cfe4c8d783aee8734d4c700663e2749076271ad4f6dbdd5f8ad343c35da747e5

Analysis

max time kernel
149s
max time network
138s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
Size 1.3MB
Sample260415-tkpmhafv6s
SHA256 cfe4c8d783aee8734d4c700663e2749076271ad4f6dbdd5f8ad343c35da747e5
MD5 ea556213cfc5c88ad84f6696fdd2646c
SHA1 09de76c4176bd5886d34cf26759f585a3e1cd98d
SHA512 a7963648210409c0beeac85d8c1069becf369898af7c89cc83f1c973f212aab95cb612a28e3ce10398fef487d3a49938dee268a14e28d12a2cd7a831a07afda8
SSDEEP 12288:XWsVw9fb2Zc5u2Qvy0JG4+TGoH0zFPwgR9GwlZkExLR4i5rRFz:XWMub2p2Qvh04+TGZJ4gDdOExF465
TLSH
T11655230FC1652C90EF1366B0719382FB5675CF9844F3345982F8B73D89F9A9CDA8A066
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4872	alg.exe
3144	DiagnosticsHub.StandardCollector.Service.exe
3448	fxssvc.exe
1788	elevation_service.exe
5328	elevation_service.exe
2172	maintenanceservice.exe
1508	msdtc.exe
6108	OSE.EXE
5816	PerceptionSimulationService.exe
3640	perfhost.exe
3540	locator.exe
3912	SensorDataService.exe
5044	snmptrap.exe
5676	spectrum.exe
5164	ssh-agent.exe
4924	TieringEngineService.exe
2736	AgentService.exe
5488	vds.exe
5464	vssvc.exe
2796	wbengine.exe
5176	WmiApSrv.exe
5396	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fff976ccda180f68.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000850a1942f6ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fa451442f6ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000428df840f6ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a255fd40f6ccdc01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3144	DiagnosticsHub.StandardCollector.Service.exe
3144	DiagnosticsHub.StandardCollector.Service.exe
3144	DiagnosticsHub.StandardCollector.Service.exe
3144	DiagnosticsHub.StandardCollector.Service.exe
3144	DiagnosticsHub.StandardCollector.Service.exe
3144	DiagnosticsHub.StandardCollector.Service.exe
3144	DiagnosticsHub.StandardCollector.Service.exe
1788	elevation_service.exe
1788	elevation_service.exe
1788	elevation_service.exe
1788	elevation_service.exe
1788	elevation_service.exe
1788	elevation_service.exe
1788	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6096	2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
Token: SeAuditPrivilege	3448	fxssvc.exe
Token: SeRestorePrivilege	4924	TieringEngineService.exe
Token: SeManageVolumePrivilege	4924	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2736	AgentService.exe
Token: SeBackupPrivilege	5464	vssvc.exe
Token: SeRestorePrivilege	5464	vssvc.exe
Token: SeAuditPrivilege	5464	vssvc.exe
Token: SeBackupPrivilege	2796	wbengine.exe
Token: SeRestorePrivilege	2796	wbengine.exe
Token: SeSecurityPrivilege	2796	wbengine.exe
Token: 33	5396	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5396	SearchIndexer.exe
Token: SeDebugPrivilege	3144	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	1788	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5396 wrote to memory of 3748	5396	SearchIndexer.exe	104
PID 5396 wrote to memory of 5100	5396	SearchIndexer.exe	105
PID 5396 wrote to memory of 3184	5396	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_ea556213cfc5c88ad84f6696fdd2646c_amadey_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6096

