remcos | 0103e500c0bc391825bf6d488b479f3bd575fbeab20c335d59c3129c14266916

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 04:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
Size 1.6MB
Sample260820-eybv8sbd28
SHA256 0103e500c0bc391825bf6d488b479f3bd575fbeab20c335d59c3129c14266916
MD5 def2779fb05d2a594b60d5a7cc7e1275
SHA1 35fe2d7668b11b20c6c1beb53da100b163113b77
SHA512 fe21f8d062802b457aaa00801490b051ee389ae7239d2e1aac43b133eb8400478e2f3108adc25d8cf8dd01b45c490fd06966ee7b5a6250822a4ef5b57f2871f4
SSDEEP 12288:ONTm5FFykZJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHZ:OQbYk9dCN/j2GLl3iFSE33b94
TLSH
T1D0751217FE57D1B3E41642B207947B22AF78EC71A6298803C781C6D2EABCD99D471533
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost discovery remcos rat spyware stealer

Malware Config

Extracted

Family

remcos

Version

2.2.0 Light

Botnet

RemoteHost

qh88best.com:2404

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
3
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-3I3971
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 11 IoCs

pid	Process
4148	elevation_service.exe
2628	elevation_service.exe
2580	maintenanceservice.exe
2680	OSE.EXE
5176	PerceptionSimulationService.exe
4580	perfhost.exe
400	ReFsDedupSvc.exe
2652	SensorDataService.exe
3156	ssh-agent.exe
4880	AgentService.exe
1832	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\80e41a4eb05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\javaw.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000531138485b30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c766e1495b30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d78d1495b30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb5af9895b30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009d3298495b30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba43a2485b30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000003e829d495b30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000088c86e495b30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047b82e8a5b30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
Token: SeBackupPrivilege	400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	400	ReFsDedupSvc.exe
Token: SeBackupPrivilege	400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	400	ReFsDedupSvc.exe
Token: SeBackupPrivilege	400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	400	ReFsDedupSvc.exe
Token: SeBackupPrivilege	400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	400	ReFsDedupSvc.exe
Token: SeBackupPrivilege	400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	400	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4880	AgentService.exe
Token: 33	1832	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1832	SearchIndexer.exe
Token: SeDebugPrivilege	5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
Token: SeDebugPrivilege	5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
Token: SeDebugPrivilege	5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
Token: SeDebugPrivilege	5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
Token: SeDebugPrivilege	4148	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5232	2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 2376	1832	SearchIndexer.exe	101
PID 1832 wrote to memory of 5268	1832	SearchIndexer.exe	102
PID 1832 wrote to memory of 6100	1832	SearchIndexer.exe	103
PID 1832 wrote to memory of 6140	1832	SearchIndexer.exe	104
PID 1832 wrote to memory of 2664	1832	SearchIndexer.exe	106
PID 1832 wrote to memory of 5744	1832	SearchIndexer.exe	107
PID 1832 wrote to memory of 6104	1832	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_def2779fb05d2a594b60d5a7cc7e1275_elex_remcos_remocs_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5232

