430af3acac9726ca95d183849e4f814c1713fabd4d8449b4a8a5d6e516edc8db

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
Size 1.2MB
Sample260507-mskvyscs2t
SHA256 430af3acac9726ca95d183849e4f814c1713fabd4d8449b4a8a5d6e516edc8db
MD5 b52f6c3168d738f06f4748f0e1f5e108
SHA1 e2a66347f4637f7f5eeb906f91dbfe8aad528662
SHA512 2c18a63b642fe4dffb938194b71eac38431c7b1a0b4b5371ab452b5c1d035cb16cd216037981f2efa469f2148982ccb7ee94d34dc37365c2c9225743abf5f907
SSDEEP 12288:U0nLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:U0cNyBo4kx929bL3Hnx
TLSH
T15F4523124B0C627AFBBD3F70749A8454CC35BC8D0D95DB94DE62ACBB58BCDA2DA21107
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4216	alg.exe
3100	DiagnosticsHub.StandardCollector.Service.exe
2244	fxssvc.exe
2076	elevation_service.exe
1316	elevation_service.exe
3596	maintenanceservice.exe
3396	msdtc.exe
792	OSE.EXE
2236	PerceptionSimulationService.exe
2392	perfhost.exe
1684	locator.exe
1320	SensorDataService.exe
560	snmptrap.exe
1996	spectrum.exe
3172	ssh-agent.exe
1136	TieringEngineService.exe
2068	AgentService.exe
3784	vds.exe
2436	vssvc.exe
3452	wbengine.exe
1464	WmiApSrv.exe
1692	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\829efa3389fac755.bin	alg.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180578\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da2d6c690ededc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092a76e690ededc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd31c66f0ededc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d3a9bc6f0ededc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000506a67690ededc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3100	DiagnosticsHub.StandardCollector.Service.exe
3100	DiagnosticsHub.StandardCollector.Service.exe
3100	DiagnosticsHub.StandardCollector.Service.exe
3100	DiagnosticsHub.StandardCollector.Service.exe
3100	DiagnosticsHub.StandardCollector.Service.exe
3100	DiagnosticsHub.StandardCollector.Service.exe
3100	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
688	Process not Found
688	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	468	2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
Token: SeAuditPrivilege	2244	fxssvc.exe
Token: SeRestorePrivilege	1136	TieringEngineService.exe
Token: SeManageVolumePrivilege	1136	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2068	AgentService.exe
Token: SeBackupPrivilege	2436	vssvc.exe
Token: SeRestorePrivilege	2436	vssvc.exe
Token: SeAuditPrivilege	2436	vssvc.exe
Token: SeBackupPrivilege	3452	wbengine.exe
Token: SeRestorePrivilege	3452	wbengine.exe
Token: SeSecurityPrivilege	3452	wbengine.exe
Token: 33	1692	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1692	SearchIndexer.exe
Token: SeDebugPrivilege	4216	alg.exe
Token: SeDebugPrivilege	4216	alg.exe
Token: SeDebugPrivilege	4216	alg.exe
Token: SeDebugPrivilege	3100	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 5108	1692	SearchIndexer.exe	105
PID 1692 wrote to memory of 3284	1692	SearchIndexer.exe	106
PID 1692 wrote to memory of 1532	1692	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-07_b52f6c3168d738f06f4748f0e1f5e108_amadey_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:468