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4872

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3144

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4188

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3448

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1788

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5328

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2172

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1508

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6108

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5816

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3640

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3540

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3912

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5044

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5676

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5164

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5384

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2736

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5488

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5464

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2796

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5176

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5396
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3748
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 1680 1904 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5100
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 1676 1668 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fb90ebbc46c48a6ccd85a13caa30cbff3e3ccee5b5794d483b97862fc69a6ba2
MD5 58316de093a416e9a01720181c4fafd0
SHA1 a0c9c1ba5ca58a6e0d6603a626e68647ccd2dc40
SHA512 fb1fee807be746fd87edcf6cb6f9a6cc96a4205fbb4e9f2cc26ae0e70ee907f1ae3421b0e1b86e94741812ec29f223a1ccb915dd9257757529f6e515564872a7
SSDEEP 49152:Zb+632BuPkFKRrdE6ohmstBhuXjfS4LWxngub2p2QS4regDdOExi6:v3q6HjBFubVQl3lxi
TLSH
T1E1D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 e3f5cee80cf70891b5bfca586c75a522a640de42dd53e33a57fc1ec935223ad8
MD5 612a5f9463d51e7441a2f5cbb5c4b45a
SHA1 d8b80c156d6a5efec00302547e2db5340e1b41d0
SHA512 0d9131e38e99284111c260abc9957eb4cc68b7c18636dc8fbd5e1b683f1b8a4e50e8f23b700527366b1f386fa9691b8c2237c52aa912aef6fde1ea7e398d70d3
SSDEEP 24576:ZXYfDtczA5ub2p2Qvh04+TGZJ4gDdOExF46:ctc+ub2p2QS4regDdOExi6
TLSH
T1E475012D63E408F8ED678278C8A28116EA33B85447A0E6DB03F496355F737D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 27c421af979f95f984f540460fa9a82f7653cd2eb612b4d5cc0ffd26930cd0a9
MD5 f533c0f870b7c22ddf9a4fd5fb1f8617
SHA1 d213db5dd1232baa7b6982c36b52dcd70509d770
SHA512 bca7a5b3d929c61f40f0be89c1354b1f886ab942bcad7f92b35b4378cfd8bd4c0ea9e634af5994f0faf94b5d5779646cb3eb88c440ce4c01c7cb137b8d43ea1f
SSDEEP 24576:w0Le5ji0hmxWrMoub2p2Qvh04+TGZJ4gDdOExF46:wPji0A4jub2p2QS4regDdOExi6
TLSH
T17D95AE16F6748331D073C0B9C5D2A69EE97130861B308ACB4296D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 50b9e4645c4f3b9474a7a7f6115280e23537dd5db47c6755768e7eb704695be9
MD5 94f24127df3d1f78678b51925651fcd1
SHA1 8b7dc08ae2fbae285ac0d9d2565fff017a47365b
SHA512 d987a0be07338fec84344a7c87ac0ac2c8112d0ada22ec3c01d9fd9e395acbb4cedbfe3b6bf8fc9cf3370c6e826be6db01b8e1cd165d24cd62e220ba3a61287f
SSDEEP 24576:Ia7/ezSC6vUyD/aqgrvWE6q8wyuOub2p2Qvh04+TGZJ4gDdOExF46:P/ezSC6vUzPvxHjy3ub2p2QS4regDdO
TLSH
T12B756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 12ce9002650cc10dedf2d18f75565fe28c25681545fd6a8e506b4ecc24b8d9c7
MD5 c9350111f4cacdfa37e14feb326346dd
SHA1 349c437694200a37f41a1161e92c7f802bd49c0f
SHA512 8f406690c09c1b6b82abec9e1fe72bb720c6c6dbc3baa1f7ca995de9d84b0b3cc3f1a14ff16b5d7ba8079a48cda44c003146ff6bf3c58055417877f1b2bf1df8
SSDEEP 24576:RVbqPb88hv/l+6Vub2p2Qvh04+TGZJ4gDdOExF46:RVO88hXl+sub2p2QS4regDdOExi6
TLSH
T143559E66F5748331D073C0BAC5D3AA9AEE3234415B318ACB0246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 23e5168c04dc5abcca12e72f57ae0c0b313e0c1039e1dba33ba559809bc8c1b4
MD5 b56c2a91e7cd4cfe6f0be9c171d51b94
SHA1 ee83b8c77865a802b82113b8149f33913723b3f7
SHA512 3ac09fa515f33fe728c6dc3d1a300d2d94e6b1d7cd4adb52f556dba542b4ecd9ab72c62ef3edf91c2c0eb2c3921ea76ef2fe87c2fd4e2f58a994af77c95bd582
SSDEEP 12288:owkVw9fb2Zc5u2Qvy0JG4+TGoH0zFPwgR9GwlZkExLR4i5rRFO:owEub2p2Qvh04+TGZJ4gDdOExF46M
TLSH
T13655230FC1652C90EF1366B0719382FF5675CF9844F3245982F8773D89F9EA8DA8A066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 b7b2d2238f9133b9fec5c8500f98109a593d62c7bc018c833f04c0d4ae462515
MD5 93115f91d47e146604e94d58dc88fd20
SHA1 0a062e16976ab7c269d2404c8efe1c6fc7df0bd3
SHA512 a8f3a1c0db623de1e829914988a70d05de49801399de351b90c3dacb9f9f5f1ca25c6b026af13a3f427119dd735ca88d4628da215663e0113b64003b0f5c06c3
SSDEEP 12288:OeBNUbTVO86UvVw9fb2Zc5u2Qvy0JG4+TGoH0zFPwgR9GwlZkExLR4i5rRF:OJIUdub2p2Qvh04+TGZJ4gDdOExF46
TLSH
T1B975CF3BEE28FCD2C67A9DB856918340D77278704B62A3CBD174830EDE235E45E79825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 66519e1ce0275f094ff1480e3c5627e645eeec5d6244b595ed5b09b59f15e62a
MD5 a3b513405243cb980aa9debbbfda8c01
SHA1 77e3941f8671c6cce984ad93febc1162214ed99e
