH
T19B751217FE47D1B3E41643B107947B22AF78ECB2A6298803C781D6C2EAB8D99D471533
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost discovery remcos rat spyware stealer

Malware Config

Extracted

Family

remcos

Version

2.2.0 Light

Botnet

RemoteHost

smmrbysummerdesnoo.nl:3308

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
3
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-7R0YVM
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 11 IoCs

pid	Process
2096	elevation_service.exe
2928	elevation_service.exe
4896	maintenanceservice.exe
3500	OSE.EXE
2116	PerceptionSimulationService.exe
5160	perfhost.exe
1324	ReFsDedupSvc.exe
1412	SensorDataService.exe
5456	ssh-agent.exe
5752	AgentService.exe
4304	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ec648e11209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaws.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000089a5efdace2edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000278647dcce2edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a91c421acf2edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e156f7dace2edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff062adcce2edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
2096	elevation_service.exe
2096	elevation_service.exe
2096	elevation_service.exe
2096	elevation_service.exe
2096	elevation_service.exe
2096	elevation_service.exe
2096	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
Token: SeBackupPrivilege	1324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1324	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1324	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1324	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1324	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1324	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5752	AgentService.exe
Token: 33	4304	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4304	SearchIndexer.exe
Token: SeDebugPrivilege	3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
Token: SeDebugPrivilege	3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
Token: SeDebugPrivilege	3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
Token: SeDebugPrivilege	3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
Token: SeDebugPrivilege	2096	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3380	2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 4100	4304	SearchIndexer.exe	101
PID 4304 wrote to memory of 2120	4304	SearchIndexer.exe	102
PID 4304 wrote to memory of 3704	4304	SearchIndexer.exe	104
PID 4304 wrote to memory of 1308	4304	SearchIndexer.exe	105
PID 4304 wrote to memory of 4680	4304	SearchIndexer.exe	107
PID 4304 wrote to memory of 4804	4304	SearchIndexer.exe	108
PID 4304 wrote to memory of 3368	4304	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_501864109cf4bd49066385ee35dda0d4_elex_remcos_remocs_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3380