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4216

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3904

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2244

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1316

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3596

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3396

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:792

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2236

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2392

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1684

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1320

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:560

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1996

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4788

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1136

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2068

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3784

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2436

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3452

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1464

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5108
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2868 2880 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3284
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2036 724 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8cbef848378b0d1068a7b26eda49915004086ae3b245d69990540288f67f51c7
MD5 04710625b4f48d37c0dd0cbb350cde12
SHA1 dfda6c5669778d76ce546c92e65d1e30d771e58c
SHA512 5c70c90fb8bd71ac5dce3ef25996deca14deb0d9b5e10df0833635e19e112899bf2c0a9e52d0cbd315da8412d705831d2442f51280a5ef53c6edf5b7740fb28b
SSDEEP 49152:cb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnJIB+kn3Hnx:G3q6sjBB+k
TLSH
T1D3D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 f64a7fb48f66f1b09a25680b1adf9a7fbf5166303088e5be7b7e80379a44e734
MD5 61083b8c3d83520dc0ea83cd806c5b47
SHA1 85879a5ec3da696b83a6c3dc3e966eb261bac266
SHA512 1795d751c4dfac81be18a085397bf8837843bf28a015e08a9ce460c47ff766e42eb4112e7bb070d73ddf86425adaf9cfd2d45fddbde7504ecb3960295020866f
SSDEEP 12288:W1XLsswWkxy2lRq2czAe4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVo8:UXYfDtczAenNyBo4kx929bL3Hnx
TLSH
T16065012967D409F9ED6B927CC8A28511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 fc661b7bb9a6529a2651ca941722507f6b4cdcfda6ca0e0779ba05de7060f978
MD5 3ac1f59b36649491bb1f9089ef3c3aa6
SHA1 bb5be86f4002dc1c8d384f5c31bd08edf39d77b5
SHA512 c8a7c9775d923fd33c6bdfd60dd54a3cb3dd28430bcd3bfdf1468cc253d8bd8a9fe03856bdae028aacaaa539040db5e6af62ad30993013cecf0d5d43dbc59664
SSDEEP 24576:+0Le5ji0hmxfrMhnNyBo4kx929bL3Hnx:+Pji0AdMIB+kn3Hnx
TLSH
T133859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0e20817879952f164184ed8b67049a9a885bfea89cdfb91cd87c6324fa52ab14
MD5 7bb6b66517e159880422811b3790355b
SHA1 ec4a2eb5dc8841d827bfd9c2e139e33c7be8fbbf
SHA512 0d27f46b7b7791e58b56af4f154bc41f883b18af77ef7fc584660b454e7a4280f322d6871c1c807d1609b26e47d917676465d61bbf6cb5cc25b7b47705e107d1
SSDEEP 24576:+a7/ezSC6vUyD/aqgrvWn6q8wyujnNyBo4kx929bL3Hnx:5/ezSC6vUzPveHjywIB+kn3Hnx
TLSH
T1A6755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0f67986d92791da1d1fad584a09b0d814b3991dd5b06683eca2f5785f4282c01
MD5 2fefa5aae9f0356a7c75340cb0a23447
SHA1 1788fb5bbc7546439c40e88e378a30de7af24d10
SHA512 af68d11062c56f04d61aa610e067f67eee7fb1263adab35d45a57a67d469e9b4fb9a19db6ca4500a8706e0d0255b8145786a28bb3c1ff33023c2f1b14a65d692
SSDEEP 24576:AVbqPb88hv/l+Y6nNyBo4kx929bL3Hnx:AVO88hXl+rIB+kn3Hnx
TLSH
T170559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7fcd5628ec4d2bbc2e9a3d6f246e76f137e86081463ec44a53dcd621a7e55671
MD5 e98a02f7168f87c6c84f5bacdc22daf1
SHA1 6ec600631a86f53b7e6a4de94992f301e5723350
SHA512 fbb2392344c253b359bb19e81447ad0faced710694d26b412ff46c5353dd6e7d9baabdac60712d3556d3d82f62987dfd38ec015e71a15a57305c45707081f8e5
SSDEEP 12288:Rmd4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:RmdnNyBo4kx929bL3Hnx
TLSH
T1574523134B0C627AFBBD3E70755E8454CC35BC8D0D95DB98DE62ACBB58BC9A2DA21103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 6c73ece6432e34284baa7096752733ad300a26864697c96b4f9c6751fe7868e5
MD5 25da22bc6d1f6d81399e2803431e0baf
SHA1 1112fc2f03ff6418dfd6523667e67ee4e197f497
SHA512 af945bf30541bd1f3f20e7b06b34b6f94ec1e76e1e824b9d209d1c924eaa92ac61a991f59bebb97e0bee424682f992669a1675fd8414964ca51b9395e5edfd49
SSDEEP 12288:6eBNUbTVO86US4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyExD:6JIUSnNyBo4kx929bL3Hnx
TLSH
T15F65CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e4555da571e1e56c92e7d9fc624eb3ba2c514ca2e807aaedbe7c57858c59c8ba
MD5 a4c85ca7094eda5e355c354815d895a4
SHA1 911998262c920462765a62ca637371640cf5a994
SHA512 66bddcba580ab34b69b77c110d171d10a6451960fc05b86c8a15cf88284260ddc8c996c9f684dfd7209548df457bcf6385a67d6f79f5e593f2d08ac4020e756c