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2628

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2580

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2680

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5176

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4580

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:400

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2652

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3156

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4880

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2376
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5268
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 2692 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6100
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6140
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2664
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5744
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 2692 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c92bb6f1c0e53749a04cfe9f3a67099dd66bda51efc206726a34dfec8533a51c
MD5 f3faf38b34b4a50066ba8ec55b5699db
SHA1 e2cdc0a79dd671ca668eb2ba14c2231793756b8a
SHA512 ac494e722df9383c79048eee51b45cb5d47f0e4bc758d02b6d3feeca79fd876165c4491a62243ad76134f92758b93edf387337e58545b2542d10783302330348
SSDEEP 49152:Qb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn/N/j2U4FH:63q6HjBwj2jF
TLSH
T19FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.8MB
SHA256 729e1dcf328abec7fcd4194a4a624a75abdde5720db5e09fd9e173e06a59cb11
MD5 e4e9fda5b4fce2659aa9dbfa4c36424a
SHA1 ac80eb48d06e61e26133ce3c248713762569a8b7
SHA512 6cbdae4a77a25091c42d4e7e68de92016b6ec5d1a91ced022a2b26ccd2b5144834aa9bd7c82cfce8cd36a89d6d0435842437f662c37b61e73008c8447f4495d8
SSDEEP 12288:E1XLsswWkxy2lRq2czArJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:CXYfDtczAzdCN/j2GLl3iFSE33b9
TLSH
T11585F128B7E409F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 3404a63255b2a5d4e2b56eee13f7c9e4b35a639abadb00afb0e87f4612f34bf7
MD5 793b91de708285436fe1dde44695666d
SHA1 cbb210bbe0740355962ec28ecbd2eaf8b8053d8b
SHA512 50ad9afe88b3a102171c2373b7a9ccb02c3e2b1757517ed612800f925e7c41e4339834500a75844fe0cd1f38831565d78e49e30df81d0c84b52ee0b6496fd16c
SSDEEP 24576:a0Le5ji0hmxirMsdCN/j2GLl3iFSE33b9:aPji0AcCN/j2U4FH
TLSH
T1CBA5AE26F6748335D073C0B9C5D2A69AE97130865B308ACB4286D77C3F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2658e6405926bd995a6b05a5f926f030be92b080d6782c9f27ec3c609c85a645
MD5 421cdf1502fe03f15fb41e0ea1a07295
SHA1 591ccaaeff376ef5affbec98c47ae47380781c22
SHA512 bf4dc7b1c339412bb226afb14c64a4ac2bfaafc1f93e015f2195a943664960685536bb47092cf8afbcb21546dd07820d10088a4fa2d2845ef2d28c330f35f910
SSDEEP 24576:Qa7/ezSC6vUyD/aqgrvWE6q8wyuCdCN/j2GLl3iFSE33b9:H/ezSC6vUzPvxHjyWN/j2U4FH
TLSH
T13C755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a7376a27d6f42686c1d69ae669a7eb0ab1c1b60bab944a235f535865d3482e81
MD5 a2ae1f44c6302f27ec84ddfd50ce4eb8
SHA1 5b8251855403dc794b27f9e682ad057a8d73b36f
SHA512 7e33383e4a90844ec5b5eb1b39c4d63b0186cf99e81227a6557050e225b00940d06e991b493ef8bfa6a40ec33c10c01b6a6da53de586ab3bbd1586c36e861339
SSDEEP 24576:VVbqPb88hv/l+6/dCN/j2GLl3iFSE33b9:VVO88hXl+7N/j2U4FH
TLSH
T1F6559E65F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 7f529e70f7bb8a56f9a7e98d54a6130e01c1273827d3fc466a35175a37f16464
MD5 5655cecf7fb1ec7a6e7b4d0a118494a6
SHA1 0db879449a265d7c41c2a850bb870064b5ec2036
SHA512 87839ebc0805a6d03cfdf8698e14a7a8ee8e0e792ce7fd855e33ea66df8eeab65725b9e9a9e0e55357f1e8be3aca337bc6000468dde8d591952f7ea5935e5c80
SSDEEP 12288:7R4JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHL:7R4dCN/j2GLl3iFSE33b9u
TLSH
T148752364D6A5B565F2AF837903ADDE615200FEE8E925884386917BEF117CFE8C033063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 4169ef1e80a3dc6b17ef3db31dc57727a2549707a0f08279eb21222478542ceb
MD5 7cffced19b0bb67b4821e6e75b476e96
SHA1 07ce3284f2bea6ada60dcdea3fa95d63f56bc7f9
SHA512 4521f7b7542df36adf914a647983f9d853843dd1d47f3203d803d5683452016c92bdd47ce7b7d6f707dd3b95c567b54de1772bcc8c38133580f1e2c7d1353f21
SSDEEP 12288:weBNUbTVO86U3JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:wJIUXdCN/j2GLl3iFSE33b9
TLSH
T15185CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 60dd141093479efca70057e2594cebaaa14698d829ffcfb3cb85286f285f9ea5
MD5 690acb98ad76c5c9de11968d672cc7b1
SHA1 aa8e518da66585f714a4232d2cf1d639bb2af26f
SHA512 c60b575de4ad464996cbb9359637d667cf08b7091bb66ee51304c80f5d33f886ee7b5170f0b7cb2b6f49ca176d1b13c88a84e6d647ead94b966b8fe0e28d79c2
SSDEEP 49152:oQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH9:oQvGAdlCEL8c/yRNw5C7j2jF
TLSH
T1FD267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 7aeb57c29e4bf142f8e97c495fc7b46fb089c82b1fe13fa4963895392571688c