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2928

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4896

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3500

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2116

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5160

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1324

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1412

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5456

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5752

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4100
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2120
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3000 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3704
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1308
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4680
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4804
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3000 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3c7fd99e08ccf14e1fb1026df49cd3d94326b8c6a13fcda446ecda31df406204
MD5 10ee0a30e2c002bf9f349a1206b126d9
SHA1 871c36af6d62341f47dc32890cd5bb5b347f46f9
SHA512 0a5fd2eca3f3996b18381831482f9ad2777c914c1b678adc94a764ba9498068a12e42890e79329b81bc54e89f5e54d1f9fe01b95abcdc23786c1148d9757fb13
SSDEEP 49152:qb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn9N/j2U4FH:c3q6HjBSj2jF
TLSH
T1C1D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.8MB
SHA256 717e396019c12cc8e20249d34909cee21066ff796e04cba5239769902916a91a
MD5 043a4586c197f54cbf5c5228a0e53041
SHA1 4fae4473b6efa67c35f22e300baa3fea2ceba2d1
SHA512 f5d01e52814c1bd590d39860b82f58b732bc5125945d5c927a44db5cb3baf6be8770aef5385cd0f9f9993d6790a9e386d6153b70026e7f0974729f9f31b44080
SSDEEP 12288:11XLsswWkxy2lRq2czAVJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:bXYfDtczAxdCN/j2GLl3iFSE33b9
TLSH
T1BC85F128B7E409F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 89115964a070fc21d6bb165023520027abdf1801f228843cd86bcadce6f3424d
MD5 7c1dd186dbdb1686b025acded2feb881
SHA1 bd21deaac32199ae94b4ba402599c150b918acf8
SHA512 838af9ee1412225395ecc29b31a80c70beaac0d86e89fd3fa52b2dbcb6bc2655555cd8160917e5c4b66daabd9334f70f28bee218aeae0e61a7a99388aa739b54
SSDEEP 24576:w0Le5ji0hmxirMydCN/j2GLl3iFSE33b9:wPji0AcoN/j2U4FH
TLSH
T160A5AE26F6748335D073C0B9C5D2A69AE97130855B308ACB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b357d050267e74aa1b2cffa90ab1b135c2a01b4e83cf28f144bd60a14357e5dd
MD5 7e5b5e22a24b0f3ac4ea96afeff9d79e
SHA1 23c6f4f91c46c6d86bea5195cd7f41ad2bdc9f44
SHA512 9d8ab901750f083568400b9ec48d051e56f384d565e03b78a8f9cecbfcd76200e342dac160e56d7e16ccbace1ecbc7f1c9862ed5b95e0c012250398bb0d27cb2
SSDEEP 24576:ba7/ezSC6vUyD/aqgrvWE6q8wyu4dCN/j2GLl3iFSE33b9:2/ezSC6vUzPvxHjyMN/j2U4FH
TLSH
T14D755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f963028843e78ba5c90b5aace4da4b3cd785d5420cb32a80f7252a36649df1b9
MD5 7135c8adf176d185200a173b941a5a04
SHA1 61f4c099a26b7c1fd37372ca8bdfa9399ea2555c
SHA512 2d90c5f51fe85b9f7c8763d37c68ff159e910a51b368c5518907d691e2c1318ef4ed17d9b9cb9212a75bcc29d6662d521b78057708b9b67b0fe8938cee7a545b
SSDEEP 24576:lVbqPb88hv/l+6ddCN/j2GLl3iFSE33b9:lVO88hXl+JN/j2U4FH
TLSH
T1D1559E65F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 93a14097071a290b75f478698c048b60ca4c27aaa90d582a16eb8a8f4a981d12
MD5 86a98312d6061e509d3b689ba692ff2f
SHA1 2516a84d72844599ad590dc2b23d8f975d8a8864
SHA512 df58427f5f1f08b255ee12af9c69545e5e32fe4b9a83f2779f1a50510f2ebe253224dd0832c25b9ac7f7552f4abbe4d870d5bbf382576bd90255107e36288a21
SSDEEP 12288:HRyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHm:HRudCN/j2GLl3iFSE33b9z
TLSH
T1F9752364DAA4B565F6AF837903ADDE615200FEE8E525884785917BEF117CFE8C033063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 4c4a3c485e15251809cf423f8b83f7012ae5dc79f6cff24bd077ff2e08c35576
MD5 ee8115c040859be2753811149f1d6cb8
SHA1 0b9d75de8d0c2bd2111ced66fe0111108edcc194
SHA512 09ad05fec7707874c3a30f984ea1327b94e5400f8788037a631f722e15c96852daaa1e11b4fda7b9dc5b4c635bee5518ff1f706cfabbcf6581196ba5634d62fa
SSDEEP 12288:WeBNUbTVO86UhJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:WJIUVdCN/j2GLl3iFSE33b9
TLSH
T1CF85CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0be11acb926618fd4799c490adcf16a08c5ac7f2687d466870a85720e970936f
MD5 29263c7f95f1154359870e1391e92bc4
SHA1 84ad87124642457768f59f4083593598ca3fec37
SHA512 a80c266f9dfbbb491d88f2a4ef4dca7e211449398027f878fd3d843a3007adc5b0b640fd78704ec6ff9005ad8037f61f66817c1932368ab75cdbf442ec72befa
SSDEEP 49152:dQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THL:dQvGAdlCEL8c/yRNw5Cdj2jF
TLSH
T1EC267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 f52ee856bbabe24ed3de31529214a2846f6a6593541cf7b476cac0c0f6f0f9b4