SHA512 9f2273ac98ff0d3c8e69454fb57b2492249a9c01395a76bd4ede1423f3a7d78648b3d961037b53c5d51c3c00ced1e9cecd231eee8a76f3ad80123019863be676
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH/:MQvGAdlCEL8c/yRNw5CeubVQl3lxi
TLSH
T103267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 d2b33fdb3bc34359e0ba31f86a3e7a7befa7c5db02f66f31090802f965b3c874
MD5 b2abed7d45818a59f2b99a87d4a33779
SHA1 36a519c052e4f7950c0d96096987f5337a56415b
SHA512 c0d3f6752725c6be53371896a4d5b18d4c96db0abf52ab4cb4d6f79289e4c07ec0752f590eb4889b34ab1267e201757898e3814c86d90b5944c77465575f99c1
SSDEEP 24576:9ZewsAjzub2p2Qvh04+TGZJ4gDdOExF46p:3ljzub2p2QS4regDdOExi6
TLSH
T12075E131FA74E432C77B0DB21B26C716143CAA604FA219C3E3F89E9D59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6d5146a6d0d647b1db604d50f54c8a99d0b6ae788c505f526ed80d66958bb789
MD5 ff36321d7e12afeebd929a1c5a1e79e6
SHA1 cc7cd4031c317ded6e0606082ecda2e9c2b7d4d5
SHA512 447bbf7941e8cc6c3ee398816d3034954afe4b00bc2e2f853d464d79929d51d19ce18659e27b816611961117695118b9bcbfb27378414f2964aa20f6efb2ac1f
SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHyJKni:eUEtQevvqc2W1cpV2EI32yKni
TLSH
T13F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 03688c118aa9f2f50f72346f11735eab8a9c05945e529a3869057f00006c28b9
MD5 e869f21daeaa000e3b8ed8af1020b603
SHA1 896e7345dbe8792b0128e7d9a0e55be6542c6abe
SHA512 2486e348ebee404a8b829fe57dd33bbf97b8a63299ba5daf476b72e88eeb1b4a71c879cb8c205cfdf406e53f4ce5aa39991ab32e8e17cbe0e8ac99c2f101e56e
SSDEEP 49152:6CbRquA/m2yL5zQfFiV+XenmE3/zTub2p2QS4regDdOExi6:PoqtVjnmCubVQl3lxi
TLSH
T1BFD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 218d3bbf99a6781a63820eaf9490d09c6258c8fc15adb9108230bd82da9806ee
MD5 81781c89e1d5953873a655f69141a570
SHA1 589f8b7633202e25a0fc1aa9161e44dca014c23a
SHA512 fcff6784e3586ca62349727d6053aa82a3cd27282c1ff867dcf85a2fa3a030571a6c95efd6cab912ba5f5af56a1c95301a8459c718b5082694f48bca9674fadd
SSDEEP 24576:VAhGLJIFoiwtA5l7S53iub2p2Qvh04+TGZJ4gDdOExF46:VAMyFoiq5Sub2p2QS4regDdOExi6
TLSH
T16535AE81E7F955D4F5B3AAB899B68171EA76BCA95E31C20F2160D21F0E33E409D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 5737143589c7fb8f76ef1672cfe4adc850253da3e36b168c059258c9576e9edc
MD5 11a58e8a7d49a1d75293fd04b7a38e51
SHA1 290574636af108e05745f4c6f091f54accd1bc7c
SHA512 c753698b379b1e9ce862b1598724fd7adf7c2cc628503549a0227a86204122f8f2f5d9d310599972b3714421b044c12eb629481b5205f2aa8067748465a39ab9
SSDEEP 24576:GwuHOWXub2p2Qvh04+TGZJ4gDdOExF46:GwsO2ub2p2QS4regDdOExi6
TLSH
T1C275F14A72A41CF9E96392388597C136F7F2B8052A62D71F03B0C66B5F77361AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 ecb1be9d3fd2594bde280b3ce6828cb7dc36803ef4839d9a1f188d85b165eaaa
MD5 923315f58b26d5710d259de654d7d6ac
SHA1 ea8847b275fb1b0b8b56f92ac646a922f886b2f2
SHA512 1baea4d974c1fed896ea89057def2625cac5520ac5eeb5d48734492bab51003cd906eaac4b09b91001f9f9556623d6912945e80b68586945c26dcf25b50b1e4b
SSDEEP 12288:EmZ1IyZVw9fb2Zc5u2Qvy0JG4+TGoH0zFPwgR9GwlZkExLR4i5rRF:FZuwub2p2Qvh04+TGZJ4gDdOExF46
TLSH
T13065120E22E434F1E6635278D9E2829AD772B49513B353CF02B4426A5FB3ED55E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b78b6be30f0093b93005e593d0ca3bdee16233d57eb63776a49fb9103f39332f
MD5 e013b990ff72f22b816858d3bbddb2ff
SHA1 d4ea05dd02e4171266fa64daf8a820eed170d664
SHA512 f9e36001a6c5013f91a37500c40e17f2d60e59758f13be942f422b3f04f69105d743db0f4ec92f8b6aab69a67bdeec48179868cf5118b65e62b1fb8a449e7f59
SSDEEP 98304:pQRQyi36YOcPQLvw2gAf+PN3hubVQl3lxi:AQyiKayX+PNQJKni
TLSH
T19E667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c2982c08dbcd9c756d192fc17f23d5b30350ae535592ee528f985e647bd31ee5
MD5 daee67efabe2523f39911fea1257f9d9
SHA1 0a2198c20e9ccfa9bede456235d5a83017463bda
SHA512 477ce76bb177393fba0189e43d270e5ef79d6ec5e26482ccd7a9688913636d8c66c4d0256451656c0782b4b3db408ca73387415985b5ca6e242a23313fd3eb45
SSDEEP 98304:eQRQyi36YOcPQLvw2gAf+PN3hubVQl3lxi:FQyiKayX+PNQJKni
TLSH
T1F4667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5732c286dc50ef1aac7c37c93b3783def21fecafe873b681097dd92a27d17451
MD5 7eb6e1f7911ea047f9ad118091251db8
SHA1 66a83a37cf4c7380f9da592ee996eb28ee316298
SHA512 b32418ceebd46d0b1e328733403eccbe616efb4e8d3639933e94c8d6184cc684d2592609fc47b06b292576076a543acef520809410e9a6770d07d2ff71468429
SSDEEP 49152:568Qg55nhheWu7PNU3/jub2p2QS4regDdOExi6:HthWRc/jubVQl3lxi
TLSH
T13AB55933B2F200A9C44DE1769F4A873196D17C758FE1E3DB8111721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3e6fbf2f915443cf0da87f967022786583a7447c37b3d3547e0c29208a9dd152
MD5 2fb8023f890b9dd39406af7d296cdd6b
SHA1 5fab0ba70cb85051abe57bcd6ec20301755a01ee
SHA512 a7470b897c5c173964e27bd8b08abb4a8baba30ca9e3d93607c723302a23fe89e81b48138bb0ed1b074bacdd12438c80966fc654982cebe402f3b8b9a8f609b7
SSDEEP 98304:By5112gYy5azzVvL69nLKnhZEubVQl3lxi:cLIHmWh3JKni
TLSH
T141167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3a809210c24fa27da1e42f13ba28e20d25bc18f3cc045a265c13933115b1b370
MD5 d0234e2b99f4e1d98f6f228fd1506cec
SHA1 2afa20903c22c465615ab66df6ec3898fa7ea5fb
SHA512 e540c68e4e473171110187c879f6b9b90aefca4058c8e5c54a7d2ec076dfcf635639e4ce670fed0306885ce519df5c138ea9c8b838b37a0a931853e4f04ad23b