MD5 b77143815e709b245f31011e5b00396f
SHA1 90e38bcdaf693472f0a65e69b2165a4998b257c2
SHA512 7840016c35adeaefcd78c77a8f6578d0fd55dce1016b509994c9c61b4baab1de850b8dc90fd04fa84d953ce03674f4051e08925da09babb47c1d9db9bd5be81a
SSDEEP 12288:PAwSfxL/2Dc34DLLmt0LDQewsAjZJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9Q:YdewsAj9dCN/j2GLl3iFSE33b9Q
TLSH
T15795E031FE74E436C2BF0DB61B36C716142CBA608B6119C3E3E84E9E59346D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6ed049caba856b9340f95157ee68c236e5e925c24a8df5148ea6495936105661
MD5 f11dad1b316744aee49f6782c45375b6
SHA1 36847153b49d66f610d03c15c50530b3831105d2
SHA512 fb155e2bd25a845a58c2472e0c7a793041f6de1d55ea7054271c97a4b037cba11300b03f89aebd1cf4af238212f654f195a6cbc05f04d52c2bfe5e1b12527e3f
SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHa8F:OUEtQevvqc2W1cpV2EI32a
TLSH
T121474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ebae37b41276deb300e0508a0b592951f1bbaae893b574786230912773778042
MD5 f011d008624d5951d2f45f1af14952f2
SHA1 5702036790eba71469d907d87a6eb6995f4e545d
SHA512 71c2a1d0a14f4000de9c4dfa3a99a5a1bc8fc3347e64b2e2e1b09b126f3109e82333d5b6c97959a0b5a3837f194ecd27c39b77005c67d682e709eea57a2f28ba
SSDEEP 49152:yCbRquA/m2yL5zQfFiV+XenmE3/zyN/j2U4FH:XoqtVjnmnj2jF
TLSH
T159D58D0976B8C2E4D1F6C37886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 35da0cc70c4d850492af7eb97fc09a2c664f194a48c15e8fd41e1f7255892359
MD5 bbc8cbd9380d8e4d3c3545c8ad1d845d
SHA1 76dd378eef2677f6c4bbf4076c415b5c78319c6b
SHA512 893589179b7b246447f303219e6084a2617a23aba58b08630dd3587a31b5881e1f7b6e6eb064586af2922e0d953acba32f3db3281ddbe94b592652095921ac2d
SSDEEP 24576:BAhGLJIFoiwtA5l7S53GdCN/j2GLl3iFSE33b9:BAMyFoiq55N/j2U4FH
TLSH
T1AD35AD80E7F955D4F5B3AAB899B68571EA72BCA95E31C20F1150D21F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 7196f0cf7eae39ff0c8d5dd3fa2aaf30aca7ad0cdd828faac9156d354cfa5609
MD5 c6b5f3466ca380be0e2cd3ace74ff743
SHA1 fd32363220d551eb5ad0de5ed7396a3a54a6583c
SHA512 0590df8eeb37eedb1b8dd7c8f3b098f4b3694b9f4202ae9c54d1276c9086ea80944b4b80f4b8896eec4712c6965e685e0bd925b70b22c41e10b760bffc7d8c6f
SSDEEP 12288:wmw5HEjsChNVBFgl0WDm+COJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:twuoOWhdCN/j2GLl3iFSE33b9
TLSH
T10085F14577E41CF9E96782388697C536F7B2BC512A21CB0F03A0C69B5F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 be44ce2d7826f582d8c19d5505be3aa56c20d7f3417a2cb525eb5bf1547a69ce
MD5 1fba4388879391c4653ee16b790f95f5
SHA1 cdd44942192b47a61d172c1f31d1f5f5171d2069
SHA512 0537ab0054fe4f3dbb255ab7e3f4cb4d6273c34eeff1e0e4676af72315e1c172a15de5464dcc9796c8ab1e83c566eff31f812e7171c551f50bf6d45f5b1dfec4
SSDEEP 12288:QBZ1IyJJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:OZukdCN/j2GLl3iFSE33b9
TLSH
T14775125933E471F9E1A7823C8AE59A05D321B8A5A73243CF026147EA1F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7da755722147d051b138f14dc4f7a95e3fd34325d5b3a004dabec1abba9ba15b
MD5 e0805737291a1791f633d31f9df31a28
SHA1 4762f0da260e8df999deb6071175e3e33bae2fae
SHA512 dbcf9639bb6aff72cd25fa7f28477f586cd332ed4f0eeb5d4f19cb34925d5c66def57cadc8f6b0aa92ddf3b314a068914c86c1c751e11beec628b5573fb66b58
SSDEEP 49152:Yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uh:fQRQyi36YOcPQLvw2gAf+PN3Uj2jF
TLSH
T173667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ba26cd03750de65cd6aae98c3573dd53fee4b1f061a843386d1e75a6d20c0dd6
MD5 967b4c6becf2fbd6bb88ed263c3cec5f
SHA1 e159c2db2b3a71dc2a5973063e1b44f119822719
SHA512 2ee3f31712dc3b787cdd622e19614d119f0541a39fd9049256942e4706de55ed8ce6afffe169211ef84f8a5c3d19ae9289698921a8d64127bfc0f53f724cc878
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uh:FQRQyi36YOcPQLvw2gAf+PN3Uj2jF
TLSH
T18E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d837b1553e5f4811cabcd3e4da833235936d41df47a214f2d1a147065b1d4a7d
MD5 1a84eae3fff05f38b42281b980d80128
SHA1 26bcc62a06faa5ae99a0dd1ddd6ebe9ba5cb840a
SHA512 4341ae3769e449ce9dfc5d597f9f040a1e1013cfb439238a586ab10bb5b1b6930ac5c51b194ff5b2d50173718304ad9152ba0f4c20b6b67d5a0bd158ca7b35d0
SSDEEP 24576:nwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0UdCN/j2GLl3iFS+:P68Qg55nhheWu7PNU3/CN/j2U4FH
TLSH
T1FAB54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e7181c33f9d1b892faff1d9f8ae5e7dd9b47f61860bf627fc102ec5bc135082f
MD5 131a3716b11c834434f0a49b3421a227
SHA1 cde035c5e31150bb862f647b86f6432b54dfe0b4
SHA512 f8fcabfb360e282b2f66117d991e6691a68ed17b2c190493e69d8100e4ab3ed90c395f929dcbf6d34637143cb2bd9a393ac89faf3b0d10bb44a86decb3341d26
SSDEEP 49152:T3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99L:Gy5112gYy5azzVvL69nLKnhZtj2jF
TLSH
T15F168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a29c7d645d71272293cc65ca550b582de6e2b5e93653ac573c8433df11df0167
MD5 43b106b9a73388414b73970d3c12875f
