Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/05/2026, 15:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
30 signatures
150 seconds
General
- Target 2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe
- Size 4.4MB
- Sample260510-sn4p6aaz21
- SHA256 071467f0f4badfccc08420e9206f92c20b63cb9f0f9793483151d1f50dd63222
- MD5 5f80ad132c19ee4154124c329e5bc46c
- SHA1 83ae5d9934b512e681b95ae2e79c12d5c42c39e7
- SHA512 6847b928f8b06d2aaa13a07aa8e77802fae0736eb3feb4d0f70c5a96a1dc3d9421e68653cd0b4e5c46d3d33a103c4a1087b1db9aaf0fda2382b684a011202d8c
- SSDEEP 49152:bCwsbCANnKXferL7Vwe/Gg0P+Whn64qNpiHPkVOBTKbN/j2U4FH:+ws2ANnKXOaeOgmhnqNp3O0Vj2jF
- TLSH T18126384A6A564662C7886775CD6695B24B102F6B0BF6C0753E24BDCC7D3220EFD23A3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/4740-20-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/4740-23-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/4740-19-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/744-28-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/744-29-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2916-48-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/3900-51-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit behavioral1/memory/2916-61-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2916-68-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/3900-161-0x0000000000400000-0x00000000005D0000-memory.dmp purplefox_rootkit behavioral1/memory/2916-65-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2916-49-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/3900-46-0x0000000000400000-0x00000000005D0000-memory.dmp purplefox_rootkit behavioral1/memory/5376-454-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit behavioral1/memory/4560-453-0x0000000000400000-0x00000000005D0000-memory.dmp purplefox_rootkit behavioral1/memory/5376-450-0x0000000000400000-0x00000000005D0000-memory.dmp purplefox_rootkit behavioral1/memory/4560-403-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit behavioral1/memory/5376-613-0x0000000000400000-0x00000000005D0000-memory.dmp purplefox_rootkit - Gh0st RAT payload 19 IoCs
resource yara_rule behavioral1/files/0x0007000000024423-5.dat family_gh0strat behavioral1/memory/4740-20-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/4740-23-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/4740-19-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/744-28-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/744-29-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2916-48-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/3900-51-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat behavioral1/memory/2916-61-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2916-68-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/3900-161-0x0000000000400000-0x00000000005D0000-memory.dmp family_gh0strat behavioral1/memory/2916-65-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2916-49-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/3900-46-0x0000000000400000-0x00000000005D0000-memory.dmp family_gh0strat behavioral1/memory/5376-454-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat behavioral1/memory/4560-453-0x0000000000400000-0x00000000005D0000-memory.dmp family_gh0strat behavioral1/memory/5376-450-0x0000000000400000-0x00000000005D0000-memory.dmp family_gh0strat behavioral1/memory/4560-403-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat behavioral1/memory/5376-613-0x0000000000400000-0x00000000005D0000-memory.dmp family_gh0strat - Detects executables calling ClearMyTracksByProcess 8 IoCs
resource yara_rule behavioral1/memory/3900-51-0x0000000010000000-0x000000001019F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral1/memory/3900-161-0x0000000000400000-0x00000000005D0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral1/memory/3900-46-0x0000000000400000-0x00000000005D0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral1/memory/5376-454-0x0000000010000000-0x000000001019F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral1/memory/4560-453-0x0000000000400000-0x00000000005D0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral1/memory/5376-450-0x0000000000400000-0x00000000005D0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral1/memory/4560-403-0x0000000010000000-0x000000001019F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral1/memory/5376-613-0x0000000000400000-0x00000000005D0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess - UPX dump on OEP (original entry point) 13 IoCs
resource yara_rule behavioral1/memory/4740-20-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/4740-23-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/4740-19-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/4740-17-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/744-28-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/744-26-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/744-29-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/2916-37-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/2916-48-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/2916-61-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/2916-68-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/2916-65-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/2916-49-0x0000000010000000-0x00000000101B6000-memory.dmp UPX - Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys TXPlatfor.exe File opened for modification C:\Windows\system32\drivers\QAssist.sys Abcstdfvcfd - Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240650187.txt" R.exe - Sets service image path in registry 3 TTPs 2 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatfor.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" Abcstdfvcfd - Executes dropped EXE 30 IoCs
pid Process 1044 R.exe 4740 N.exe 744 TXPlatfor.exe 3900 HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe 2916 TXPlatfor.exe 5468 alg.exe 3616 DiagnosticsHub.StandardCollector.Service.exe 5044 fxssvc.exe 1648 elevation_service.exe 5572 elevation_service.exe 2412 maintenanceservice.exe 5432 msdtc.exe 1180 OSE.EXE 3752 PerceptionSimulationService.exe 3940 perfhost.exe 4924 locator.exe 6036 SensorDataService.exe 2884 snmptrap.exe 5996 spectrum.exe 2012 ssh-agent.exe 2180 TieringEngineService.exe 2252 AgentService.exe 2080 vds.exe 2624 vssvc.exe 204 wbengine.exe 5500 WmiApSrv.exe 4960 SearchIndexer.exe 4560 Abcstdfvcfd 4752 Remote Data.exe 5376 Abcstdfvcfd - Loads dropped DLL 3 IoCs