SSDEEP 49152:hQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THF:hQvGAdlCEL8c/DRNw5C4+k
TLSH
T1EE266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 54d8db069a36d93f703bf3724b5f154a2815feda67b89d0928992c89a9b71307
MD5 432404d6c97881fa45d44f59f307d186
SHA1 9f424248741da725bd2743b521c181635e08bd60
SHA512 2411760321e62006017a4cfea27da484707970af5d12f1820380ec27b9342601121f0d2c7d2b958c3ec971a8b3ee8d21699632884a9fe35bc6a9239d561b781e
SSDEEP 12288:IAwSfxL/2Dc3XDLLmt0LDQewsAjc4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbP:tOewsAjcnNyBo4kx929bL3Hnx
TLSH
T12F75E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f98dd7f082f8d80855fc56740499dd45987794fe103c86704d49646a674fefe7
MD5 2d9de6e28cd346793026e8a9f2a5485e
SHA1 c68597c1317525a05f523a25a154e13919df9b3f
SHA512 f358062ce4efc3966dd121bdd40ef4d95d63255de7686f3f68fc8a91053f4eedd7ed8bd4c7e70704100f7d1a57cf2104be0e9b8e48a60adcbd45af83574be645
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHP+k:5UEtQevvqc2W1cpV2tI32P
TLSH
T188474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3c93cbb4f923fc7d10baca433ff1b23bf46e53750fca7397412497b1af6faf26
MD5 c09d4ecf352dec7dbe4ca6a49d939491
SHA1 36c805673ce8ee97232becd24e9c31300e0f183f
SHA512 e4bd8c648fda42856d670c3915a0650beb7998fdc25e44efae68057918caf5e431f2258f28dc70ac21e1cf6e4aee86cae158252a6c42da2ca1ac0465b73620d1
SSDEEP 49152:0CbRquA/m2yL5zTfFiV+XenmE3/z8IB+kn3Hnx:doquVjnmU+k
TLSH
T163D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3ca1d5e6d6eae905d08cff89c7e2eb238ecfade3e021a3958fc5352e849c4850
MD5 2e5144e6df32d84d119a3063a64b88aa
SHA1 e1246a01bdf43793857631aa1efdb614819a0634
SHA512 843afd2c3073a2b9efdc3e20436ff9a0fd9721e7ba3601ee10bd35c3fc1ee00dbd59a475e31d602e990e737015c01333eb7c719d7315da9e4edcec3cb5c33577
SSDEEP 24576:EAhGL3IFoiwtA5l7S53HnNyBo4kx929bL3Hnx:EAMUFoiq53IB+kn3Hnx
TLSH
T164359E81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 614392d2de4689ab5fe11ce3e29f05942cbc4558b08a145a6b7537864777d2da
MD5 aff4473a01f7f904ae12e9e86993fd57
SHA1 b3f38a3042fe64531001640ad770420ad5001e2e
SHA512 1d6cabb6c83a715de9cfe04e85d9d7b51450b462049a469af2a9ad4ee3fbcdd61679712f149f2b8080e423c3a5cdea9fba94500306387116eccbe5c0ff39b348
SSDEEP 12288:Lmw5HEjsChNzBFgl0WDm+CD4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nT:Kwu6OWQnNyBo4kx929bL3Hnx
TLSH
T16F65010677A81CF9F96756388587C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 204da136e0abd1ef183431b8fd4ac4f488cee0f604e588cbead7368446f8417e
MD5 844580537142ce9a0759d7d55a0aedd4
SHA1 4600c2190683671008063215ec9cf49b70814720
SHA512 7603390c2148bf4d337f2d1d778f5c9cab39c46cd42f759f0968d99e4c02b030c1c91a5c683b1b26c5472c833f7afb91f572546f7f52b16be4e380969ced8824
SSDEEP 12288:WgZ1Iys4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:NZuZnNyBo4kx929bL3Hnx
TLSH
T152551216239831FAF2AB2678D8E58544CB32BC461B7183CF5A2146BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a30c38306f5e9f49b7b7c5eab5d586577363af90a4675364725a364cbdb59c35
MD5 8783536351bd2b9ab1dcd15c2b1193fd
SHA1 a9bc6e74e508805913c6d9f3294ea295c00a520c
SHA512 31646a86ad51cd19a6142a87e87821d1b1ccecaeb328f98d8c3895522650d48feb990384ab5d3c4f59fc76d64384ecfa7f807f5efba16f8b13250a669ffe7643
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uh:hQRQyi36YOcPbLvw2gAf+PN3F+k
TLSH
T11F666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9307e206c4070c051856db380da9388dd5ee536241dfc2e9e01ecf1eeac5ed95
MD5 54ff979ea56ac09b46a2fccdc4ff0dd8
SHA1 0774ea65dfa6cccc06b10efae7f6c67006abe98d
SHA512 e4da7457cda8d9cfc9c7decd979cf8b361a16fddbe907f6e80e1cb80dfab46420f148eb96c9787e31f1ba88218755041d837585517b1ddf71bf3e16d586b67bd
SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uh:mQRQyi36YOcPbLvw2gAf+PN3F+k
TLSH
T1D7666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2df0a6ed2368245e88f0a636410ae805d6fd9ba267074d1b865cea7d466470a5
MD5 d9bb310983927809305c95a7799b35bb
SHA1 675952abb2a85360d2a599de55413f0e0e08fa4c
SHA512 8c669f2e266652824ba3cfcd6813794261b75b76a80fb234b9df841a224058d558be657ef5ef7f951a21aba89d4d9299c2e0569997649ca1934647287c04ffbd
SSDEEP 24576:/wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0JnNyBo4kx929bLh:n68Qg55nhceWu7PNU3/MIB+kn3Hnx
TLSH
T1B0B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c559a2d890587831b455c92b29e0ae1bd72b1eba6f5412e79067dbef57d41193
MD5 2dc5b2dcf29a88c1da559c2edc6e649d
SHA1 d157357a70c6398b7c349c71452cc73d102b1e4e
SHA512 43fb7305344b0a9cf10fc176bb61485de9018d51ce93ecc305e61cac1ccfb089a413cd32fa1aeff149680efc30df28f656b4ff8dd10730fb44f4cf76ee64f1b1
SSDEEP 49152:s3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99f:Jy5112gYy5azzVvt69nLKnhZW+k
TLSH
T188167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 89925c5549dfcff04d9fb6d03abb4949b2073ae4c285cbadc4acd52094f454d0
MD5 c8c8f811cf50e6b3ccafc06fb08af5ba
SHA1 3bb2230e461472e159657b513f6bce86f3e43b2c