SHA1 9efb21677000441a12a50c872af3f6bc1555831e
SHA512 99537925b410e20a61eb401be68f835223f0e701d6a112cd8f9f9f747f8a03b217d6357bac515b619d0562e93468539ad32891c12e4376b53c807c0a4dba521c
SSDEEP 49152:JB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glgN/j2U4FH:fu6JmVxd2dcj2jF
TLSH
T1ACD59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 03bc8d69b6b578527c5f13dfeaa7790a1d2a8be6aa7dc6399dfbfa64962d5ffb
MD5 39e7e8e7ec274c7cde24bbd6431852b2
SHA1 7ef63a91f3a4790d00a902ad19442b57629b9a63
SHA512 0259678de10281f3412eee65f0e854905cb5360fb27d5d10e6ef6a25f88ed389e741e0c6e604382c2a4a2209771790c3e30240bae5e32e47560609c198e3c78e
SSDEEP 49152:R1hpsNoJpF1A6UU44CwH7R4xkN/j2U4FH:RmifPbRnj2jF
TLSH
T100B5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 208f60b5b56c240020038c07390e33e2babeacca89aa560e2e94807b292a6002
MD5 dfb108e353ff92ba7afcd22475511246
SHA1 e9ba0cbdad5f048bf0b9dd9552fe0f3d74b400cc
SHA512 4b405cb33fee964ba484cdd52e348124b1abade9f4b9ed090f7694e8edd33dfbb8eeaa58b3ad2e2d635e34e2a03943a279b9c906b748de140d2f9fa172b48900
SSDEEP 49152:JSuZQIY0Be2KRRVtOnks6NMHqPN/j2U4FH:H5dKTi61Rj2jF
TLSH
T10FC5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a82dcaba3e7cfdef9598b663371d959bc926c4ab751cec0d29bafbdc9bec4522
MD5 714c69141c2c709397ed7962d3791b14
SHA1 ff2237e835fe32426b0fcbac26cb81022d8d92b0
SHA512 05ae74f451172b515b8554d569fa5ff51356ac0ad2f6996c043c890ff2a43f081009183f5e0f834e45468968eb0ba650ba2a40bb29a20cc195505ba5f2dd1250
SSDEEP 49152:PhtSn8EApI0figngiDn0AP5wwN/j2U4FH:eX2iyphTj2jF
TLSH
T18095BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 d21327a7e328f8a149b41b578c5d76c79ce0aab8be80c5dd188690dda5ca550c
MD5 0cee681bb8cb6b98e8148eda1298d290
SHA1 e1a1e1ce31c06f3ec619f3d5aae6d70b554152e2
SHA512 e77a1960cf08c7f03aa5547fca74f430736c08ca641f32c2f8344944c64dd1c6c56c96a991c5325714c4a72ad270748b063479cc04ef529488acb4c38f8c040d
SSDEEP 12288:LAJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:LwdCN/j2GLl3iFSE33b9
TLSH
T1E8752364E9E6B669F15BC37943A9DF515100FEE8F626448786C156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 80df7432d8c7db00b2835068540c1a697713e4e00bfecb297d5561916ffd71f4
MD5 62ea9b0782f67ea03e82028f7f7442e5
SHA1 04fd8abf7bb7cdb6415ce0fe9007004e671630e0
SHA512 5e63b2f2fc06f3d4c094b7316c5eb55ed4bb9fc86301d221f10115730766a7c71e436dae2adc41237ff8e42e9e7fee8d6b1efc20e6562c469e2381f982ac62c5
SSDEEP 12288:ydJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:yJdCN/j2GLl3iFSE33b9
TLSH
T1BA752364E9E6B665F15AC37943A9DF515100FEE8F622448786C156EB637CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 0ec2315230913a62fb03fbe17209e43a5c9acfbff379876c2f993033349bcca2
MD5 45626c2691e2dc6e3576804ab623db05
SHA1 3f7461970a9a8e0bea22b6538a9c8950a092d6f0
SHA512 382d9b6d282033cc4ef6da2663b86d172d7d4c114b546fbca6cc3e70cf1c41b2608d66cdebd2e85cd4971ed92eb274e4ad0e374f4dd63907c2ff4090a17e2d6e
SSDEEP 12288:z/JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:zvdCN/j2GLl3iFSE33b9
TLSH
T1A8752364E9E6B659F15AC37943A9DF615100FEE8F626448786C156EB227CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 6fa49ea0690ec0c2ba4b78b32f77d77964cb779fdae7992163134b700d9bfd4b
MD5 12e4cda0fcf8f1cd69b369689e006b77
SHA1 f0a68e05bf6f0e3ff42c69dc212f327afe273307
SHA512 3827552f815d95d5529e80c8a1e7f5e785ef7578e34ab2095e7cd3b6fed00da409c189c4e86643f10ac9be9d30385bfb67f0a3cfe269a8f87541cbb0cc48c0f5
SSDEEP 12288:AVaJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ndCN/j2GLl3iFSE33b9
TLSH
T18A752360A7F561D5E46BC37C83B5DA21E220FDE8E73245CF87410AEB1B74BE89432562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 55dc02fcb6aa17a600c54f5d9ed444f229c90b9fe5175e8845dff6bd2fbf44fe
MD5 4f589c38dd72b272020854778edad6f8
SHA1 e2b55a87baa4a1a028c78129645fcdc8534d3982
SHA512 2f34a54a7d12586d77a6491498629b8c65c03b08e290914f5dca307f7941f01c2b76e6639e85fd4d1b919281f9b86b27d552f4d1037ad9fb94f648aa8a72de44
SSDEEP 12288:9yJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:9udCN/j2GLl3iFSE33b9
TLSH
T11A752364E9F6B659F15AC37943A9DF615100FEE8F626448786C156EB227CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 6e923db7a87eb75105aa78780e3fb721e12e174004d16fc9aab576ad2d58a08a
MD5 0ee71144b6fb212ec961a8a742a9d2c5
SHA1 5274e24594d544afc80c46fb836be46dfa483827
SHA512 a7a0b680fbb30bf55710d3990c94b3b395b3b9fd35f05926d2f08b616e5af412dfb2c5cd5397b72111f45d6ef5d07da1cc6a5e4ba1899084c7d78923d40fb8df
SSDEEP 12288:2hJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:2VdCN/j2GLl3iFSE33b9
TLSH
T1A1752364E9E5B669F15BC37943A9DF615100FEE8F626448786C156EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 909df7fe048552b34b9c664733b06bbbf2d1f5b2229484aac9bfbe7e263f9f85
MD5 2a7d0aaced3a7e78605901fa340d27d4
SHA1 5a4a7c5f34bf157b3a9a6f745c497ac6d5e3c455
SHA512 38d933a018ee8a0737920725bc37f1d655c3ace442529235a4c518e305a4ada8fcf015edbc36f07d1c8cd0dd9a1d0be30237b4df5445f9676513da9c919b2233