MD5 725a84dbab031c1786877de2ab9a3b81
SHA1 e95486cb5e9e3a2d2853173d9a9199add924bb9c
SHA512 c50e59b243f7d65c48e0aed8e7a41f6c57a88238c54bc680d26f0303b6b4ef715cd3cda140869a8311d1c1b6fa7b3681125d4514ea789ca8f721639e2fe2634e
SSDEEP 12288:2AwSfxL/2Dc34DLLmt0LDQewsAjDJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9h:LdewsAj7dCN/j2GLl3iFSE33b9h
TLSH
T1B995E030FE74E436C2BF0DB61B35C716142CBA608B6119C3E3E89E9E59346D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8a071220437f764efcfc70335ea8d8587f47a35b4a0b246d0172a4aced790c86
MD5 c1e2702090f372c317c09dfc351a721e
SHA1 d648bbfa68c96b9b54930cf13105e9bbcbbe6bf0
SHA512 2a747fd9fc7c3bad3502c88c043871df43a4b8dc2e712bde7fa9cc78eeefe10d52ec0aecf8d422d0605176fff372b2c050658c53f7cc8aaf730b6b9b2b8a45f9
SSDEEP 196608:LUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHc8F:LUEtQevvqc2W1cpV2EI32c
TLSH
T1BA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 239ac1eb9cdd2c2c1a882ab1a88ce4e69c61586dca2596f5a9c50e1e4d7c73b2
MD5 0da84744c3dc305cae2bb0a127206fa3
SHA1 f8d63ae8ce9a35acc8c7e58e144c92077e0db959
SHA512 2906c797abe05b74ec6a5787f4f0c919bed163b6e5aaad955308d14222d572ef38aedfad4f7398aa6ee273a845fed05c4e5e96b80b34ee3e9b4fd8156c351a50
SSDEEP 49152:cCbRquA/m2yL5zQfFiV+XenmE3/z4N/j2U4FH:VoqtVjnm5j2jF
TLSH
T1BFD58D0976B8C2E4D1F6C77886A2C647F37178158B3197EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c0ed90821a6abed69bd094a0c2b50fd46622ad1322dd27ce325390c1a523745e
MD5 a4046e1bc7a9eb6ba6ba206fb14f322c
SHA1 037737a6a942bb323d00998e575ac7ed98cae425
SHA512 44692b78af74e1c3c78e8e7e261f181dba8c3172a6d43427ea3306aae3ea87a4dee2b0c72d9c017a35de655a0ecad07a1116dd9543c7ca42679fe4a6797b4626
SSDEEP 24576:hAhGLJIFoiwtA5l7S53cdCN/j2GLl3iFSE33b9:hAMyFoiq5XN/j2U4FH
TLSH
T18A35AD80EBF955D4F5B3AAB899B68571EA72BCA95E31C20F1150D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 66f61516505d980197f8a40e7859c2d5d109daffb0587ceaf495f1b27b2bc8f8
MD5 ad4ab4ae17fe11fe3ea39fb6f7ab789e
SHA1 4667a515d1b34c43e9e0ed366adc5c9582c15367
SHA512 7e655404c05f7f5de2f01e7741edacaf8a30791c3036394e4dcd6731279d7f7d9cce7e73f8e39eeae19f388643e9bed1cdd1d4411b3fe399a0fa5345bc117e43
SSDEEP 12288:Kmw5HEjsChNVBFgl0WDm+CYJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:DwuoOWfdCN/j2GLl3iFSE33b9
TLSH
T12D85F14577E41CF9E96782398697C536F7B2BC512A21CB0F0360C69B6F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 5ee0847f8e554178acd5e88229a469841a25d74816249466a4628d0ef52a1f16
MD5 3ccf489810558b322d9ea0952afb33ee
SHA1 46aa1a24efb2d516642d5dbab33f614cff13d2d0
SHA512 5a0419519c6ccec4953a3a88c1747d95d0a457d719cb4cffcc6ab2d28bcb94c53fe53561e308cc660cc91876bf946129ff2e7786399c50630b47af67abae42d8
SSDEEP 12288:UBZ1IyTJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:yZuKdCN/j2GLl3iFSE33b9
TLSH
T1F475125933E471F9E1A7823C8AE59A05D321B8A5A73243CF026147EA1F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 afc5ed3d9fd2163cac198be2d3e10678e4753ade31aa630eb4bd15aedc0e9fed
MD5 ba03035f1264734c17e3ac955dcb2992
SHA1 b1d89aa54890fa25080ce6e662ca105c226b85b3
SHA512 7415c4b790cc552c27d4b5e7bab90c00263e0cd7425199de4f71dbe361fb771fbc760e0b3d3eadb2aeff6df27c476443e3a4768ba093403ff00daa78f7a88787
SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UP:UQRQyi36YOcPQLvw2gAf+PN3Gj2jF
TLSH
T179667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 cf133fb679dabdfe2e025314af8f9590c1cf68b6ebd8704976edad26fa6bbb33
MD5 028fe441bc1c4c59a500465d4eb6f6e3
SHA1 ca81af95e83993de946025c7a6257a2ef144e207
SHA512 feea52b912b9b7ebd331b883700adf31c8ec8160eadcd3606439081f67151f2dd9be7f44e8e80a8ceb108caa01b7a141562bb1b99a41c367f4e93fbedd73045e
SSDEEP 49152:Yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UP:fQRQyi36YOcPQLvw2gAf+PN3Gj2jF
TLSH
T1D2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0acf3890d674b15468f8168d42688fdafd65080f8b03b70e4112d9ea6e888926
MD5 e3f3c047e1f9c2e15c98c329d97c1678
SHA1 1e7e0535e64821b2fd597e59df97a2d7366b7eb8
SHA512 8a408013060ec9c69f9bdb72d7c73ad5d171fbd608c1404df05d8c1ca165a42641896e97cff3b7ae51691e138f7d2f95655f684f6391869f9d7280fd06871ecd
SSDEEP 24576:TwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0adCN/j2GLl3iFS+:r68Qg55nhheWu7PNU3/oN/j2U4FH
TLSH
T16EB54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 70fee1ed8c88d383019c6c6dafc96e9dc7bbc3aefd2620e38311e4b80aebbba3
MD5 13e90fdf1c283407b65bd235b6b96c80
SHA1 8ddf1ef713751fe1d3409eab8afca718c2d40d75
SHA512 e3b8291879db413308a0f4776d4a1bd2107b55c26c0309170a9a2ea4819e9fe7f028b4b4c34d96d27d9cc2c420a415cec878f2c2dc71331e286e11c426aa6cd2
SSDEEP 49152:I3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk995:ly5112gYy5azzVvL69nLKnhZfj2jF
TLSH
T16B168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6558a02c53ca361f261b167fd53fea233c44d003dbb0b0760587bb8554e69330
MD5 db0270f63198969f0cc29b5d41c820a4