SSDEEP 49152:cB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glpub2p2QS4regDdOExi6:2u6JmVxd2dpubVQl3lxi
TLSH
T113D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3c5193b6cbe696427e628aa72259231a09a24990d229a45f16ce7cbd98c36f7f
MD5 fbfc3b7144b61e276f91943b5fe34215
SHA1 445f3e936542bd6ad6e26c81e5e2a39087fbba6a
SHA512 5e17eecfd4c7d4945c42b7c819c4955c238efcd02bdc346ad1ca10bc7b4caaa78e83922ad77a0431aa7453f82622b02c501eca129810113896280173a35f5a9c
SSDEEP 49152:p1hpsNoJpF1A6UU44CwH7R4x9ub2p2QS4regDdOExi6:pmifPbRCubVQl3lxi
TLSH
T1AEB5AE13F2D900E8D06ED17887569232EA62BC450B35B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7f7afb8067dde5a964ecfab94a9f4921b97d1698354063f906a14baf6755992e
MD5 e8cb9e388a83606610e4b31517188d2f
SHA1 987d5b9c88d9f71c5dfb69e81425ce993ba5cbee
SHA512 d80f215e841416f2d00a479691cd5ea096ab42c5dcf26cac95b9029b45f8f62d50aac28ba5dd07f57d9de637f666f877ad8b8589529221e6b04d6739bce8e3da
SSDEEP 49152:/SuZQIY0Be2KRRVtOnks6NMHqwub2p2QS4regDdOExi6:F5dKTi61wubVQl3lxi
TLSH
T13FC5BF03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 35bc445f603095eec5b2cd816346141ad038cb8f116dfa9a79634df75b206eee
MD5 5883cddfdbc65bd4d5c59bb07070b47d
SHA1 1a8319deb26f7c47bbf90289ff1133518aae6ed7
SHA512 906322f239c2195bc1f38138e9c7ab5a8e7b3d7d18060defccd82c82a2d667b6fc7709f1f4c53a468e09b25157d720f83433d4b90ab4048f6bd1efd72195b75e
SSDEEP 49152:DhtSn8EApI0figngiDn0AP5w5ub2p2QS4regDdOExi6:iX2iyphWubVQl3lxi
TLSH
T1C895BE13F2D900E8D05ED178C7568632EA62BC150B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 77410f84c204dc4901f6bf35f45b5ad44598207a552f9ac23e59746d3d89f4fd
MD5 e156781b514259af9fe035ef50e57abc
SHA1 ea13a77355e72f3552b5b72e95254873e63472fa
SHA512 463ea8c1ebbb00353124e9249530d9dccfa3472191a65924f8d0030b3e5b2f817642876e5187e304dba7c5fe5428f9f0d508983e10240e6b6e5efea11f7b3567
SSDEEP 12288:hMVw9fb2Zc5u2Qvy0JG4+TGoH0zFPwgR9GwlZkExLR4i5rRF:hsub2p2Qvh04+TGZJ4gDdOExF46
TLSH
T1C955230FD0A61CD1EA0366F0A18383EF9569C79C55F3305983FC72399AF5EAC6A89075
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 0b41ef275db5c92424eb3df08bdbe3dee0edfc9cf26ab60897ad9d3957c10081
MD5 b0eb6ec66ce4bc86ea31e359010a2131
SHA1 1df6eeecf8a19bda8042556283bd5e1efee3842a
SHA512 052a759e100ff83b37175a03edea6fc2bbfd613097c8b06a00996b8fcea4f1d8895102cba4283d6764f1dc9692d20cd0264a9af065591a7b348e5ba0eeb1ef9f
SSDEEP 12288:BdVw9fb2Zc5u2Qvy0JG4+TGoH0zFPwgR9GwlZkExLR4i5rRF:BPub2p2Qvh04+TGZJ4gDdOExF46
TLSH
T11555230F90A61CD1EA0365F0A18383EF9578C79C55F3305993FCA239D9F5EAC6A89075
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 a7475e39aeb0d9cff6cfe5ade2ab0a63c5517cdd7f07252df3a7729cbd1be7fc
MD5 c30ed1e44c16c09bf9397f74f33b5930
SHA1 d980e5a2e821dbb196d219025559b5d7ba69978d
SHA512 92d5541e30b29a1eb15aab04d21f1a7a99df8ec8cdbe99190c25bedaba70bad1ae87533ef36c1f6d905b2947cb86e67284f1b34f00eceab807a914036f5e2f66
SSDEEP 12288:z3Vw9fb2Zc5u2Qvy0JG4+TGoH0zFPwgR9GwlZkExLR4i5rRF:zFub2p2Qvh04+TGZJ4gDdOExF46
TLSH
T14E55230FD0A61C91EA0366F0A18383EF9578C79C55F3305993FC723999F5EAC6A890B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 28382440bdb77066feea09da12ef5db7371c2e4ef63a4d78a308983cab19d9b4
MD5 4321e53d268b3e64a7a7e40b5f438ba8
SHA1 dc6ebb68be9f063948d7b99aeb687d655a20f84b
SHA512 053a5daa3a1d6b223ce18df56a61d9445bcc7ed20a38aba5a4cf4c6db7b04e895a67b8a348f736305a11433d0748dc50bf1d26ac80e6471bf568aa5fc49b42a5
SSDEEP 12288:VVGVw9fb2Zc5u2Qvy0JG4+TGoH0zFPwgR9GwlZkExLR4i5rRF:Sub2p2Qvh04+TGZJ4gDdOExF46
TLSH
T15155230F52AA18C0ED13E2B0D19382EAE675FADC56B3319F8374122D4EF1BD86D59274
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 502f2ad5231ba842cf82e91f9ab2237f837ea322b885882b00ba3e897494acf5
MD5 bb394ea21317c7c193613fd89ba39fce
SHA1 4bae50c5eef8859c725b8b1f9d82bab37ea3c1d9
SHA512 4df16ff474544c25f7bd25aac8536f5628ba8b82df1cb717c7f3cba8b972100422031960931f3c1eee4f4c06fe13bf3813d5a614586d987383d1e3be0b5a48dd
SSDEEP 12288:ZeVw9fb2Zc5u2Qvy0JG4+TGoH0zFPwgR9GwlZkExLR4i5rRF:Zaub2p2Qvh04+TGZJ4gDdOExF46
TLSH
T16755230F90A61C91EA0366F0A18383FF9579C79C55F3305983FC723999F5EAC6A890B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 251ce13f6295b9f28a0c2a53dfcc0df3c33702d888fda962036da3a16e8a508c
MD5 df980ed9e0400ee593ae285e7d742f47
SHA1 3d057fe719abb2da138af691f76d68b00eb17199
SHA512 a2cd061818a3810a554de12431db3f695b2065a67a074d6dfe49aa41e62ef45158fa19ce0f5fbbe4c99820cde8535df0f2be5d4bf05da9cc046bd9e53adf01c6
SSDEEP 12288:DxVw9fb2Zc5u2Qvy0JG4+TGoH0zFPwgR9GwlZkExLR4i5rRF:Dbub2p2Qvh04+TGZJ4gDdOExF46
TLSH
T1B755230F90A61CD1EA0366F0A18383EF9574C79C55F3305993FCA239DAF5EAC6A89075
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 bff05f7439e433874491c0ea56b5ae15daace143b1fff5d49c08e1def9fbb93c
MD5 cac4fe4e6ccd38f8d90850883d00db6f
SHA1 97e20fa2249b1eb24d30bae3046bcb32568d6d82
SHA512 65fbb21b5f1be2ac79396a052aafa26e5925b47e4fbe79fee67555eecb8fd530e5ecd6a2f3fd2623e764aa6e5a8ca0350ee979f34272758e028660e814a9c6f1
SSDEEP 12288:DVVw9fb2Zc5u2Qvy0JG4+TGoH0zFPwgR9GwlZkExLR4i5rRF:DHub2p2Qvh04+TGZJ4gDdOExF46
TLSH
T1E355230FD0A61C91EA0366F0A14283FE9579C79C54F3305D93FCA2399AF5EAC6A89075
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 b1253b0c1f741dba30715bd7327445f3cfc34f978ffa4e27b4d9fb915c4d9857
MD5 dc2310dcba1549e1f1c8b67c827e5259