SSDEEP 12288:S1JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:SRdCN/j2GLl3iFSE33b9
TLSH
T1C8752364E9E6B655F15BC37943A8DF615100FEE8F6264487868156EB237CFEC90330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 86ea5c9d1d05aa8dad259a92467f8ac0604ddad1517ea42b5d8789999f6704b6
MD5 27ac2d309d832203d470e3beeabb100a
SHA1 f3aa63f69fcbc57502eef04cb22a726bf67adf07
SHA512 9b205816f77fbaace90d9a0ec3433293be361b643793d44af3f1b293fe2d61bfcb5fd6da36dbf33650b58b3fb12c7880274766a0a58e72435ccdb31b51a20283
SSDEEP 12288:AiZwb6zzFEoS2cPvy9JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:DZMSzFVSOpdCN/j2GLl3iFSE33b9
TLSH
T1388502A4B39018F8EC67823EC9658916D2B1BC594770C60F03E4366B5F377A15C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 9389febeb23c510ed995eb3588b61f512fb5bf72629f39ea6da6ed0273a8b1d0
MD5 15e829999f40fd9e1cb90570c4fac48f
SHA1 02b3cdc740e09ddd89f4c8a62f001adcc3356267
SHA512 53372a3c2abfe28f73a2d96f7ea9630cc7c63aa41d350cec5caef079b05074d835cda64de772cb7f12a8340ed3b000e22f4ff1f0b94709357acb642b095ee5e3
SSDEEP 12288:n8JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:n0dCN/j2GLl3iFSE33b9
TLSH
T10E752364E9E6B659F15AC37943A9DF615100FEE8F622448786C556EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 0f4edf3a1eb7b207687680c13169eef916703ef55aa27a59eb12de913ba7db29
MD5 d476d5ad926d387ac804eff6bc7aa112
SHA1 1792b6ed4ed26e761831575fcd070bb1032004ed
SHA512 4e28fd95650d8774790dec07011218ebe5718e9b38f13702bbf96ce7d4b173c7177a516d88746143323346d126ef03cb76df9ae1967ed683bffeb768c111d79a
SSDEEP 12288:BoJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:BIdCN/j2GLl3iFSE33b9
TLSH
T1E3752364E9E5B669F11BC37943A9DF615100FEE8F6224487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.7MB
SHA256 8151889aadef657d3528ff8472be94228b472c3ec22a3eba2cf0b34d49eef606
MD5 22c2a04c5a08cc33a66fbea41d9f9307
SHA1 623649c38bf83b2db998c0158c3fdaae13d9cdc1
SHA512 c5a8e1ae1fcee806b333ccc841bbc6deac5b46f619cad7267de573e11d7bfcf7cf0efe1ed4417ef946baa5783f1ae29b7d0a6fe993384705941bdd3bc480953a
SSDEEP 12288:0yPz5L8JJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:tzyNdCN/j2GLl3iFSE33b9
TLSH
T181850217B3A131F9D167823889A55A11F331B87597208A9F43A007BB2F377E49D3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 b993c6ff0dc35c660e4e55c2fa48f505ad292064fd702c45ef47ad8e33d7f5eb
MD5 9479acde599a599dc4d7b46cc07694e0
SHA1 6a487d041624ff6b7e868c15ea6432d308be3dd8
SHA512 8db30d8701e19aa68311323b2695504c146ece48b70c6a6b08656ac7bfe9adfe1c382e1dfb489166c82b139b9eaab657a3d49aff7b01d4ed6a2560fd60349ed3
SSDEEP 12288:n8JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:n0dCN/j2GLl3iFSE33b9
TLSH
T1F4752364E9E5B659F15AC37943A9DF615100FEE8F622448786C156EB637CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 96741d5501c696d3f19f9d625239342eec8e2a1e0d25a5669aced0c4bbc2813b
MD5 e80ec1fd31d1666cf1d910f6ee5ebbe5
SHA1 37bdfd8ad41698672fa7b632b8214067da8d33f5
SHA512 f3e8005fe6ea58e4e15c17c5774052b100cd5642e51856346a22f067bc71f43a71f1e7bc74678a7ca0d8291da08ac12d48cd671883b1b3807bf42313f0d54261
SSDEEP 12288:k8JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:k0dCN/j2GLl3iFSE33b9
TLSH
T1DB752364E9E5B669F15AC37943A9DF615100FEE8F6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.7MB
SHA256 9298e950f176ca5471f2f18e6e7226400cc3fea7498c976e970e405a53832377
MD5 2e3cb9e1ef1ef5e9a58557418ee3e4d0
SHA1 5de9cf20165c437fda2b92199e2b47170b09438d
SHA512 9ba5517a57f8653d645c8b5a95b9ffedfa9236cc3d1f89a52587dd54a71424c885ea5de01a2d6780b6825bd20117d78770ec623391772e1bc260f74843da4106
SSDEEP 12288:hyPz5L8JJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:wzyNdCN/j2GLl3iFSE33b9
TLSH
T1C2850217B3A131F9D167823889A55A11F331B87597208A9F43A007BB2F377E49D3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 f2415ca81650b6b1a82175f2214d9d9cddb9359912f34e2ba0d3814268cecd03
MD5 14c410e09a1ff93c66ce71bd11d0b700
SHA1 8e5b36948b79837d15dad152993eb2d54989e6c3
SHA512 7cb92a4d17b3683642463b60ca250bb47b1e517395361943a6cb03a4b31f882397c410432a8d047307eb7541e313ed290b4f8907578e9d42151743bee4f303dd
SSDEEP 12288:8Cd9eWYoaLHF3z0z04PDvhPJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:lTHaLl3z0zDfdCN/j2GLl3iFSE33b9
TLSH
T12B8502A4B39018F8EC67823EC9658916D2B1BC594770C64F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 2.0MB
SHA256 4086d14c2edbff98c0b8a296bd185047f937ed7a4438b31fbc1abc3dbd241b2d
MD5 14ad3d5b742d11bce2a4cebb96207825
SHA1 41c9244006090716b0044345afe59a73634fbaed
SHA512 2901636076f178931a7ce74faa2a74842d75c87fd01de384706ba67992450605575a61a9516d28a842e282584d09621839c4180ed64397b57e13549aefcc3a21
SSDEEP 12288:9i4e7+RdTfgwCHKy7GLbbdIvGJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:937d9CHKy7GZrdCN/j2GLl3iFSE33b9
TLSH