SHA512 30433e5b4c4dbfa4d9140d21c717099213da1344e27b408a798a5b9fe73e338b1cc7554c51167d00c88249391cd852945ba713ce1ec8c67f39862a9f4ad3e59d
SSDEEP 49152:7B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glOIB+kn3Hnx:tu6Jmdxd2d9+k
TLSH
T16BD5AD13F1DA01E8D06ED578974A9233E962BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5adaeafd69cc1549e6b0c149b0bf1054cbd3da988ac71f2c59e8906f6b9d4501
MD5 07e3ee2f7b015f41973355172d20a3a5
SHA1 bb90795daa8f5cf2614f5a9e6c5f06eb78806a6e
SHA512 996de757a651945568dc9bbf804fe0e99d5dd45a2626d5cb3b3500d5933b0ebe4d7d76bde5bb28d95203aa47e19452ea916b97b6b8eb084318f0aea4d9b9174e
SSDEEP 49152:f1hpsNoJpF1A63U44CwH7R4xyIB+kn3Hnx:fmifPWRU+k
TLSH
T1E1B5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 54be2ee119a5a7ce3b31128a762af05defdcdad6ba5bd626b0b75de1a39ae614
MD5 b038a0ae5e5d241ab37f8cbb5c5f1f30
SHA1 edded617688bc80ffacb075d9a5f0bf9da4ea408
SHA512 4399ee634debca635dbdfb8aaa02217af192cfabac354f9e8fc4c6a620b9422f2717ffd8421ea3ef3214dde18378b4672f47638a72a767f7e9863ea9574aa77f
SSDEEP 49152:oSuZQIY0Be2KcRVtOnks6NMHqZIB+kn3Hnx:y5dKii616+k
TLSH
T10BC5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8225ab3f1c96dc7c5c82f46ca0b296770de285e71c821e526162617dbaea580c
MD5 1be08980dc119dbdd1452cfedfa6a4c2
SHA1 432b9796d4c93432d336bc2c9c89a45aff71af77
SHA512 cd428d29518324b116e5d7b0b55ade340eeb79eafcb7e6fbac8e1f7eafb6c49817152014942ae3a77cc66ff16f19c42334ea0fef3fcd552b188d09eec11ad3b5
SSDEEP 49152:NhtSn8EApI0fig3giDn0AP5weIB+kn3Hnx:cX2imphg+k
TLSH
T17695BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 afad91d41ad1a56e3edb50ecd7fd0b56f5c6a866c9a8c5e035ab7bd1025c4669
MD5 d5227b2c93bd78951a79fe556e964ddb
SHA1 215e2c2b59b8b50021e545265c7e90c960a996bc
SHA512 fb4a8d687f85f2c0dc0346fd449e0f4ff41b7f25894d97cb1e062c491ff9e23a119d8fc2845a7d4637093c941da20032df4b511ddaa6dc2d63f00a71c7e1791e
SSDEEP 12288:H14LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:H1nNyBo4kx929bL3Hnx
TLSH
T1864523025A0C627AF76D3FB0644A8498CC34BC8F1E9593D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e3ff35744ec64f02e15ddbfdd3759e23e1182b5b0f6db39c2335300f73feb1f1
MD5 5c0924d2c263259ee021626e4fd7fc9b
SHA1 d15aeda3c696c6fddae1e1688261be6b2acd92ca
SHA512 de5344833bc1171bd027ac51bc86fcf391dedbda55ed5742a51c335f88cdb70e42c0b748e701c2f0900bb763551fe474643eeb63edb706c00936abed4d21a2b0
SSDEEP 12288:E44LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:E4nNyBo4kx929bL3Hnx
TLSH
T1214523125A0C227AF76D3FB0644A8498CC34BC8F1E9597D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c4460b46770af32f280df6acbfb812b1e54a718b3789a658016422ae7d503887
MD5 7f26fbff2a8b4a3bc8bd9e96c1653eba
SHA1 440f600e39f131332d924dbb4c8c4b44490d4a9f
SHA512 433e57a1cbead7b392c2ed6598f3726c4a18317655bd96ce94d15e147f94e9b805d3c64aa9a31b762ef12dd3e603c98ead2027924abde383d54f4ed7564bf819
SSDEEP 12288:Oq4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:OqnNyBo4kx929bL3Hnx
TLSH
T1A44523125A0C623AF76D3FB0644A8198CC34BC8F1E9597D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 0334384b2796a9926c481f4d986600d0c2666ef80fb4155306c483617cf40f93
MD5 6bd737e92b97e4ac94b7ca0744a7e3b9
SHA1 ab5e2e9b994ca7ab54e15d77b7045fa4ca3bf723
SHA512 243e3ff59514b892e62506409ba9fcbffd06d9e084ef18b635361d6b338996c6eb2fddf9f4184dc212312eb56a5c55e0760da38c0d1158cf3daf57a8f02f794e
SSDEEP 12288:oVn4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:qnNyBo4kx929bL3Hnx
TLSH
T1234523025B5C12BAF97A7BB0985A8054C835BC8A5B7197DFDF124CBB0DB9BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 88688bb820c4a9ccb1512e47f6ff8984d6301a6daab4f86eb2e8affd55493869
MD5 74e211501d73381fe324444156697401
SHA1 588c5ae3394a6cc782ff4be41a8a9138d85b4274
SHA512 c2bf941e0309f7052f758f1da0a6ce05acd91e888bd6d4f65ec773c9767de6ddb0852513ea7baf4e1b323ac7bced91e7680e06aed3eff001948d8ae3a3ad6119
SSDEEP 12288:gP4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:gPnNyBo4kx929bL3Hnx
TLSH
T1E34523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e8f173e6b904178126ac71e556069a16c39eb180f9d73482834ce54d566359b9
MD5 594130e8250533c3ddaf218d38bf342f
SHA1 df81d9c6ce36f4d8781255fc4f3bc49e333576f0
SHA512 0c86cc45e906576812da95a9a01ad69c1a21109118bdd653cf2471bf936daef94621309759565d7505c1f1e02f1d7f7852e0c777952277442a8242d0169e6c3c
SSDEEP 12288:/U4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:/UnNyBo4kx929bL3Hnx
TLSH
T1574523125A0C227AF76D3FB0654A8498CC34BC8F1E9593D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b9ec1719ea20494d46d0068d52598e023a2cbb61d29cd32ee3e7ca25e87b0b30
MD5 3de3f2ce4fdbf4238a1c35dfd805d98e
SHA1 0044b7a63a0950a15abf68d2ef82c7deecf47847
SHA512 b18e142cfec0897d5c0f233bda988e348aeedf4976f4ddfa90a0b999577a97a00ddfc62703ea9b10f0aaf61e9b8419b9c7e8b0b4106b228bd8128b7d0658d44d
SSDEEP 12288:QA4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:QAnNyBo4kx929bL3Hnx
TLSH
T1A44523129A0C223AF76D3FB065498498CC34BC8F1E9597D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 25b1fb220bff269aac807706359c453a1133dc80df22c4b4bebd667d34b70961