SHA1 56bd246f22e919d527148eaa9275f2187bb131a0
SHA512 d8411e8b588d0666a628fb0e7466077289e9910d50e1f6a5ff94e4ed537a61d3542f5ba28b6cbe2c445951c4bbdd6376d26914325ed4515d358022f3b03b253b
SSDEEP 49152:HB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glWN/j2U4FH:Ju6JmVxd2dOj2jF
TLSH
T156D59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c6751fa6a11b3f75c5fdb0fa5557c8cf4086214141fa34c612eeb451ed396491
MD5 fe58f19f19ede4023f6c5b639d9c94ef
SHA1 f7c6df579dbd853e39329b2dc275b6b886abf69d
SHA512 d086c918fb6e93e5f17685252cdb47abe06fcffdcb27b4bd9968a3042b5db43ccbb36bc0b7795f31dfcc1fb4aac747b31c9ac5341a44bf7c314594bbe864d33f
SSDEEP 49152:Q1hpsNoJpF1A6UU44CwH7R4xqN/j2U4FH:QmifPbR5j2jF
TLSH
T15DB5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 37a147c062b5c150b0b8377f7ae22df3ff5689a2b2f1bfb29b8f6ca82a9a6601
MD5 25510a051d5b3ab39a8d5c576e5ad630
SHA1 434fabade0d096aa69002f3f7b9fa155c1e893db
SHA512 4e037ce460022ed7dc038e9723e36e5bc198861fcdf97e18e97fb2abc79db8465a9d930379e985e31effe31620dc6dbd4ba75b9ed340142b5f7383508843f0dd
SSDEEP 49152:5SuZQIY0Be2KRRVtOnks6NMHqtN/j2U4FH:X5dKTi61Dj2jF
TLSH
T1D3C5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7da1270a1e82498f3b16269474ae1e36005a0275abe77746223866d10aa5878e
MD5 2e4ec8c3b1ee2734338ae9a813c690ff
SHA1 ad6b526741f93d8716440d111b244b0836ab57ff
SHA512 90807579694d81e5f590389d92553ce53e38aa7f8ee8ba98e852728221a089ab440642bf3f5a3a00ce689c8fb76492bbb7caf53e8d7e3acef88cd1336702c356
SSDEEP 49152:vhtSn8EApI0figngiDn0AP5wGN/j2U4FH:+X2iyph1j2jF
TLSH
T15E95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 5e987c055ad37c5b0ec104625def7ed93e72f36b9a19c271b10e4f81874eeaf5
MD5 7315ca3ed45bc031c9e229771a6e88ad
SHA1 50513e4671ee35094284c750ee5d4f20fef90b88
SHA512 cfdb49faf13d87ddd3f34b0734243395f8fc2dfc250f4d5df012acefd683fdce80efeb1c3c7af55ad0c3b410560b5bc6478d6255fe277808f24ce24cb26bec21
SSDEEP 12288:R6JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:RGdCN/j2GLl3iFSE33b9
TLSH
T1C7752364E9E5B669F15BC37943A9DF515100FEECF6264487868166EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 45656b2695bfd846600052fc2728989b35be4e51c4068809b7ae86de0d1f2d92
MD5 2827710d15eb576c3bc61f979a9ebb73
SHA1 e9f259c600b9ae5dc3cae4ac7aa3a22078d192cd
SHA512 288be2bc014e02f2669660d880cc18e5f0ba3f1ba4f01447766c32afffdf75f33b62b21b436ee41076de378ac63831412710cf4e4e3773411f8c026bd1eee3c3
SSDEEP 12288:tHJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:tHdCN/j2GLl3iFSE33b9
TLSH
T1E0752364E9F6B669F15AC37943A9DF515100FEE8F6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 733107071079b90897ad3871a5c889912bc9e76d491dfb4c032377d2c431df02
MD5 d1fb2307a81b2c9061b25099ec413ea4
SHA1 ed13ce82e1841e55f7eb0cb4f0163cdec82d9543
SHA512 a5010cfc29ca4c19c2a06f825019fb3ff9560d8f5fed4afdb5f19751b2d53919956a49046ceb61fd17e4b45f858de07125a6175dc4c87b33db1636d772e0ae0a
SSDEEP 12288:XpJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:XtdCN/j2GLl3iFSE33b9
TLSH
T146752364E9F6B659F15AC37943A9DF519100FEE8F626448786C156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 c60495cf77bf76f0706d252aacf77225045d82b4d37467362654baefade39816
MD5 eeebc476aa2b27c411e0acb460ecf5a4
SHA1 39b7c960f3f53ba1a922d0cd00791920eff0e7e5
SHA512 64f65d904ad93ce5ade17db82801d182fcc16f0646bd7a84cfa5b06a70908d0983fe0dae851b65c13568e3ae0da3089af55973204ec3af4f8abcc4c0fd15be9b
SSDEEP 12288:rV0JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:6dCN/j2GLl3iFSE33b9
TLSH
T127752360A7F561D5E46BC37C83B5DA21E220FDE8E73245CF87400AEB1B75BE89432562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 6b7d7a79796ab9fdab2206079ea0d159fff21f82c36b0aaf31fdf5735b056648
MD5 4d1dd2326bd70a9cf73a7a7d488a8a2c
SHA1 e728ed1aceb52cce7d653ecda1bcd3783d0172c5
SHA512 545ceea51e6618e6cb73f4ea2b29359ea188d986b32e4b2989a823fa0c91b181e4d34d480a776d7bc1f00f3d87a00c2f7646bbc9c7dbd986d14976b985455ee4
SSDEEP 12288:xsJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:xEdCN/j2GLl3iFSE33b9
TLSH
T100752364E9E6B659F15AC37943A9DF615100FEE8F626448786C156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 3b9df1557486714cb9a7853d3b7078a830bf216fb473c98da9c8435b2c3957c5
MD5 f681f07d573b4358dcd89e89d8ae1ada
SHA1 81cd3fab30c124a710ffa9b4602d310cce3b2bf7
SHA512 7fe521886b09ead27ae5771a12541497f234924b27ada061332612924c4054361d618a48a49bf2c7c495deeca694306037fbd56153d4fdda720ae8c627b21ab2
SSDEEP 12288:/LJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:/TdCN/j2GLl3iFSE33b9
TLSH
T174752364E9E5B669F15BC37943A9DF519100FEE8F6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 63e2c84534e124fe150b7c8db635398d3201a241b139ea9a57b14fa57913cc12
MD5 456a6c9d5f9a737c0db96129d4052f43
SHA1 3244aa589701e70dfd9c3b7a5b2cbea1e9aa9057
SHA512 cf62a2b763a032c3805921d8e03adca33da65e166db10f69f2441f5892ecd388fb96eaa684d403a9c73b641ad174adee32467dcd70cb55143d3ef51a0c0adf0e