SHA1 54b32e3c6ff1aa58592a757bf8d1a1fea23d6994
SHA512 d2bf681532216517f9357bd576e92c7b65aab14f7408f6fa573c836f1e94c89f1c3b527a6d0544e06b992b872c0aa60ce111e38eb7f1f8efd13312577b6d19d5
SSDEEP 24576:YZMWzFVSOvub2p2Qvh04+TGZJ4gDdOExF46:YZMWzfrub2p2QS4regDdOExi6
TLSH
T199750159B3901CF4EC63823DC9518956D6B2BC5907B0C61F03F8362A5FB37A11D2EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 06c3eb8b2c8e382285b3b6933290eb6792158a6ee8277fd66032ed018b318413
MD5 e53db7f74c6629c2cb133c891b32edb7
SHA1 413a1b10b13038ccd2f7e07bab8d7d2ee00f9dbc
SHA512 e97340e62fc8d09fcb46108dfac905034dde9d03a4bb744bad2cfdab40d5158b8d89b39d76ffa0a5aae899ba97e7ad62f135dcbe7c7f1854e74204acc431f1a3
SSDEEP 12288:qYVw9fb2Zc5u2Qvy0JG4+TGoH0zFPwgR9GwlZkExLR4i5rRF:qAub2p2Qvh04+TGZJ4gDdOExF46
TLSH
T1F655230FD0A61CD1EA0366F0A18383EF9979C79C55F3305983FC623999F5EAC6A89075
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 f94fa7bc14026f621781240500f1d9ee82dd1d91bc29ad7efc6b4fdd438cf218
MD5 d226a7ef883747e549aebeffcae6dadc
SHA1 da76cd9ef9c392a1d0ac47ce521cadeba54e7fe1
SHA512 720a336e898c463911efce1006672fe81d0cc71379de1e6d6fc17c9ae71f549ef32744b6551b4475e116f22bcd4dffab14c10aad810a5318e2463cd61c42a6f0
SSDEEP 12288:0UVw9fb2Zc5u2Qvy0JG4+TGoH0zFPwgR9GwlZkExLR4i5rRF:0Uub2p2Qvh04+TGZJ4gDdOExF46
TLSH
T14E55230F90A61CD1EE0365F0A18383EF9578C79C55F3305993FCA2399AF5EAC6A89075
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 2980187bf477a1d176a255df255ecf2935b4e71e3f600fc7cb7a8d4a499e7a13
MD5 44cee6c48108fb5a52eb10c57629fb02
SHA1 31a4339fb9a8e70932558b88f67cdaf76cadebe0
SHA512 d62f29a8f4689948b660fc799ef3a726ff48520606d7063115861f3dcba72fc13d4a0a9e476adeefd995d868fec3c32e8ed765eb0e2bb2d1e724195fb983856e
SSDEEP 12288:6yPz5L8ZVw9fb2Zc5u2Qvy0JG4+TGoH0zFPwgR9GwlZkExLR4i5rRF:nzyDub2p2Qvh04+TGZJ4gDdOExF46
TLSH
T1A965010B72A530F4D5239274C8920656F772B87507719AAF43B4437A2EB76E09E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 a53d6354fd7c3477f46114460143c54fe5c837a5ad247aac514052a1d5f7903d
MD5 3d1282d706ca4518f7fddd2bb66d30c4
SHA1 ef85baae25198c142efcf2da490e59515bbddc41
SHA512 bf5d7d2dfad6fbe2c4daf6b92234cd04f0a752d690e1cc902b7068efa7e2b05cbf3d4c1bcdc643a0ad7f415fce11ca475bc8b363775dc682b8a6214d86cf94fc
SSDEEP 12288:YYVw9fb2Zc5u2Qvy0JG4+TGoH0zFPwgR9GwlZkExLR4i5rRF:YAub2p2Qvh04+TGZJ4gDdOExF46
TLSH
T1DB55230FD0A61C91EA0366F0A18383EE9578C79C55F3305993FC6239DAF5EAC6A89075
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 043f69d80b71356055a23652a54d19db1feb93b38268eee526caccf1e21812d7
MD5 f4de7f297086ff08ef988a70bd1b3488
SHA1 ab38efe4c6185af6f4acde41495d1bec53bc4217
SHA512 5800dfc71e387086276e07b973b4b61cb8ecb8c04702919519606b8c595fbb063b87ad21b1e76b95ac7bffb5c4d00d75953e1ccf04cdb8e90c5ad472953857a7
SSDEEP 12288:jYVw9fb2Zc5u2Qvy0JG4+TGoH0zFPwgR9GwlZkExLR4i5rRF:jAub2p2Qvh04+TGZJ4gDdOExF46
TLSH
T17D55230F90A61CD1EA0366F0A18383EF9579C79C54F3305993FC62399EF5EAC6A89075
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 ac89f8d410dee96377422d411dd1e46b40dddef0149e6281b739fb75ae1bcb66
MD5 bd44e5351585268cd66ad86659d88695
SHA1 9369c3a7278c4af4beb8ccf1f03bdf15c6482a6a
SHA512 39dc693c3c26055e6af3c3fc4b4c61b06fbf3263a70bac489f7f413b352eb2970eb12af700c37d26166ec1ed39b0bcda37620691a44fb2e5d6b556395ca1a335
SSDEEP 24576:0CUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvARub2p2Qvh04+TGZJ4gDdOEx1:0CUxPTY+8Wg2lIL8lrIUJLWwaub2p2QH
TLSH
T1AD65AE1EA3DC0896D4BB81348A518A16EB72782E1B3296CF1170C33D6F67ED95E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 f9440da440b40e1257845f28185cabcf17eac7cee55c489fc37aaa64918c2061
MD5 3d3fd138682e2ba970cabcec3bee757b
SHA1 1660e60c3692455312a7974aef4f39ce4a9debcf
SHA512 3c18d432175b867308cbd101adbbd424f794a669e25110e7fc2ac3bf6cd4028ec8a7405d8a297e43d22d6f883ef7bc6d6cfae37dcbf03b295003631a0243f2ab
SSDEEP 12288:SssfoVw9fb2Zc5u2Qvy0JG4+TGoH0zFPwgR9GwlZkExLR4i5rRF:Ewub2p2Qvh04+TGZJ4gDdOExF46
TLSH
T10C65F10ED29811E4D06E6274C7424685B333BD6487F2A3CB53E0F53E1FB6A945EEA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 e75608e87b28ad8f781a6a5bdc64ba4ca826607604c57f6031bc9be056f90fce
MD5 2ffb6e15950170d255879254ab5a188d
SHA1 55d3cf07de2255281e1432b2024bd8892a9f331b
SHA512 5c9861fa6dd97dcf52a52cacda3dd3d5b9a585e65c4a831a0e814722226957143e4dc4652e1fd857c2fc20bb9e4998b1bfa40ad731ed11b2d4be36480720fd30
SSDEEP 12288:YXVw9fb2Zc5u2Qvy0JG4+TGoH0zFPwgR9GwlZkExLR4i5rRFs:Ylub2p2Qvh04+TGZJ4gDdOExF46O
TLSH
T1A455230FC29D6C80F92366B05043C27A622DD79C4FF360DBD2B8633999F5ED85EA5126
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 5df98083b4236d57783668f3059447e23c7752df3a05054d70b14a3ae331e8bf
MD5 705434bd6b06814d350424dd077e939b
SHA1 e932cc9bed00be0f8f9f03caa5d51bd57a83b6f5
SHA512 a0b80b5646d47a9fe0734c6097c49dcdf4d08af1ae2a2ba33994fc30aa2b92393e1a0b7c42fa24b9191c9c48fdcb517797a83c0b8527afb6a8f874c2b7afe99b
SSDEEP 49152:9RZwQCyiHiQEaaPnMIub2p2QS4regDdOExi6:P9xvP/ubVQl3lxi
TLSH
T10C85B01E62DC46A5E0BAD278CDA74407E6B278165731A7CF0290C27D1F27EF45E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 2ecd4340b9fa0fbb83cdae3ee199049711188e82062999ae84b86a2bd15263c0
MD5 8140d6019494522863b38a746587f13d
SHA1 79cff634a345ec2e233be14e11484056f827b8e1