T12395CF90F3E414E8F0B7CA3589769511DA767CA95B31CA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 1c11b9a047104f8e2fc006639fe8b23d1e62edba2fd82f7b8754c002d0f44b2c
MD5 2807b828af08d7b4e2ea7ae919b9c4f3
SHA1 65d9701ff9960adcecf27925c179a52afa518687
SHA512 c690c88c217c290e3cd4ca01fca8ac350503f6265d3548cbd8483d9c69260c4ac08e507d5a9af2719691e9f4ad419132d33afb7ea22e6d5cdc48d329fad3cbaf
SSDEEP 12288:cfJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:cPdCN/j2GLl3iFSE33b9
TLSH
T118752364E9F6B659F15AC37943A9DF615100FEE8F626448786C156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 fa429a01aa8e9836b33bd8007305ab53758a50bb0cf7aae55e4e3fe9cef43378
MD5 f562b45fab3c7744a9b8f8a3310a462c
SHA1 a00a467100f55759d6f83488fffe347b8f21ab6b
SHA512 215cb91f8d8338b28fcc4f9f0f62db8d5ecc17fe623c46dc90e72cfeba31dd3c7bd35bf1949003393a2b75992c30643da27159ed5e081384a76989d2f606275d
SSDEEP 12288:RpJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:RtdCN/j2GLl3iFSE33b9
TLSH
T1D3752364E9F5B669F15EC37943A9DF615200FEE8F626448786C156EB237CFE88032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 16117f2c11661be268ab832a9a9619ccedc06d782e38a2f7b3fa0a45a2df6ba9
MD5 89e93b2cbb7aefefb8aa3a6029cca8c0
SHA1 bd54461338ff4cab081dd9c5e3c8e0d9321a6685
SHA512 56a5e330d24dbabd65eb9740ee3d21e98c66c133a6340f53e102d1c6f848707bfac4e6739f72984d68beaf1a00b8c4ed91a374d458196224844a32405566a0de
SSDEEP 12288:AGJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:AqdCN/j2GLl3iFSE33b9
TLSH
T1CD752364E9F5B669F15AC37943A9DF615100FEE8F622448786C156EB237CFEC90320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 e80fa415c4930382e24db8775e5d6978369e7b1dee86ca6bd920a4dfdd6df4c5
MD5 21218cddd75af3d286b4d30d88f8d70d
SHA1 113ab507e7eb3e7fdb2aa87bfaf89bdafe3a41b9
SHA512 e4b494aeccc7d43dc54ffbcc455719f2ee169bcbd2b7f10a1a08d63e794b1c0c266c4225a254715f56857866e665903d49a86ec114dbf744f17a9902102d4b65
SSDEEP 12288:T8JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:T0dCN/j2GLl3iFSE33b9
TLSH
T109752364E9E5B669F15AC37943A9DF615100FEE8F622448786C556EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 c1b250ed0c8db2a1b6980ce8019912cc36c1c19e6bd143c4943edff713510d1e
MD5 83c72a20948e20740b6b29716606e02c
SHA1 4ab42627a55ff3d113a75512bac031617f6f0bca
SHA512 dca13ceb984dbd9992bf4c5d70bf1107e069d0eda544f6a0ed3dee14e35f3036972156ddbc2e390f4561a216650a1226537415983b47e21f11ac5ef6000bfe46
SSDEEP 12288:ifJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:iPdCN/j2GLl3iFSE33b9
TLSH
T123752364E9F6B659F15AC37943A9DF615100FEE8F626448786C156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 ee97747c973be33ccb1a67252de73dcd73a4a249f4aa86e8bf68d40b222c5ae8
MD5 79c6948363cde78b648fca7de5940d49
SHA1 a86252b3518afcf526e874a26a01ad80055d2cd8
SHA512 ad55188a6f0f77b822dc7f30ac14dbbe4d5809c047d7c9ced6d3dc2b9c1450328869236578d30eaf481a92e628cf7e6755dd42c537970d8c71286dc93b0055b9
SSDEEP 12288:NUJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:NcdCN/j2GLl3iFSE33b9
TLSH
T14A752364E9F6B669F15AC37943A9DF615100FEE8F6264487868156EB237CFEC8033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 2e20c30ec96f7e2a06882352cc49896187e1f0503f8de34094f18880a3fd55ac
MD5 5e7e92470307d2a78804a2326ede3d6e
SHA1 96e69e12e80669371ed1e5bb17d28c82a72aadbf
SHA512 157457d09609415d5dc800a42762c20dc0c79b42b1fec9b139f378e00a3f4a589ac986c24206402fd64242e6dec8a78b665c872d467c41782a7203862b88fbaa
SSDEEP 12288:+yJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:+udCN/j2GLl3iFSE33b9
TLSH
T104752364E9E6B659F15AC37943A9DF615100FEE8F626448786C156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 7161472c790dfdd5c567c9c49c1428a22141cad782edac13890adbc6c60c5b84
MD5 69f015dbeb9ea52a6fb4057d22e9ce5a
SHA1 b2fd1b47c9a3da68068535806dc0de6e9e8cc281
SHA512 1798c0538490ca3f14156c21f5065b060326f6b9941277eb312d23935fbf45e9972fee1c62ff5cadb56d6480f59a18cb047cb5e998b9544957d4643f73c9d6b5
SSDEEP 24576:dfwvok9RX6wkyAIYdCN/j2GLl3iFSE33b9:bMnYIDN/j2U4FH
TLSH
T17AA5D029EBDC44E5E177923C89B7460AF2B178685B31C6CF029A53AE0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 79e1d2686f3f82dd4385d1d3c3669d7930e38cbc94cedd88899ba7d2e304390f
MD5 4047fe0ef633c2ec9cf0f7d17fd45a2d
SHA1 77708c38f84779cad215dcaa8a49a457cee3a834
SHA512 7c32e2bf923721879ecd15b48237a767602d016e10459c76ec22bb880223148ea426174b087989b27cbb046a2084c80cc53d3748fe8d8c0c9ea15a1792eddfe1
SSDEEP 49152:6YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0QN/j2U4FH:UySzP0j2jF
TLSH
T10A067C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 440be531b10871964f59fc7c86f4126533f10b4964c5ad8285407f6175586fb6
MD5 eefe2389b77e191e2d67a65a4ffc9577
SHA1 23493e7b6707393648c0f1dd904cd6e270b9eeca
SHA512 aa1c4147fb809b80017da34b630ecb253392e52ad4ee194556702ee9cadab7defb56232ef00e0c24c5ba02fa257e4b093a962119f13b54aad3cd73a0c92c163c