SSDEEP 12288:A/JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:AvdCN/j2GLl3iFSE33b9
TLSH
T181752364E9E6B659F15BC37943A8DF615100FEE8F6264487868156EB237CFEC90320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 13d4079350b8f52f0b8d6703210f7e3a6e71442b20f6eba7a5cfda8b82a5431e
MD5 8330b6b76d60d28667db0b8fb2c6f06f
SHA1 7961f07c83ea566bf2444a6bf32635e5351de8bf
SHA512 9bb05ae0bd3a2cd500b0e641f6061205e775bc22a52d8f0baba895680f911be6774f7b123d1f06a8e037da21b83754c1d2491cdfb135e26efe50c03ea05dca9e
SSDEEP 12288:riZwb6zzFEoS2cPvynJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:WZMSzFVSOndCN/j2GLl3iFSE33b9
TLSH
T1CF8502A4B39018F8EC67823EC9658916D2B1BC594770C64F03E4366B1F377A15C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 c1258f95489b6943b9b5778a2e06cc7baaff54287e6b7c4a36e057ef8413395e
MD5 39ebbd14c7db806b6854454b01aa7f10
SHA1 807b1ef9983ed2d715636f9f9ec7d103efa31706
SHA512 d994a5ac72219e901c9fa5dd97120235589b8197c62bf36f074dc20585fc51dfba73a22c9ceb98d81618e151ccb6df89b69788cdfae46145e5fa745abf4dda6f
SSDEEP 12288:02JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:06dCN/j2GLl3iFSE33b9
TLSH
T1CE752364E9E5B669F15AC37D43A9DF615100FEECF6224487868156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 d1a2f63eaa63c19da6a7d7d4bf86c587b87394cf9f41013e932cb2a9697b4f4c
MD5 b185c570d5b78b727814bbd083e2f4ac
SHA1 41357370317b9aa3a5118d05f5931b8a59c9ae92
SHA512 855458fde792edfb2af091c0a6d9332534862fa486bb85abfbde20c8a76e1379c9264891c4d6b0249bb7e5f83255c0e81836ca3da279d09bee3ed8c095088465
SSDEEP 12288:FCJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:FedCN/j2GLl3iFSE33b9
TLSH
T1FD752364E9E5B669F15AC37943A9DF615200FEECF6264487868156EB237CFEC8033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.7MB
SHA256 992611db7ff0bf80fb7eec42a4474eb53a647d9daee2c52ea102124c2324de46
MD5 a47d35b0d59b2ecaacfad45ce0ab5ac3
SHA1 2ed091bfd64bd2bcd5cbbd13879bfcf483bcaaf7
SHA512 c0d1588203ca7066af8bce94b547ec4d6b2e5f5c0a90b5bd092c4e132ea7ee4fbf23adc34968ccccde1f757820431cc4141528c6fa99cbfcfa295de9c8e8b4bd
SSDEEP 12288:9yPz5L8TJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:0zyrdCN/j2GLl3iFSE33b9
TLSH
T1BD850257B3A130F9D177823889A55A11F331B87597208A9F43A007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 6e8cc58d8be454040deb0064bbee7ee6a06139b7f541807493fa7bfe59140e5c
MD5 7567771a6f97587e9a87b6315584759c
SHA1 a301a58d0b5d8554a034aa7385991a79d4fb5ef9
SHA512 cd94d2cf8287373ad91d0b26ca39fb7028c2e4e0279bd74e1f61f5b48f4be93f938e0b365bdf938cffc1a779312e955953d362a53678ca2b4d462154452fb86c
SSDEEP 12288:L2JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:L6dCN/j2GLl3iFSE33b9
TLSH
T161752364E9E5B669F15AC37943A9DF615100FEECF6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 8a638525083e43eeb03f1f7595889bf3385abe60f554785c24db0f4fc162b3a9
MD5 708cf7f59a0ec03e614b63e03b1fe012
SHA1 5dc627ef04d5fc0937a7dea7f5dff9369ec6e14b
SHA512 db07d7bf4f341e9ba214fc883a5b6027de69b3b01b300c6fa23e0570a82bebe1caf9d4c4651a915f1995a68683574db72f758603701cd8f13cd32ee69e81fca2
SSDEEP 12288:X2JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:X6dCN/j2GLl3iFSE33b9
TLSH
T147752364E9E5B669F15AC37943A8DF615100FEECF6224487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.7MB
SHA256 c918d7704f08f5a0c79fb1df3e6a5e4b1a1423ef38a36a524f31e377d5f4918b
MD5 4e7fa67e2bd1e994035a023dcac36f6b
SHA1 73de33863fe77d63c327c51ac8ec845c75539838
SHA512 c3247d79dd274219e6baa76f4002990a87a04f3312c30180d35a6b766a4e345683d5df2be213df44cd409631a4e9b99a9cdb6312b11a27e5c16c018eb8436dfe
SSDEEP 12288:XyPz5L8TJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:azyrdCN/j2GLl3iFSE33b9
TLSH
T189850217B7A130F9D177823889A55A11F331B87597208A9F43A007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 2241b4e0d20204cb6262ab804f0c10dc05ed850e5a7aa69e133b9680b86382fe
MD5 1ff695d2de7df8014a411774bc5a5dc9
SHA1 ef88c1e2db6de196d1d83be57844b7f45e68b0a8
SHA512 d56a5a0718f84f07d01ab475cdd2d8cb46998c77d4fcbafa7ed5e553200085becf1eb9b0a5e972f0fe5d8728f82e7b4c8dd33e4f201ab3e01c9bd44614ccc243
SSDEEP 12288:8Cd9eWYoaLHF3z0z04PDvhZJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:lTHaLl3z0zD9dCN/j2GLl3iFSE33b9
TLSH
T1518502A4B39018F8EC67823EC9658916D2B1BC594770C64F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 2.0MB
SHA256 c6fc9a627ffd5db2e6627cc12603856adbbe53d9db8c618d670d391f71226137
MD5 1619bc8e035c7bf896be040f022fdc8b
SHA1 2bcf06322cc28a5012d27c70e374c82ecfc2e848
SHA512 b7fdb5dac12f167e00ac38785dfdd1c5580b819e684989781da744a9059b72fe5d0090d7a3d4e03ccd14181633bd4c5cd339cc87850f1bbb6ed7e488a47b5e44
SSDEEP 12288:ai4e7+RdTfgwCHKy7GLbbdIvQJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:a37d9CHKy7GZpdCN/j2GLl3iFSE33b9
TLSH