SHA512 df4b2e40c3292c3b44789be42dc56017bcb6fe394d4a23d5f8fd7d1f806d6d010837333b34fd6279c926c5ad178afd010ac451d6430b3f271dcf7cf6764a651f
SSDEEP 24576:GbxA1UG1ub2p2Qvh04+TGZJ4gDdOExF46:GbxA1Usub2p2QS4regDdOExi6
TLSH
T17265122E52AC28E0F572A17895D2824AD331B819177263EF11E4C33E4FB7EE85D35B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 95f090fead48f1453bc16da9a017f47d58543d1c2729bb08653a5c47c5644aa6
MD5 3e75dfe78faae64fdf28284f5962b0ff
SHA1 87255efe33a2bf06515b0c5b0d2b6e5907704e8f
SHA512 24dd740e31fa1fdd57af734cc2768974d5155bde368022c250514ed3703dc5df5e03a403c7b0fc44179550787808ea2cdc02064ad77286f327d289cc4699d3ab
SSDEEP 24576:ojsmP0yHaqrVqHra44KDzMsrnSub2p2Qvh04+TGZJ4gDdOExF46:ojRP0yHfVqzlAsrnSub2p2QS4regDdO
TLSH
T1C845AF2EF2B910F9D4AAD136454107B5BB71B42D1F219ACB0170C234AF4AEE89F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 3536bf37ca190284fcddefeeab5555bf1e3ed3fae1689ebc417466e25c0bb28c
MD5 d5ad6e957e62ce5e939bf5f788a25d34
SHA1 d83e86c764f8bf26d0f569f9d9590d4db6d515d7
SHA512 b479b315be4bd03648211f5609365b359fe0303395a260936bbdacece1912aa30475a2ff73fe7717a20f3c7b2425338aea84253fc012a0d53c20410c2d572800
SSDEEP 12288:TRVw9fb2Zc5u2Qvy0JG4+TGoH0zFPwgR9GwlZkExLR4i5rRF:T7ub2p2Qvh04+TGZJ4gDdOExF46
TLSH
T1FC55230E91562CC0EE1366B0618383FE6564C75C07F330DB82F872399AF9EED5EA9065
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 9913dda0e0c7d8ed7e55c6a892645b3e05b5f26a8f3f4d385f0f22bcfa0d93ec
MD5 5c23b1b9d0cbfe18164515ddda6a06bd
SHA1 bbd57eadb24ad7df00f68a0fa3c8bbca86f664e8
SHA512 a3890aa88d2218c65602474cbde512ae2c31806c8bd851145bf33865bd2c5d117e9ec233cb4cfa09036aed04f806e08fdecc5e8af7b477f92982d6b8c8133655
SSDEEP 24576:nNLBUT5ub2p2Qvh04+TGZJ4gDdOExF46:nNLBUdub2p2QS4regDdOExi6
TLSH
T18C85F109E3A504F5ED67D13CC9A28616E272B49C0761E7DF03A84B691FA37E54E3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 1f0ab12f32c9b19493644029f944f240ed6d2c1a7b7c56b7977a3a2e75d1729b
MD5 9f919b3fd889273030cc55317f3cf1a3
SHA1 6ed545ccf81ef01cbaf6883e06d9992c8c53d1ec
SHA512 107cd6a34efe94444ceca62d9558b9856440ae49a80216b16ec26a68e80686d9c4f3218efe87b9b42006b24e3d04c7369c06a73b8d34cbe4a67d528767939b45
SSDEEP 12288:b70VmzIYNvUyBpcVw9fb2Zc5u2Qvy0JG4+TGoH0zFPwgR9GwlZkExLR4i5rRF:kfYNHmub2p2Qvh04+TGZJ4gDdOExF46
TLSH
T17D75F11F92AD1CE4E53BA1798AC38259F272B856135292CF01F0827E1E57EE87D3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 31fdb49350556868ac90639bbb83130c8897d166a6ceba53a14a90ad5916fab1
MD5 6cd22614f27d2a0fe6d6582cdb50dfe7
SHA1 3761c103e31b86957ac604ca4876f375480a19d2
SHA512 13e23516cd761654b881f406e8e62827682f36823924d7bee365cc54fb9126437852551b6ca5bec2ae8725116aedcf61a8544d6ce99afd80ad3d6a82a547aa67
SSDEEP 24576:DnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKJ:DnXoJJYH84VVS6AmEcJas+cHBjSSKHP5
TLSH
T18965BF6EA2BC04E8D5BBD17CC5C24506F5B278651371C6CF026082BA7F27AF56E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5c592e6abcdb6ae2a34afdd1db275189b5cf68a34451b51a1ecbc6a2d9403f44
MD5 21d297b64de8db650c3e78ff2990cd65
SHA1 b4fb68fa5f9f0040471d676569dc4a432df8e32b
SHA512 1621c494a2c61c9cd03805162b99bb8c2e596197d6eb7f48586ab4950279aea5267ae544ac07df4d8645aead48e8e58e116a6d0d00585da733b8860835420291
SSDEEP 49152:pDLL9TuJ0M/TYW2Pbub2p2QS4regDdOExi6:K+ubVQl3lxi
TLSH
T13D858C1EA2EC42D4E47BDABD85A79147FAB2B855173091CF0290856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 f07eb080434a73d0dd2942b3b34ebda143d9906f49ef00b9286bcc06c6cf5a2d
MD5 fe0cda4f437e4c744a62df1f76f442d5
SHA1 d93aacbf19427dba24931db8487db1a0dbef1932
SHA512 1102b56f9564ffc62336df0ea2e45daa7bd4f667833f080c8c6dfcc5fcb3212c2f7eb60a0ad1535a54367a1fc6a3e2fc84e410ffb884ac737eef2e51429c3591
SSDEEP 24576:negJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10w5ub2p2Qvh04+TGZJ4gDdOExF46:nngOJOmPOHh5ub2p2QS4regDdOExi6
TLSH
T15755BF2FA7BC15D5E03EC17D8A938916F6B1782603365ACF0160827E5F5BEE42E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 d6ff12c54f46b73e4243859d84835357423f1f29beba9daf29acd918808ed687
MD5 a279a99ab45a33929b2564243d168eef
SHA1 6418fae7abcdb58230eb6c315d09d07d379cce85
SHA512 03af86d3b7ee64883e0bc8d72111af9ca2d6e456d7f4a57d020442429872ea06822898bc7fe9ff3e31d023e4bd9664dd9aa09460fb14a32ec5248fe94a5b2c1c
SSDEEP 24576:kLJnJiTk3R3waE4JrObub2p2Qvh04+TGZJ4gDdOExF46:kLJnJK8R304lCub2p2QS4regDdOExi6
TLSH
T13475E12DD2A810E8D4B7C2B4815A1796FF31347C2B2269CB59B4D5353F12FE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 98ab8fa3c945a406cfaec3907ecf3b3837aa2c03b2433285e13651fe7cddd0a4
MD5 a5ba1784a65366ec9993257af50a8bdb
SHA1 39bc07dfeb059e2c03b6e210bda6880f3ea98755
SHA512 0ccaf8ec4b819c53c0fdce1a28b9e827fab5e0b79d495f76f07ba437f69f1ddc46e713c2a8e508e0dd687f47b890fea05c1ec1d104170ff1dda07f5158f4866a
SSDEEP 49152:o9GqCzDScAZmlvTcFg8Ph6Hub2p2QS4regDdOExi6:KGubVQl3lxi
TLSH
T178955D05F7EB5294E8B3CAF1C96294159B327C409B34F7EF4A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 01c9569ec5c519575fc96c9e275845e8248aeb00a90b68ee0db82cda451e769b
MD5 2e67bffd866c56ccb3654db4f71f800a
SHA1 7a3d5b92956b49da89bfbf6fbd757145f627da2f
SHA512 e331ba3c9b502d1327f0af6aeff42181ae6c67991416574bee6f615f5a630345621dee58e3d4befb035af0adfa1c11e0be2b0434621b0e7084a83a43e94fc733
SSDEEP 24576:QlYJeXm5jUuEJub2p2Qvh04+TGZJ4gDdOExF46:QlYJeXmRUuEJub2p2QS4regDdOExi6
TLSH