SSDEEP 24576:B47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY5dCN/j2GLl3iFSE33b9:B47JUQj1irIhCnDHUPfF/gN/j2U4FH
TLSH
T10165AE1DA3EC01E5E1BA827885158A5AEA71782D5F31CACF1270437D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 ef303284c3dfde2518457e7771b17b39d265e58684334b5d5e077d8cd337b3c5
MD5 ed54c8e957cb242bebbbe6cf8a0e3715
SHA1 8ebc5c35d5d67c5fabe2d2ff79913d12d6024b6a
SHA512 37c1a85a8bd091c85bfad1d4686a401f378b3fc2538a76e4a6e61f2e38aec6d8c9c1aeb3e1200d9edabed1878fb481ed11a1e6b40861002c7922f2d711bf99fe
SSDEEP 12288:hNsfMJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:mkdCN/j2GLl3iFSE33b9
TLSH
T1E8850119D2A412E8D06E9279C7558A41B3237CA493E1C3CB43C0F5BE1F7AAD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1020KB
SHA256 45442c526c791715621a6f240d4352d996a0b376fdc4ec34683bf95db9ad3562
MD5 f23cdb0654e3bba17a4fe57acf755052
SHA1 5289d8815e5d8acebb65306078cd057433c5238c
SHA512 a1def01aa3fa7c6d01626978bf699fb202bf4404875f69f5c01ace3910078779efce35a289933b76d40b1e375647aab0e3491f3b84224e517bed1266aaa1d47b
SSDEEP 12288:LDIXQgKpU3fDupouDRr0MytYhQwRWJZ3iKN:LDmH+UPDso+VyIQwALyK
TLSH
T11A25F700766AD75FC6A980321E32D1CDA7707D11EE45AF0773C88B3F8576669BAF2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 7447f76b8d54b983bff7d94c045371d302dd17c0f5f340a24deaf783b0e65fa1
MD5 aa4bb5c115f651ccc254d43c64d8cae3
SHA1 217cf80fa176af4d355d74302118590ab9543e2c
SHA512 76400fcddabc016480da6b4726510deac153026ddb5fb30a6fdb39e16b1b0e83368b2a40c57a27b918226c17dfdd3ac021c2d83209aeae0210dcc030e0edc168
SSDEEP 6144:7T2C9QsWVNOj/jqWFKDVs+DfjHQtTj23tsryu42a4uWQC3tMxoC3tMxCEe5RF5x4:7Tb9QsAcDRcK+DfTQtm+n4R43x1
TLSH
T1D255FA815137E2CFD1FB6032071A5B4CB764EC16B7496F26B389443AD82AB25A4F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 3a142612ed3be1145ea355307b418455df4d363f29d858568fc7fc17818c99c9
MD5 aa56aa47e9e3fa29b4e4ed3d7e7725fe
SHA1 dd3eb58c0a231d2e81a833c2fa00eed8b66956f6
SHA512 8eb83f50ffa46a85f81e02a2220dcecb21fd266fe25b6afb9f73bcbf074f8c5ba7e55bd2cfb90eacc6a4f9f56fa1c167497aa64b804907b85e55ebdf74d0d510
SSDEEP 12288:qM7kJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHL:HMdCN/j2GLl3iFSE33b9C
TLSH
T185752360D7E9BA55F47A837803ADDA316200FEF8DB1184C7C54166EB6278FD8D832563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a1ada8cef7331314c9bb080a6a6eaf025f213cac0de86d46bc7c0f22c8090740
MD5 58c8c1e4ef6a7288c96bb998cae564f6
SHA1 06a4ab1f9f51944aa1898f1a30688fe82ad18c7e
SHA512 55dda860ba93985eee8304d4bbcd7ba538c26bb885ac1559faca5ac2e7f92a44bfd9f1b93a7b724cda67990bc8f219a5bcd9de2751c955bdb65041138d944f4d
SSDEEP 24576:tgb6bmBIi49WNNFpg1rSvFv7bYCdCN/j2GLl3iFSE33b9:tgb4mBIBhGFON/j2U4FH
TLSH
T19665AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 9071c3ff464f09424eee718be611d86ebbfcb816d4de0a4f7dce98346d8c12ce
MD5 392b93def9d7718c286a7c408cd9a608
SHA1 a7b258503940f88c0ebac962f834c9acf446c32e
SHA512 dc7a29570a1a3843f2bf9bee3410d3e2f1d55ae70ede9de107634ac2d063813bae24bb6331603337f184234679eab41523e3459c6f685cc1a79be2ec2a4cd5aa
SSDEEP 24576:LG88u8FpJqH1bzria7/mpdCN/j2GLl3iFSE33b9:K7ZFPqVea7/tN/j2U4FH
TLSH
T1E4A5F16576E101F0D47BD1388A864663F671B8251364EFDF07A88B961F23BE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 a5503b3e382d4ab240c30d437d94262bc2065848dded021811fb60238f2fea0a
MD5 c58596b0d2edca8d576411a73af22457
SHA1 64ab4740e7e61b4d043a475aa9fd859fdae63ce8
SHA512 cc27e465d4a5803f6d39ae6b2a0b96f012775bf7a067bb459a94ae04dab72565bf3bc2ddaa09e55c79b5819094e6169590ac65c608694bc43b03d06538b335e2
SSDEEP 12288:RHvUrBFrEjwaQRJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:RPUr+NQldCN/j2GLl3iFSE33b9
TLSH
T16E85F22E62E918E5E67AD17D86868719F731B8615312D2CF02D0817E4F77EE8BC39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a400a4b33bfbb179b410bae11f1cfc021bebcf2f065e8b35b8fc48d6de576ea6
MD5 5abe5ad3309d052257323d04da5985c3
SHA1 2040aa4bab3da93b3747196d8d4fbab2950a50d6
SHA512 b7d79cb318ce41a2e7ab1f1a175879360f6ab8d6f37709c2beeb05b09a58e37a9c03ed8a52ff4399331f8b3d512f5aafc6b1a15f93229431cf323a6da0297dbb
SSDEEP 49152:IBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjKN/j2U4FH:jG05lO43bFj2jF
TLSH
T11AD5CF6A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 87ad0e545d3c38d99619a50e3c019b6edb4feb23b095f9e3ee0379e6860c224b
MD5 5981d8af2bac62d576d214f316dccac9
SHA1 6780de88fef3ecbb8d41dd6779d9dddaf2401878
SHA512 31eefb28623da9533006373307ec4675d14f7c4ffcfe476d0c07f552a436df1a84fe2e0891c42fc3b6e24e0485260083a0be9f3b45df703bc1ca10aea7ae5f77
SSDEEP 24576:jfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnTdCN/j2GLl3iFSE33b9:ba5POZ3+Jt2pasx2+mCN/j2U4FH
TLSH
T17965BF5DA6FC01D5D1B9D17DC5838A1AF5B1346153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 31c861f61cb554d8dac06a03171bdd6a86ecd71b5cdbea4dfa23cf48d2fe2732
MD5 dbcdae46306a89149c66e0fded26323d