T1AE95CF90F3E414E8F0B7CA3589769511DA767CA95B31CA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 18588666fc7e936a90d065f50c8d8aeef2b2a25df7f0de1e5fd5ab6c3069db90
MD5 0622c99ca20360259e233a2701b0d3f1
SHA1 21fb1c0d082157e8dd1e154f25b58d42c48546d4
SHA512 25adbbcf9fb01b4b8ae0367ab46ad3d7eaf7d5c9240cb7fd89aa007dc99f1d0419f846d40585281218e5df05491bb700502c9b3dc4ff61b2c33f1a84a833da4f
SSDEEP 12288:EJJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ENdCN/j2GLl3iFSE33b9
TLSH
T1FD752364E9F6B659F15AC37943A9DF615100FEE8F626448786C156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 c7db2b933f744d19a173e20748dc05f878f67e5c9cd3e3c012cb30a1874a8683
MD5 95fa70687fe516cababe49ba57cd3706
SHA1 732adf029374e41b9e9b28f89e14179cbedc6699
SHA512 bec59cfba6c4201134e83db2ac16e4940e204460a49f188413966ebb688d0ba44da6ad830278bee504c77fe9e381743a305d1849d47ad7dc4b7635cb52cdd883
SSDEEP 12288:FzJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:FLdCN/j2GLl3iFSE33b9
TLSH
T1A4752364E9F5B669F15EC3B943A9DF515200FEE8F6264487868156EB237CFEC8032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 2921af3e2c4dab2b39c6f539cf709d83f78df9dd468fefd65da1622b0dbe0050
MD5 b27043d0433a5983cf4a2129f8dfd7fc
SHA1 1da5e4f182ddca3224bb9617b02d982ac9c63265
SHA512 bbda7a1d6397421b4308d74620534030f8b09deb61c3c3797b89e11bf399fb931a02a947064ed575d6cafe21cf470b17933559774696dd18cd9ac92abaeef2e0
SSDEEP 12288:yQJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ygdCN/j2GLl3iFSE33b9
TLSH
T10B752364E9E6B659F15AC37943A9DF615100FEECF6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 d2c7e1ea17f14023fdab12b4fd7b88909e98b6d9cd967310c46b4fbf70863d78
MD5 4fbdaead6feaf341ad460169159c3597
SHA1 519b440fc0f65097c18441407704f5efa7a5bc9d
SHA512 96476c7d71b5204c699ad089f972cc51fb4a3058ea76c6a2f52c34ccdb0b759b039a8154459ac95b59f038b2e1b11288ecbb332fa10267749b923d17ebadac02
SSDEEP 12288:Y2JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:Y6dCN/j2GLl3iFSE33b9
TLSH
T10F752364E9E5B669F15AC37943A9DF615100FEECF6264487868156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 b2a165ac339f8793fa9ef724fc620284b7debe2dd68959a838cbc1d114505bd3
MD5 4f7fc549ceac00e1b488f3ccabad7dd0
SHA1 be401b4ae6fbf9993235a112c8dc8f5ced68bda0
SHA512 d611bf628cce71a2eb133c6afd564890a84f125b70f4c56f22c4e3584fb971999c47ea63d3c1fb7de5ffc63adcade7b5eefb921231802d63a9d2f36039f8339a
SSDEEP 12288:uJJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:uNdCN/j2GLl3iFSE33b9
TLSH
T15A752364E9F6B659F15AC37943A9DF615100FEE8F626448786C156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 2885768dd38a07120af8d9f1b7fd9a157b458671224a5560e67ccfefbfc76d5e
MD5 c3de5f1d9435cbc8e25225e4cfc4ea71
SHA1 f12b2ede4cd55fc2f6e90b93fa6e8c57eb0d423f
SHA512 7f1638475144098a2da26ded7f719c93b0f5b94c56e2a7fb86dd2a68a876a3cb74041988319f917bc5f4a8f2912463ccfe8ead760faf22030ca4ced8019838c6
SSDEEP 12288:CuJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:CCdCN/j2GLl3iFSE33b9
TLSH
T116752364E9F6B659F15AC3B943A9DF615100FEE8F6264487868156EB237CFEC8033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 466bd360311e428a747d0e27b70cf78a028904f9bca0cae1f21a386cf7fba39f
MD5 f43cad1fd06530276aded058d3af3dbb
SHA1 bf92065f3628c50adb2b3ce59de72752c3d73b0e
SHA512 a255788aa2896befd0422b856a4565a80d38dbe0d4f396f8547ef78594e4de2908ccd1e58adc9333f5c35c21eda846b8886fb09e1a01463876dcc3490cf371d6
SSDEEP 12288:XsJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:XEdCN/j2GLl3iFSE33b9
TLSH
T120752364E9E6B659F15AC37943A9DF615100FEECF626448786C156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 c2dbd0ec6f83ad31185d573ed9afd270b95bcde7b7175828767c3d0a5e2be296
MD5 89ee5e15180aebfe13b6644c7c90a86b
SHA1 4b183f209a64f0d6eea3c84dc0ecc19eb60fa1ee
SHA512 5e237b1b6c8643db056cc5e56e324111cdd68e23a0014a0d613d860625ed5468b4ba91bcba38b4da86dee5e5ae1e472d0040cee78abd3bb56467ce433e6491e8
SSDEEP 24576:ifwvok9RX6wkyAIOdCN/j2GLl3iFSE33b9:OMnYIRN/j2U4FH
TLSH
T1E4A5D029EBDC44E5E177923C89B7460AF2B178685B31C6CF029A53AE0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8bc1992cd2c1cbf8f96a195d02d2b9314f01d2c564f826390a24732dc2086a44
MD5 be700f850dc199dfde1c9bfbc430b5a1
SHA1 94fa7ad5ff1f75eb836817f7d206e9218f4abec3
SHA512 5be5c4da2341fe08643ac931d792d5a40f8062a2dc319aa77275407286633dc79d9e4be770789e7c31699d6140056bd9877f96d676799ba62d626ef894b51a95
SSDEEP 49152:oYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0mN/j2U4FH:2ySzPmj2jF
TLSH
T17F067C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2e068d592f24a76815970deb31f509ebacb90b6a064867e3459ae3524ac11b18
MD5 8ab2b94481c2ff517af8e17c65d84919
SHA1 26ebfe7fc3fc5b27b9ab9b523f02ec970613aa17
SHA512 7bf5368c4c0a0ffbff5656b2f4110d80760b1edb3b438d4e4f4a2f7c32db68495d3e947bdac4bf7be218ceac010071b1876d746deb92d6609b5dfadc30440c1b
SSDEEP 24576:K47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYXdCN/j2GLl3iFSE33b9:K47JUQj1irIhCnDHUPfF/WN/j2U4FH