T16A65120E61AD34E0E52B917895928259D371F1A4139323FF42F4C27D8FE7EE92E39A50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 f85caf775c73e0861f149d863164d08a9c2965bedfd6afb2a52833a77130d7a9
MD5 98b6160d0c234476a9bf99bba71d1f3e
SHA1 71818aefb0b8f6b16bdf768af5db3c8be781167c
SHA512 d9bcf903e6d5d06c42bb8286d72b56a261ee3f8636b579721edf75c37396add0a959e2cc11920f98a5a987db73639899cab98cb9b40d04e160a17a1faf1cc724
SSDEEP 12288:s1u6kyWVw9fb2Zc5u2Qvy0JG4+TGoH0zFPwgR9GwlZkExLR4i5rRF:sEtyyub2p2Qvh04+TGZJ4gDdOExF46
TLSH
T1A265220D62A428D0EA721674D6A382A59B34FD244F6252EF41F0F33E5EF6BD4AD34721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 0d831114238d679b304bc51ed16f0e72ec97c9ec327eac5e29bb4a0cc4a6d018
MD5 45cbe20d6b76fad8e4594e25b49348fe
SHA1 50228d818cbe53309144e58b6a442026e59dfbe8
SHA512 dd49bc03f8d4e8591467886748af26a4b0c04a6f8a5c5a16a1bd5e5322737a281f3266bb11b87cfb6aac063132bd80539478ac0121dd8f27a4fe611e69f6086b
SSDEEP 12288:JPjVw9fb2Zc5u2Qvy0JG4+TGoH0zFPwgR9GwlZkExLR4i5rRF:N5ub2p2Qvh04+TGZJ4gDdOExF46
TLSH
T17555230E41663C90EE1366B0515343EA9674E76817F330FF42F8F239CEFAAD86AA5055
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 4f8c5fb32bf190f19201e37547b6b5c88ce4564a6d518642a0a330f419c6a3e8
MD5 fc465125d0fb8196131fff2aea7333b0
SHA1 9bf0995eda9c5c2563e2c28fa524b7b3c75372cc
SHA512 ed9bfcec66e55a4879920383647706cdef7e3d709b1ce74b3193ce68356b84679cdba3298f9fb76e0490d17bc199d1c813021156d49d873bd7aa8cd2d7f65cf1
SSDEEP 24576:/C+TyQIu93VAumZr7jmQub2p2Qvh04+TGZJ4gDdOExF46://TfIq+YQub2p2QS4regDdOExi6
TLSH
T18B558C1DA7E91DCAE276C675C8A34493E633B472137296CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.5MB
SHA256 fd8107ff8b2e6d67a019a10c70dceba61b1ccba8982daa5a04b62a39115eceeb
MD5 d88e97f5af64180feff1b0bd68d1b11c
SHA1 217b6d02257e56c0e7a1f19dd0fa76486a0dfb7d
SHA512 9e9324ca902f30c7e5ed7308fb955a00cec172b91884bc43ddfee1978dae3226600178f1ca54247464b471da6c751975e73125261eed790e90d97d94fdd7f10c
SSDEEP 24576:LLQikZNub2p2Qvh04+TGZJ4gDdOExF46:PQikzub2p2QS4regDdOExi6
TLSH
T11265F10FB3AA00A1E567C27888824256F6B3B474476263DF42E0C77D4FA76E97D38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 3c59a6ff9ef70638bd63250a28e4ad5a6571a61da09491a9c33858d4398785b0
MD5 00bb581eff6c64c01562e49ee237d0f0
SHA1 c033d0b547e77f8c101b163cdfbea37f566179ee
SHA512 ea31e6d224b5ec5fd0567c9f1c1ad1ac6263572e6d634e91d3d8f5512ff883ceced5158fe751cfdab2e222727c284bc3d44563a7438cc33993fd5bae7a6af1dd
SSDEEP 49152:/pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPyub2p2QS4J:kpC7b4+80GTkfubVQl3lxi
TLSH
T130A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 294112953810b8539db876fb8819a07efe3bbbf7351b03b4baf57760f2b337b6
MD5 d681e5625b36e4ee84d378478a52b6f1
SHA1 b739884166fea072cf8002073fd66471a252044c
SHA512 99ef92ae1df4a6965acb8ddadf73bbfc27df2208cde7827866c24ed5c41de0a0d4d6532860fc9312d4d0463c3f75724b3613fe10385763bedaf7ec1166cd9b0c
SSDEEP 24576:9SAwJPE1IDAo+4Kt+l44135UQ6ub2p2Qvh04+TGZJ4gDdOExF46:9qPCIo4Kol4/Q6ub2p2QS4regDdOExi6
TLSH
T1F155B01EA7F956E4E17AC7B4D663C611FB727822133163CF8290813E0E16AE85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 1bb4474e14cc7ad12a416ddca6a37348f7c7fcda3b8f296a0e8721c9f5bf60ce
MD5 036bac2fa86066ecf96b95aa88922cf8
SHA1 83a82ff13341fcd0a91e050e193dc4568efd5678
SHA512 caed9936b1ed31ebaaf7db90c06da2a6a194153efbf57426ee63d7485316fb64561bd1151fb3a4ea2fa1dccc90fa566aef3fcf454525335da77fc5282ba6c6da
SSDEEP 24576:FyLXPLcw94tKub2p2Qvh04+TGZJ4gDdOExF46:Fy7PoXtKub2p2QS4regDdOExi6
TLSH
T1AF85E03ED66D08E4E47AC27CD2A38506F67238AD037266CB05E491791F6BFF46939B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 c911bd8bdad83725e805ae96fb758b0b895f254b73e36cb4d945dacac39d4bdb
MD5 7b2d065e6890aae69c8f587c51457348
SHA1 a536d35e9af77cf266be905a181068dcc8d99fcd
SHA512 b6dd3a6fcca039d4dc6733995591b7b0161db5a7afad1488aceb25d42bd747903f248cc7535b42a800471583f13f2b8ddf4850009ba73126a079acbcac88d143
SSDEEP 24576:WWv8qjp9ub2p2Qvh04+TGZJ4gDdOExF46:WWv8iub2p2QS4regDdOExi6
TLSH
T1B665120E52E428D0F4364270E123826A8171FD7513B269FF71E8E67A4FB5AD4993EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1508-151-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/1508-69-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/1788-39-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/1788-38-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1788-130-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1788-32-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/2172-65-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/2172-61-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/2172-54-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/2172-67-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/2172-55-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/2736-153-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2736-152-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2796-375-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2796-167-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3144-25-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3144-15-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3144-23-0x0000000140000000-0x0000000140160000-memory.dmp