SHA1 6c5e3c21aa2be6af8f9c8e2ea179a9196107a8f0
SHA512 02215500c3fff8169e8f4fde212db846bfeee264a39d3b785b6221d1d62695a23a9498ea0f4ccaf887e661b86377f3a53cde65658b14fab2d5cc0917e958465d
SSDEEP 24576:1NcwHdjbyQ4nLC18lb/EOjowL7FkBdCN/j2GLl3iFSE33b9:1Nc/zEOVHFNN/j2U4FH
TLSH
T190857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6c9301deff9e5214d1272058f936313346f4f3ab764ad9b4c5cc80868c11e8fa
MD5 1eeac7f891dce970692e4deada81ea61
SHA1 31b81e2de2defd4483ce2262bd95a9ce6779725e
SHA512 d616c5a88a36019403e2af92da3c63d11e7d75a1777cd452547e0b6a526a3a39300c2e03988cef93f58faffaf456cc6d6f989ad625fba5ebc7da029e77d65cbf
SSDEEP 24576:Z8kNvNnaFeYhJNtmZBmndCN/j2GLl3iFSE33b9:Z8MwBtOmUN/j2U4FH
TLSH
T11455AF6EBAF846E4D1FEC6B58E238512E6727461173293CB4290C13F0E679D89D36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 5686a23bdde8947020dd2dcb7b75f7866974c42d8857e93eaf937edbbe1e36d6
MD5 39e998678f5190a0a2db79ea06712382
SHA1 dcf3b9395fa7e9c2a9b2ec9a3f22836b09980324
SHA512 940c603e923e3b0cf9b4c078e07b6bfd8578c020e4b030ee6d055880e04bd650c8565049c5f3364f5e8220c04443b5c95400488d544f885ecaaea3efb1914f2d
SSDEEP 24576:VD3FHshBIYQgAQdCN/j2GLl3iFSE33b9:VDVHeBIAAbN/j2U4FH
TLSH
T15795E17DE69C04E4E57BC2BCC6638A06E77178A8432255CB02D481BA1F6BFE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/400-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/400-298-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/400-88-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/400-94-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/400-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/400-326-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1832-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1832-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1832-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1832-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2580-53-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/2580-39-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/2580-45-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/2580-38-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/2580-49-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/2628-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2628-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2628-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2628-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2652-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2652-106-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2652-100-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2652-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2652-312-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2652-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2680-52-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/2680-60-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2680-54-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2680-245-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/3156-120-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3156-114-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3156-112-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/3156-311-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/4148-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4148-14-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/4148-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4148-20-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/4148-21-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/4580-82-0x0000000000A80000-0x0000000000AE7000-memory.dmp

Download

memory/4580-286-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/4580-76-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/4580-77-0x0000000000A80000-0x0000000000AE7000-memory.dmp

Download

memory/4880-132-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4880-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4880-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4880-134-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4880-126-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5176-64-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/5176-276-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/5176-72-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5176-66-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5232-0-0x0000000000400000-0x000000000068D000-memory.dmp

Download

memory/5232-86-0x0000000000400000-0x000000000068D000-memory.dmp

Download

memory/5232-7-0x0000000002640000-0x00000000026A7000-memory.dmp

Download

memory/5232-6-0x0000000002640000-0x00000000026A7000-memory.dmp

Download

memory/5232-1-0x0000000002640000-0x00000000026A7000-memory.dmp

Download