TLSH
T13F65AE1DA3EC01E5E1BA827885158A5AEA71782D5F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 b47f6b0b7c39d839b5982930f827b4e8c892a7f4b189e905c50cd34a3927aa23
MD5 5e2aaed06c0a9d9a9aeea8a3bafafe95
SHA1 b250ffcb3d871530d1456f8d81b7bb3eff3d1eb5
SHA512 515242b951f7885b945b940a47b7e0838f1f28bd50408b2d39cdc29b177cc566603dc3b8ed1812a45fc8b0fe8cab08939a08018681fda672a094e685d7879d13
SSDEEP 12288:2NsfmJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:/KdCN/j2GLl3iFSE33b9
TLSH
T189850119D29412E8D06E9279C7558A41B323BCA493E1C3CB43C0F5BE1F7AAD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 a868b0b37190bee57d8b51abcb60f02bbd694f505ffc1c805be071442fb55536
MD5 9254805f252056aee1a0e4f353224c08
SHA1 8c25754e211c7f4010b461f91132ea7ba47923ab
SHA512 316906d795bc67ded7bd9020e91acad471f1439d538679d9b25736ca9e126860c1fb93e1524a928dcb100c567b451d0b3dee546ad2e34ce8bb1b05dfd8abfa10
SSDEEP 12288:XBkxU3f3B9C9kqbJXH5uN/79n8kk+oNfcDLDhx:XB8UPW9bJHkthj9oN0DLDhx
TLSH
T190453841762AC75FC6A940325E32D6CCAB703D15EE046F0773C8873F857666DBAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 e0323168666c3c3b7ce5ac743003a4cd672ceb98d4221a0ea575c4712335132d
MD5 785d06ef5b2048c5ecc45defd4e9d173
SHA1 0949acec426c7dbf5b7b2ce025720b385fb62b96
SHA512 decfcf0b660917c41e1abd53b75b17139fda6b7a4113bb5732b3f48cb97098b85bdf4b7f9458932c295d24b7fbec8df222ff868f459700f84795abca4115df9a
SSDEEP 6144:dwQ3P3XPHvQ4a71CZlhlotceGKB+RJU0c/hgjYVp0zUQj7bR1tMxNR1tMxNxcNQ6:Z//HIbsgXB+RJUxZu4p0zUQj7QSoPNJ
TLSH
T1F965FA816137E38FD1FB503203256B8DA764EC06B7456F26B3C8453AD86AB25B4B93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 33421eaef110828ac2c8d8aee83526471a477a90744edf7b3be111a5962f7878
MD5 a1b0ccd1b85913d6e14ff296a6881d09
SHA1 325cc178cecb3e0d9b72371ac3a3c2054fad16f9
SHA512 bc16eb46cb665bf25f3137f28d2485a9e70411825c85af3644ec6d1a73334b281fb081eeaf1ada4e11c067d62fe3000b418ed84d9bad9986b60df6f0ea353da2
SSDEEP 12288:XM7eJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHe:sSdCN/j2GLl3iFSE33b9L
TLSH
T1F4752360D7E9AA55F47A837802ADDA316200FEF8EB1184C7C54167EB6278FD8D832563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4c65f9f686d351588d1c979c43621ac63c7ea7df6023c9d21d1c042c0ef45def
MD5 3055acd96ccdb41a95666c096b2f11dd
SHA1 8e9c2c37a142aaa7726ca166e8e3ead846b4ea65
SHA512 9ed1199879be22d20698e35408c1a30062bff9a0a40c6ee5410dfcd8d07db4904dcd222c0bed1d2ae99c927b3ed723340bdd36d728f3d7fd7c5886ab2a60fd6e
SSDEEP 24576:Rgb6bmBIi49WNNFpg1rSvFv7bY4dCN/j2GLl3iFSE33b9:Rgb4mBIBhGFEN/j2U4FH
TLSH
T11765AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 c4de298837934312c8eb9187f68e6b7830121b914fe644d25042e9b0b05637a7
MD5 ae11ebeea51feefaa8fa6fd372782f81
SHA1 9bc0a7ae1d3053c9bf8bfef5b5f06db984476c82
SHA512 ebd602e23f9af34ae84eb5d82227ff3daf82c9bb6d224f4e7fbbefb98bd1a25ac9507e3cb7c1fbc2cf31bd42c5f355a29497dea917ed781149469f9351ec9078
SSDEEP 24576:7G88u8FpJqH1bzria7/mndCN/j2GLl3iFSE33b9:a7ZFPqVea7/LN/j2U4FH
TLSH
T19EA5F16576E101F0D47BD1388A864663F671B8251364EBDF07A88B961F23BE44B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 7d87bc65b0d686e77d9c7605e0ea3ff5b87ae18a3f4e350a7a8012e7a9a267ca
MD5 343c7faed929a88c3562ee751b03c8ca
SHA1 f5644169a512a4c672b3f669bbafdc70d9f93c3d
SHA512 75d2fafaab2ced59c9a55bee790cf84f4a7e9b17d99bbce2298a5823f2c76479d98256115a8582a09b0a7f8f7a7bec5b670fada188bb9f6df82561e29bd7de99
SSDEEP 12288:yHvUrBFrEjwaQbJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:yPUr+NQDdCN/j2GLl3iFSE33b9
TLSH
T16485F22E62E918E5E67AD17D86868719F731B8615312D2CF02D0817E4F77EE8BC39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 619b09824668fa6f82868966f49104b8314dd29c3c37b5d340e51e1b0506dd43
MD5 dcca11315015af0d4181a260f494d557
SHA1 455bcae0c23939368d7f09002ee2106452815e31
SHA512 008f8381cfdedf22a30ba0a9fe36543483365de39a442c6ad278a634b6d33424e5f530e39b5af957c5efef489010bfd12863d1c7716aff2cd4e755c3de7614c2
SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjQN/j2U4FH:OG05lO43b3j2jF
TLSH
T1EED5CF6A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b1fbcfb593a00a45951957f28f77ecdf3ee7b5b30f0a445a3ac5c6905311bd29
MD5 610efc4df58e1e2e9cad3c9045ff69e7
SHA1 9a2a3ade6cc93ef2c010e9c64bc5d59b237bd1a1
SHA512 3367326cca9df46149e8db44362aac2535c165282e26dcc3879ef88988cb8cae5b011134c9fa3efcea0f496589f6bf03ba57c897a070e9ed07542b0d772fac9f
SSDEEP 24576:+fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnRdCN/j2GLl3iFSE33b9:ma5POZ3+Jt2pasx2+moN/j2U4FH
TLSH
T18F65BF5DA6FC01D5D1B9D17DC5838A1AF5B1346153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b1787871f829d30c47cc6484646b73232f97cd3e0faed8e6885ae6da62403fcb
MD5 c4bf3d7ba982bc0ddb12432135205b01
SHA1 1c1513bffe70c56930906e29ffdc7c96af442246
SHA512 31bd6c8e9f4f1c62f8ecd9d53efdbc0babfb9d670186fe18bbc20d17e6800e433bceac8e03d3166fa71a8cf5ab50bb2c6179e52e973a9b006483d02343dc52a6