Download

memory/3144-100-0x0000000140000000-0x0000000140160000-memory.dmp

Download

memory/3448-29-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3448-28-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3540-166-0x0000000140000000-0x000000014014C000-memory.dmp

Download

memory/3540-113-0x0000000140000000-0x000000014014C000-memory.dmp

Download

memory/3640-101-0x0000000000740000-0x00000000007A7000-memory.dmp

Download

memory/3640-165-0x0000000000400000-0x000000000054E000-memory.dmp

Download

memory/3640-108-0x0000000000400000-0x000000000054E000-memory.dmp

Download

memory/3640-106-0x0000000000740000-0x00000000007A7000-memory.dmp

Download

memory/3912-377-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3912-115-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3912-183-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4872-13-0x0000000140000000-0x0000000140160000-memory.dmp

Download

memory/4872-99-0x0000000140000000-0x0000000140160000-memory.dmp

Download

memory/4924-357-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/4924-148-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/5044-225-0x0000000140000000-0x000000014014E000-memory.dmp

Download

memory/5044-119-0x0000000140000000-0x000000014014E000-memory.dmp

Download

memory/5100-427-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-438-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-429-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-455-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-456-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-457-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-458-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-426-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-459-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-447-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-452-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-453-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-454-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-451-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-450-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-431-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-428-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-449-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-448-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-446-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-445-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-425-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-424-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-423-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-442-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-433-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-443-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-444-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-441-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-440-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-439-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-435-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-437-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-434-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-430-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-436-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5100-432-0x000002995F010000-0x000002995F020000-memory.dmp

Download

memory/5164-144-0x0000000140000000-0x00000001401B9000-memory.dmp

Download

memory/5164-141-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5164-135-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5164-331-0x0000000140000000-0x00000001401B9000-memory.dmp

Download

memory/5176-182-0x0000000140000000-0x0000000140178000-memory.dmp

Download

memory/5176-376-0x0000000140000000-0x0000000140178000-memory.dmp

Download

memory/5328-143-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5328-49-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5328-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5328-43-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5396-223-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/5396-178-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5396-172-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5396-185-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/5396-201-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/5396-184-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5396-378-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5464-162-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5464-374-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5488-157-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5488-373-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5676-122-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5676-131-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5676-274-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5676-128-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5816-88-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/5816-96-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5816-161-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5816-94-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/6096-1-0x0000000002880000-0x00000000028E7000-memory.dmp

Download

memory/6096-76-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/6096-6-0x0000000002880000-0x00000000028E7000-memory.dmp

Download

memory/6096-0-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/6096-385-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/6096-372-0x0000000000990000-0x0000000000F92000-memory.dmp

Download

memory/6096-382-0x0000000000990000-0x0000000000F92000-memory.dmp

Download

memory/6108-85-0x0000000140000000-0x0000000140186000-memory.dmp

Download

memory/6108-83-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/6108-77-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/6108-156-0x0000000140000000-0x0000000140186000-memory.dmp

Download