MD5 01d22cbe103896f948cf3b2fe4a57675
SHA1 055db297b3b7f7b57a4a0d5ca932e90caad66977
SHA512 d01dd5e8f2213ee990ff9bcd3b2baaba0af2961a2aa7adeff0c2afecfc191d9119d621944618c5b9afb09ff3d23fcca2907c44e7f1cfdf6e973dd2a5c9cbd055
SSDEEP 12288:0iZwbjzzFEoS2cPvyY4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOz:XZMXzFVSOYnNyBo4kx929bL3Hnx
TLSH
T1F0650195B39418F8EC67823DC8158906C6B2BC4A0BA0C65F07B4367B5F773A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 549d17ff316163180178070eddc3f3ffc3038fd63e072f1000b7d64b696f99c0
MD5 843b2c4df45ce2ce48640038e075d931
SHA1 ff1aa8a71a2bd1f2aa3a08e235d9118357c37e6c
SHA512 e5910e816088e3ee1e10ad026676618bc61310ed2c2f02030791e518d76b4b5298b366a9be559edaddd0f41a865829a8a1b199bf82d4108f1a8d705e7ce4b1c6
SSDEEP 12288:5p4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:5pnNyBo4kx929bL3Hnx
TLSH
T1124523125A0C223AF76D3FB0644A8598CC34BC8F1E9597D8EF279C7759BCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 de47e61f8da8d3916fa6cf25a00159db65ee10c10ae6abfe6fa394e90c80cb46
MD5 8db6ea9fcc4fa9b47ca550707cc0357e
SHA1 b88ff118dedf86246d89aad007c588931f234ed8
SHA512 1f8ab9f3ac5fb2be2d33a50445a7880fb040e613bcc607bfc441f1f108dc8bb2a3eb9e9c3d5518112e905ec97de70bff14172ab21832dc940715f2f6d9822f10
SSDEEP 12288:Zt4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ZtnNyBo4kx929bL3Hnx
TLSH
T14C4523125A0C227AF76D3FB0654A8498CC34BC8F1E9593D8EF279C7759BCEA25B10147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 4bc4b382c20ddd7c598be73df5ef72c28fe572cd4c221e53be7a48d5facaef7e
MD5 af52820cc03662c9bac6d989359f0d8c
SHA1 d4af4272a89df4f6fa957183aef8f6e740b38fc7
SHA512 df5b34ae90789b61cf753c0eff3f7e48f93de4d8aedb7d1d5b688199e90c12a9d3783f80ed73ee57fba087be12eb21ce20d356eaad0ef4af62e5cca34422d631
SSDEEP 12288:cyPz5L8s4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:FzysnNyBo4kx929bL3Hnx
TLSH
T12255120777A831F9E17A6234C8960A01E771BC360B608BEF576046772F776E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f427b8c996ee64c32fed7391e71f360e7feabb66706c49d189abafaf3448461e
MD5 caa3fdde95f14acea0285fc988146fbf
SHA1 01551d3c36fe0e9210fb40c9239fd4ef68b21e67
SHA512 f5886d778e7f40d769b9ff668c874a6a74342a3950cfbe26460aad4ab7650d8948dc058800f9568ac79202f829c05c8501913af974b9afbbae8119ab4424b2ea
SSDEEP 12288:Lp4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:LpnNyBo4kx929bL3Hnx
TLSH
T1D94523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 dfc719e28acaba60fafdb7cb3271b99ac5bf40202cb5c42fadcb5c9f93cbecff
MD5 b2bc3c5533495ca93f4d982947fc280f
SHA1 c761ccff676a6fc1b5939aa4d70d2204970915e0
SHA512 41fa6888240220f248ec4727883b36976f2038a3bdca6ba655b7b5ce975b3df7966d3de1bfaccd57252dba6ed58d1110495e9c3fc7ba6c92ac97bebbe75e9369
SSDEEP 12288:bp4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:bpnNyBo4kx929bL3Hnx
TLSH
T15B4523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 7d244f665f63455be0cdb0933918e9e86cd9993b24e5d2e804a5233338302ede
MD5 48743ad7885cf19a31b83786bd9cf15c
SHA1 03fe809f9ed7d118debdbcfc1bac5f3c9bda477a
SHA512 86a903b34e3e42de7691ace3d2ad743e6c8167ec656d4b798a0f4a7505ecb168c8fa24ff5960f4c17cedb337381632e56e5e3bff0220c5d9c7b8eab554c75ce5
SSDEEP 24576:tCU3pvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAGnNyBo4kx929bL3Hnx:tCUZPTY+8Wg2lIL8lrIUJLWwPIB+kn3R
TLSH
T1D765AE1EA3DC089AD4BB813489518A06EB327C2E1B22D6CF2160C77D6F67ED55E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 58c4749bf027bdc73320cf88cc31949b0558a25d2a44ac22a2a96e8b35349128
MD5 429be0064632413bfff4bd4c303f416e
SHA1 9308bbc6f31fc2480a492706205d57ff51994e92
SHA512 02272a88045466018c1f0ba219a221b8d57e796f57c026604f35d742c56ccc6d1a57e0c41cd38ceb1ec847dfb89e05b8766f3177ab3abc244aa45e3ecab12c90
SSDEEP 12288:qpsfZ4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:TZnNyBo4kx929bL3Hnx
TLSH
T13D55F00AD25812E8D16E6274C7468A40F7337C5A47E1D3CB97D0F87E0F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4fc1bbcf2885e72a55d5a554679aaf338e1e5488ff645a6d165bb4c5ffef2469
MD5 1e5ae32b22cc248e0012422871ec07b6
SHA1 8c4e6d30195320c7e93d5e9b5ebe3d5d6a3bccef
SHA512 67f76e5feed0a5df1361325dd38821b237b91733f7a0a1e36ca42f68faa74ddee98ba2d13e19f07f9fd2340709aad8f0b4c166bf78dd0d9d69c05c8a9d6a7784
SSDEEP 12288:EK4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:EKnNyBo4kx929bL3Hnx
TLSH
T180452312974C623AFA7D3BB0645EC024C839BC8D0F55D6DBEE1258BA55BCED29E30607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 4babc6191ef107b41b4ae5055f8e349ee82a11fea96323bb27d5b5c7d4470b7c
MD5 efd72fa14f5f24222bef845fb9cdab19
SHA1 0ecd280220af69dc3fbc20f3f70b160b246f50f8
SHA512 0c2e0609150299e45bbcd05ba1c4fb197d63914121ae721d2c91e4e2c833508f097160ebd52ab41c7ed7f79710ab7766f3aa1148f4882cd8b9676fe463e3bbe6
SSDEEP 24576:P8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTC8nNyBo4kx929bL3Hnx:URZwQCyiHiQEaiPnMBIB+kn3Hnx
TLSH