SSDEEP 24576:fNcwHdjbyQ4nLC18lb/EOjowL7Fk/dCN/j2GLl3iFSE33b9:fNc/zEOVHFrN/j2U4FH
TLSH
T1B0857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 92cf6c53c02eaf27fb1c6c66b367bb15f1d876e7e00e4f9c87131ae6ef82a1cf
MD5 5dd29398c5745de6c1c550add0af4114
SHA1 eb3039089acff594a1fcea64c72d0cd9052f85e1
SHA512 1d678db749d275f36bf3dccb30573ad5a67a3c55a11709724ad0d0e4feba19658f7d6c71f41b25dd485dc2384b7f916064534595731fa1289654740f6b44c025
SSDEEP 24576:N8kNvNnaFeYhJNtmZBmFdCN/j2GLl3iFSE33b9:N8MwBtOm6N/j2U4FH
TLSH
T1D755AF6EBAF846E4D1FEC6B58E238512E6727461173293CB4290C13F0E679D89D36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 408fd77a9ff806bed1514c0b2069194057bc3afcfd54bdede78eca978d2f4e4f
MD5 bb2d4c343baeb56b36f1ab56e7b81034
SHA1 c1dd545fac19354acf8817e78d25d584efa35c16
SHA512 257c81a07d1dde6313dd658b8ae18f1b4a82a20dfff3c3fd0bd890d2c0777005ab36f51bb211bc178f08197e007d7f3f3b077d95d3347c7e10824156c52a9e0d
SSDEEP 24576:MD3FHshBIYQgAmdCN/j2GLl3iFSE33b9:MDVHeBIAApN/j2U4FH
TLSH
T19F95E17DE69C04E4E57BC2BCC6638A06E77178A8432255CB02D481BA1F6BFE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1308-405-0x0000025839DC0000-0x0000025839F43000-memory.dmp

Download

memory/1308-325-0x0000025839DC0000-0x0000025839F43000-memory.dmp

Download

memory/1308-326-0x000002583B2F0000-0x000002583B538000-memory.dmp

Download

memory/1324-290-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1324-93-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1324-87-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1324-327-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1324-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1324-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1412-298-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1412-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1412-312-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/1412-99-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/1412-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1412-106-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2096-13-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2096-98-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2096-21-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2096-12-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2116-64-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/2116-65-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2116-71-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2116-242-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/2928-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2928-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2928-111-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2928-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2928-25-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3380-1-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/3380-0-0x0000000000400000-0x000000000068D000-memory.dmp

Download

memory/3380-6-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/3380-75-0x0000000000400000-0x000000000068D000-memory.dmp

Download

memory/3500-178-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/3500-53-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3500-59-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3500-52-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/4304-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4304-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4304-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4304-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4896-44-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4896-47-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4896-38-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4896-37-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/4896-49-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/5160-76-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/5160-77-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/5160-82-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/5160-273-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/5456-120-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5456-113-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/5456-114-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5456-310-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/5752-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5752-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5752-133-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5752-131-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5752-125-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download