T17285AF1E62DC42A5E0BAD278CDA74407E6B27816473197CF1291C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 252734fdbf7343a1fcfb6b713548d52c63d22df3e4edb22f7991845029db90af
MD5 485ce33c87eb182f7a27536e728c8a3b
SHA1 d6c4a184f965262288b6f8b64ae29c008078eff5
SHA512 6f2eef12ff4a47985154056de6e0c16eb6182227e4025529bddcfdcc73cd3be0bda958730aa166730b9364abd35edf64b2f6cb721d58ece65368c827c8c67a55
SSDEEP 12288:SbxA1U7Ka4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:SbxA1UGanNyBo4kx929bL3Hnx
TLSH
T11B55122E569C20F5F27AB63898D68105C731BC0A1B2193EF6592C27E0F3BEE55D35B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 ef8c7a1b2afaf9dca3da3460928afe06f9acdf328861feaf34bb49f030e57bab
MD5 5e0de0ede0de12eff905498586297f0c
SHA1 f5671d1da148c40a78ec5d34a8ccafaf0eb2f46a
SHA512 930e571e3a94435247b7be4fd3a966c940bd3116b1d88ecc3e31b27e295cba191c52170f45e892aa53bd83ba2d3d4057a2552911c1014e8a01ca576f13212ad1
SSDEEP 24576:YjsmP0yHaqrVqHra44KDzMsrn3nNyBo4kx929bL3Hnx:YjRP0yHfVqzlAsrn3IB+kn3Hnx
TLSH
T1E345AF2EF2B910B9D4AAD136454507B5EB71B82D1F209BC70170C635AF0AEE89F35F4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 4f8d32a23ba5d2f7024f3a1faaae48028a47b7d46eb53ca3391893658e51d6ab
MD5 5ed2ecda079d3c9e7e4e96ed4e96e836
SHA1 672df0a38b0b2ae130844db0a868f746f6f658da
SHA512 3ba2fe825b3d3fc73fa5a367dcd3831b1bd10c2a666ba06f3d9f20af3404563597c0a85cef249ddd889d08955a8ea4e829ff1f51f45a21d4212f7e5c47f0fc8d
SSDEEP 12288:w04LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:w0nNyBo4kx929bL3Hnx
TLSH
T13E452312560C627AFA7D3FB0644A8554CC34BC4A0FA597DBEE6298B749BCEE34E31103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 76e031ef23fd7388c7aefd6b38d938ac641287735df5e781449d7360b3067262
MD5 268f400cebdcd46b91067cc09e7c65fc
SHA1 0390c53aecacbc17df62d75fd092312ea4911928
SHA512 738b5718d79893bd140585d9ebeca5c8e47aecfaa9ccf7c667d30e965170f9fe8dcc647acdf69ef52c5a32eecefaad50eb35fda3104cf571bfcd65f76ccca18a
SSDEEP 12288:0ObFA4LWO+vAYFTe4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ZxLBUTenNyBo4kx929bL3Hnx
TLSH
T19F750115F79800F9E97B923CC8A68916D672B84D0764E7DF03A84A661F637E24F3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 b4fc9b9eec18f9db44e0a3ca410280897d44e69f887f07e747969e72a9b4b531
MD5 1f1bc8c1173fafbba5c67abbb7de14da
SHA1 673f7eb14417d9570fb910ce459772939a04ec4b
SHA512 84cbb2e8f7d80c38f8a2c7707f2b53307e10876361111150164300f17fbee239f63690a267afa1080ecbc799700ffb1ae64df7d0e4fab15f83807bd39bddbac2
SSDEEP 12288:/70VmrIYNvUyBpl4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ojYNHLnNyBo4kx929bL3Hnx
TLSH
T1D965F12F52AC19E5E53FA1798AC38209F572B856171193CF05B0C27E0E27EE9BD3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 680dc1351d0671375e04f400e6e3a9ff1cce100b752797bac79a8a2d7083f307
MD5 8d3861107c47a8cdb695c618e60bc0c4
SHA1 fcbc668626b14ad5ddcbb0492c48fc5eed4692e2
SHA512 c17724afa3195ed36c50bc23b7c10784970603de898d719cffabadb08ef6c159078ac73705c6a141aef479a2d4bc639041cfe7f0dc4b4700e5fa6097218d6ea7
SSDEEP 24576:RnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKz:RnXoJJYH84VVS6AmEOJas+cHBjSSKHPj
TLSH
T14765BF6EA2BC04E8D5BBD17CC5C24506F5B178661331CACF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a85077dbeea58ed31725fd8e0e337032e575f92b65856c509a13a1e574ea688f
MD5 41f67835172941d23904b504d4ef9526
SHA1 f71b1a564da9a19ab595abd5ac7215f79c8d13ef
SHA512 c64faa980151bdd4d8a9dc0d151953f3b97133e5946cf911e241b2c15275f9276988d3a906f6052c94164f3eab01724829898c164a8ac22902cd91119746e654
SSDEEP 24576:ov7Xbxd9Tuycf8M/TYlSuxrr2PC9nNyBo4kx929bL3Hnx:oDLL9TuJ0M/TYj2PUIB+kn3Hnx
TLSH
T1B0858D1EA3EC42D8E4BBDABD85A79146FAB2B855173081CF0251856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 4aa5ad97b09935a5ecaec281de14943d2a8dc2236578ad099aa307e1be9356d3
MD5 fa60e5ecf8a3b99d49a1eaabc73d97f4
SHA1 6ea6fba02044d22afd56e74aa42b1a73bfc775d5
SHA512 edb32baef4d9f8187e8df0d89efa84b4f1dc33e87f425667569a2dff22010e1a86fd260a0973d4b62f0fa1e5e961aa96cfecbd4e3e75327bf9fbb9c3f05551f2
SSDEEP 24576:5egJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wenNyBo4kx929bL3Hnx:5ngOJOmPOHzeIB+kn3Hnx
TLSH
T1C155CF3FA7BC15D5E03ED17D8A978816F6B1782603255ACF0560827E5F2BEE42E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 fbcf7b893ad3937541ebbebf43481eb896e9a5d9583cba0e0eb89774dc943894
MD5 6e6d2ac5e6407aa7ea7d5870742f268c
SHA1 91314ce4701c60fd03cc65dd149eeec4af60dd23
SHA512 b5e6b0b32350e0f48701245e8073dd225f1f1956c58f1038bd30d8d34f9ba835dcae552104e11d4bc5922a71e99c11d01fe2cfd8242d1430a503951029bd84d4
SSDEEP 24576:yLJnJiTk3R3waE4JrOUnNyBo4kx929bL3Hnx:yLJnJK8R304lnIB+kn3Hnx
TLSH
T1D875D02DD2A810E8E4B7D2B4815A1756FF31386D2F2169CB59B4D4313F12FE0AA79F09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 eed143924ab8c36104ede359116cb1390666a139af3661195efdfe3d26c2557b
MD5 4d628f9bce960e7856b2fc050d7ce4c6
SHA1 33cd9db1d6ac692b878adb0c701e0295e93457d8
SHA512 4ae5561a679f0a293e795584f081376dd73e3f45a357e675f169180a9c2d8ddd038b276afd8a4750739921937330f857d228f551b9a5e78873e9f1dc46123fa1
SSDEEP 49152:G9mqCzDScAZmlvTcFg8Ph6AIB+kn3Hnx:IQ+k
TLSH
T1A9955C05F7EA5298E8B3CAF1C96694159B327C409B34F7EF4A80C97A1E32BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 17378b523ea9197a28af98c9ee0d8ca7fea81a505b9b435bd386c3e5e3250c4f
MD5 88d9afc8bcbf21b96d34b25335ba9f11
SHA1 6fec13ac55ea989604446794c328b570a305a93b
SHA512 a10f8b62c07fbf81852754d670d23a489bf1675a6f62f2a3e9f7c526676377c68bc93cd6f49b2bc4df4536d43d37255c6154b20fb6f407aff03d1d1cfa461133
SSDEEP 12288:blYJeXm5nkEUuEu4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:blYJeXm5jUuEunNyBo4kx929bL3Hnx
TLSH
T1FC55121E265C31F5F23E657898928504C731F8A6175163FF96F0C4BA8E7AEE21E38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 b7cab3f126a62b044a999a2975322060b7e1d7f55a8332a6350591a4e6e7625e
MD5 17397707af4c6d073db2dc8bc64e6ca2
SHA1 9d7cfa835fb38db1f9d7db783d24b6e60ef2e506
SHA512 526308e23a90bb6c8a516832c2f95fd0563220959b2c86cbd66b0694a19f5f40342905ec689f98b2e520f7ba90973c623d4a33a0de1c91965a49e65b3e1c0771
SSDEEP 12288:YIu6kyX4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:YttyXnNyBo4kx929bL3Hnx
TLSH
T1F2551201639861B8FABD2A74D9638194CD34BC154F2093DF95A1EA3F5E7ABD1AD30B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 8a350c435a4ef89923031e495a9f69151b3a959a5d52d19403bbf989f6750059
MD5 86f43f6fd28ba500efaa869e0c4591fc
SHA1 5c976ed5007643d073ddd2e639c0becacc92b539
SHA512 976f5699993ecdc22ace98b814232be2e78f883564fe1f73745cb7061b2f03d4453579054d240385c96281efa60ee7cbe8b27118badd07a11e551d2559ea3990
SSDEEP 12288:MPe4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:8enNyBo4kx929bL3Hnx
TLSH
T1BE452316461C3279FA3D3EB0645A8554C834BC490F51A6FFEEA2D8778EBDAD35A30903
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 c891a99d47bc6ffba33173580e14a94ebc96f3bb27767462492fd41dcb540cc7
MD5 2777b23d21adda55b090984497f2b385
SHA1 aa7bdaeed2b954943adb91b414da627b1a4c12aa
SHA512 fd7a92fb27afc7ebb1f44a49e41d52f09821d4d769cc63c682b2866951a3ac5babbf3d8f96f162544e9746bfd10d398a84cdec562460aba076c644cb243280ca
SSDEEP 24576:nC+TyQIu93VAumZr7jm5nNyBo4kx929bL3Hnx:n/TfIq+Y5IB+kn3Hnx
TLSH
T1A5558D1DA7E91DCAE276C675C8A34493EA33B872137186CF2044C07D499EEE9AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 bf2dd741307ec1af3659f27c136295228632eddbd9360029382945e7c09612c8
MD5 08d95d3656c4c2efef0291b6e08d1c0e
SHA1 f9bfc23e4e690a40b3f8729407d251e8a2648cb5
SHA512 fa921053d245da4956a41648c44d78b2c5cdae4e0ded15c23f083cc5edd7859d709097665026af8683bd5bae7c2a099207c3511a0089641e272f96a33cfa1445
SSDEEP 12288:McyrWOstaa3kcsC4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:pLQikZCnNyBo4kx929bL3Hnx
TLSH
T16B65F10FB36E10A5E1AB923C88854115FA737875071263DF46A0C77E4FAB5EA7D38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 7c1ba71d7669461e6322d13bef01aac9c296a8e30fa5a99f3b5a0d300451b59f
MD5 c7a35454e7d4852af3c8d233d33bdc44
SHA1 c4dca87d2947733012c067de56947c0073181d73
SHA512 657107495ada4ecc169ae0a4186d88c406302e42e80220dc22b1315b24f9547a15499e490b2f66cfaaf5c0255adbf6256c361320690c3dc307c8c84289522f2d
SSDEEP 49152:CpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPXIB+kn3Hnx:/pC7b4+80GTkL+k
TLSH
T1EBA57C3DE2B810ADD8AAC775C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2c6928c86cfa85ad714bd13ecd68f73401f81fc1a76d562ec88ef4bebd5add03
MD5 41cd83a8e404a3e60145d58f337e2422
SHA1 ec47b08486d03d4784c71f0ceacab6d2ac4a091c
SHA512 dbbd0fce031aac226a41cfb6137d63af2edce66ab4b1ce1bdabfb74a4216aa920e476da01ff9f431e256eccc548022b45692549e38693f30bd03fef4e3b14c11
SSDEEP 24576:NSAwJPE1IDAo+4Kt+l4413JUQvnNyBo4kx929bL3Hnx:NqPCIo4Kol4vQvIB+kn3Hnx
TLSH
T12E55BF2AA7F956F5E17ACBB4D663C501FB727822133163CF9290813E0E169E85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 30db4df82859155b0b561ef34f5c6188093f829c85a2019d81ff2240b39b936e
MD5 11130fc68adfeaef0092fdab15f45aee
SHA1 9f61c5192ebb013269f1022aa03144d2dbf8b80a
SHA512 0af916875df60701eb0ec875fc0b7c03f1352690f9738f2fb43a4bee646ac389f1aaf5136257ec6b687e6a52f1cfba4b0bbc87a2dc69d41f925c53a036fac15b
SSDEEP 12288:/SsyLCFBoPLCRyZ6NQ4t/4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVd:zyLXPLcK94t/nNyBo4kx929bL3Hnx
TLSH
T13D75E03ED66C04F5E57AC27CD6A38906F6723C9D033166CB19A0947A1F6BFE46939B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 cd7b9a34fcf369d327bc5cc5310c3fe25d09ef48553931661df4cae45ae10ec6
MD5 603356920c9dad391148f6d871ab661a
SHA1 97fd9e2ac63a3e929678f4256d12dd326d0dddd0
SHA512 c03c694ed3117d4651849a03eef1061a3c6e8829f8b6a333800c6b7660583f376a59a2e90f8eb27a2ea29a5113932aea3bcfa35c996fcfe1171f4bb799175621
SSDEEP 12288:f9lyvj3IkxjbBzy4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:fWv8qjpynNyBo4kx929bL3Hnx
TLSH
T15965220E579830A8F57D1770E5268124C431BC7A0B64AAFFB5D5D8BB4B39AD1C93AF02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/468-520-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/468-1-0x00000000007B0000-0x0000000000817000-memory.dmp

Download

memory/468-6-0x00000000007B0000-0x0000000000817000-memory.dmp

Download

memory/468-82-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/468-0-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/560-320-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/560-157-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/560-163-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/560-156-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/792-110-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/792-104-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/792-229-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/792-113-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/1136-452-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/1136-199-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1136-202-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/1136-193-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1316-470-0x00000000013F0000-0x000000000158A000-memory.dmp

Download

memory/1316-62-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1316-176-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1316-79-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1316-68-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1320-276-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1320-471-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1320-144-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1320-473-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1320-151-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1320-150-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1464-254-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1464-260-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1464-476-0x0000000140000000-0x0000000140160000-memory.dmp

Download

memory/1464-266-0x0000000140000000-0x0000000140160000-memory.dmp

Download

memory/1684-142-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/1684-265-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/1684-138-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1692-274-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1692-268-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1692-477-0x000000000B800000-0x000000000B99A000-memory.dmp

Download

memory/1692-282-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/1692-298-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/1692-478-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1692-314-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/1692-277-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1996-174-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/1996-177-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1996-363-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1996-168-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/2068-218-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2068-216-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2068-210-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2068-215-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2068-204-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2076-54-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/2076-167-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2076-48-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/2076-56-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2076-469-0x00000000007C0000-0x000000000095A000-memory.dmp

Download

memory/2236-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2236-122-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/2236-241-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2236-115-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/2244-60-0x00000000008E0000-0x0000000000A7A000-memory.dmp

Download

memory/2244-45-0x0000000000FB0000-0x0000000001010000-memory.dmp

Download

memory/2244-36-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2244-37-0x0000000000FB0000-0x0000000001010000-memory.dmp

Download

memory/2244-58-0x0000000000FB0000-0x0000000001010000-memory.dmp

Download

memory/2244-70-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2392-141-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/2436-238-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2436-468-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2436-232-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2436-242-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3100-130-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/3100-26-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3100-32-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3100-25-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/3172-182-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3172-188-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3172-191-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/3172-410-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/3284-481-0x000001FF48DA0000-0x000001FF48DB0000-memory.dmp

Download

memory/3284-488-0x000001FF48DA0000-0x000001FF48DB0000-memory.dmp

Download

memory/3284-489-0x000001FF48DA0000-0x000001FF48DB0000-memory.dmp

Download

memory/3284-487-0x000001FF48DA0000-0x000001FF48DB0000-memory.dmp

Download

memory/3284-486-0x000001FF48DA0000-0x000001FF48DB0000-memory.dmp

Download

memory/3284-485-0x000001FF48DA0000-0x000001FF48DB0000-memory.dmp

Download

memory/3284-482-0x000001FF48DA0000-0x000001FF48DB0000-memory.dmp

Download

memory/3284-483-0x000001FF48DA0000-0x000001FF48DB0000-memory.dmp

Download

memory/3284-484-0x000001FF48DA0000-0x000001FF48DB0000-memory.dmp

Download

memory/3284-479-0x000001FF48DA0000-0x000001FF48DB0000-memory.dmp

Download

memory/3284-480-0x000001FF48DA0000-0x000001FF48DB0000-memory.dmp

Download

memory/3396-99-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3396-95-0x0000000140000000-0x0000000140158000-memory.dmp

Download

memory/3396-214-0x0000000140000000-0x0000000140158000-memory.dmp

Download

memory/3452-474-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3452-475-0x0000000000690000-0x000000000082A000-memory.dmp

Download

memory/3452-244-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/3452-264-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3452-250-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/3596-80-0x00000000017E0000-0x0000000001840000-memory.dmp

Download

memory/3596-86-0x00000000017E0000-0x0000000001840000-memory.dmp

Download

memory/3596-89-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/3596-83-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/3596-73-0x00000000017E0000-0x0000000001840000-memory.dmp

Download

memory/3596-88-0x0000000000C20000-0x0000000000DBA000-memory.dmp

Download

memory/3784-226-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3784-230-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3784-467-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3784-220-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4216-91-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/4216-11-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4216-20-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4216-19-0x0000000140000000-0x0000000140148000-memory.dmp

Download