pid Process 1044 R.exe 4636 svchost.exe 4752 Remote Data.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: Abcstdfvcfd File opened (read-only) \??\Q: Abcstdfvcfd File opened (read-only) \??\W: Abcstdfvcfd File opened (read-only) \??\X: Abcstdfvcfd File opened (read-only) \??\E: Abcstdfvcfd File opened (read-only) \??\J: Abcstdfvcfd File opened (read-only) \??\K: Abcstdfvcfd File opened (read-only) \??\L: Abcstdfvcfd File opened (read-only) \??\P: Abcstdfvcfd File opened (read-only) \??\R: Abcstdfvcfd File opened (read-only) \??\V: Abcstdfvcfd File opened (read-only) \??\B: Abcstdfvcfd File opened (read-only) \??\U: Abcstdfvcfd File opened (read-only) \??\Y: Abcstdfvcfd File opened (read-only) \??\G: Abcstdfvcfd File opened (read-only) \??\I: Abcstdfvcfd File opened (read-only) \??\N: Abcstdfvcfd File opened (read-only) \??\S: Abcstdfvcfd File opened (read-only) \??\T: Abcstdfvcfd File opened (read-only) \??\Z: Abcstdfvcfd File opened (read-only) \??\H: Abcstdfvcfd File opened (read-only) \??\M: Abcstdfvcfd - Drops file in System32 directory 45 IoCs
description ioc Process File opened for modification C:\Windows\system32\locator.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File created C:\Windows\SysWOW64\Abcstdfvcfd HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\AppVClient.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Windows\SysWOW64\240650187.txt R.exe File opened for modification C:\Windows\system32\dllhost.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\fxssvc.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\msiexec.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\fxssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe elevation_service.exe File created C:\Windows\SysWOW64\TXPlatfor.exe N.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\SearchIndexer.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\SgrmBroker.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\System32\snmptrap.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\SysWOW64\Remote Data.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Abcstdfvcfd HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\spectrum.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\System32\vds.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\311304dc3bf04e52.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\vssvc.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\wbengine.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\SysWOW64\ini.ini R.exe File opened for modification C:\Windows\System32\alg.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\System32\msdtc.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\System32\SensorDataService.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\AgentService.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Windows\SysWOW64\Remote Data.exe svchost.exe File opened for modification C:\Windows\SysWOW64\TXPlatfor.exe N.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe -
resource yara_rule behavioral1/memory/4740-20-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/4740-23-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/4740-19-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/4740-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/744-28-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/744-26-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/744-29-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2916-37-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2916-48-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2916-61-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2916-68-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2916-65-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2916-49-0x0000000010000000-0x00000000101B6000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7z.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Abcstdfvcfd Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Abcstdfvcfd Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Remote Data.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language R.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TXPlatfor.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 5936 PING.EXE 5232 cmd.exe 1896 PING.EXE 2532 cmd.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Abcstdfvcfd Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Abcstdfvcfd - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Abcstdfvcfd Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f2c802090e0dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c0a4572090e0dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software Abcstdfvcfd Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0677b2090e0dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008610272190e0dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006659d02190e0dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie Abcstdfvcfd Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe - Runs ping.exe 1 TTPs 2 IoCs
pid Process 1896 PING.EXE 5936 PING.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4732 2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe 4732 2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd 5376 Abcstdfvcfd - Suspicious behavior: LoadsDriver 4 IoCs
pid Process 2916 TXPlatfor.exe 664 Process not Found 664 Process not Found 5376 Abcstdfvcfd - Suspicious use of AdjustPrivilegeToken 51 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4740 N.exe Token: SeTakeOwnershipPrivilege 3900 HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe Token: SeLoadDriverPrivilege 2916 TXPlatfor.exe Token: SeAuditPrivilege 5044 fxssvc.exe Token: SeRestorePrivilege 2180 TieringEngineService.exe Token: SeManageVolumePrivilege 2180 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 2252 AgentService.exe Token: SeBackupPrivilege 2624 vssvc.exe Token: SeRestorePrivilege 2624 vssvc.exe Token: SeAuditPrivilege 2624 vssvc.exe Token: SeBackupPrivilege 204 wbengine.exe Token: SeRestorePrivilege 204 wbengine.exe Token: SeSecurityPrivilege 204 wbengine.exe Token: 33 4960 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4960 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3900 HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe Token: SeTakeOwnershipPrivilege 4960 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4960 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4960 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4960 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4960 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4960 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4960 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4960 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4960 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4960 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4960 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4960 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4960 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4960 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4960 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4960 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4960 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4960 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4960 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4960 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4960 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4960 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4960 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4960 SearchIndexer.exe Token: SeLoadDriverPrivilege 5376 Abcstdfvcfd Token: SeDebugPrivilege 3616 DiagnosticsHub.StandardCollector.Service.exe Token: 33 2916 TXPlatfor.exe Token: SeIncBasePriorityPrivilege 2916 TXPlatfor.exe Token: 33 5376 Abcstdfvcfd Token: SeIncBasePriorityPrivilege 5376 Abcstdfvcfd Token: SeDebugPrivilege 1648 elevation_service.exe Token: 33 2916 TXPlatfor.exe Token: SeIncBasePriorityPrivilege 2916 TXPlatfor.exe Token: 33 5376 Abcstdfvcfd Token: SeIncBasePriorityPrivilege 5376 Abcstdfvcfd - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4732 2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe 4732 2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4732 wrote to memory of 1044 4732 2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe 85 PID 4732 wrote to memory of 4740 4732 2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe 88 PID 4740 wrote to memory of 2532 4740 N.exe 92 PID 4732 wrote to memory of 3900 4732 2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe 93 PID 744 wrote to memory of 2916 744 TXPlatfor.exe 94 PID 2532 wrote to memory of 5936 2532 cmd.exe 123 PID 4636 wrote to memory of 4752 4636 svchost.exe 124 PID 3900 wrote to memory of 5232 3900 HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe 127 PID 4560 wrote to memory of 5376 4560 Abcstdfvcfd 128 PID 4960 wrote to memory of 1168 4960 SearchIndexer.exe 130 PID 4960 wrote to memory of 4860 4960 SearchIndexer.exe 131 PID 5232 wrote to memory of 1896 5232 cmd.exe 132 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1044
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5936
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exeC:\Users\Admin\AppData\Local\Temp\HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\HD_202~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1896
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵PID:4580
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\Remote Data.exe"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240650187.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4752
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2916
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:5468
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k "Remote Data"1⤵PID:5728
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3616
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3672
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5044
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1648
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5572
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2412
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5432
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1180
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3752
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3940
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:4924
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:6036
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:2884
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5996
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2012
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:5872
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2180
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2252
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:2080
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:204
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:5500
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1168
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:4860
-
-
C:\Windows\SysWOW64\AbcstdfvcfdC:\Windows\SysWOW64\Abcstdfvcfd -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\AbcstdfvcfdC:\Windows\SysWOW64\Abcstdfvcfd -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:5376
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 6941bcd4e1a083fa45b18ff4364b282b4081a08a4c6de07448cb1c2db40581b1
- MD5 c8e208ebdeff2a1b042af66ce0f0e6b8
- SHA1 9ef34583c8e83f192f299564491ed00614853c0e
- SHA512 3da41ea41d4231baa9c31f6adbbbc37aa49b214d9c4844d441636e00b42b2987ba72574bcc4aca9ac1c09e72219a358d837bedd9508aebceaf75b9a09f090f33
- SSDEEP 49152:Tb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnZN/j2U4FH:x3q6HjBCj2jF
- TLSH T181D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 6c4664670f93bb55d89a987885e6020fc01e8d851f016a31f3aada1b6155f543
- MD5 e2ba3bacc4b38ada1ce661c968fac8a6
- SHA1 594161d6a6492ffb19dd9559219365821c369e19
- SHA512 c9e0132a46dbbdc14d1c4b7f156975f1adacff68a2b878157939dba302a560650b992ee1f9a1b11238c0949ff215e5aee7bf45c0890d8cf8d62c10ac64ca6578
- SSDEEP 12288:Q1XLsswWkxy2lRq2czA1JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:GXYfDtczARdCN/j2GLl3iFSE33b9
- TLSH T18305F128B7E409F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 a0cebc448a44c522d686c6bd9c2d752b8d8b13e9c670efec853c49b73325ca20
- MD5 b56c86266a2d77db9075aea8c664a79a
- SHA1 a440d68e38d68e4cb2182b255532f6c1a57a928e
- SHA512 b0d58adb9d22a3c1a4cb4fd78134e89ff8877e79f0bc829c36a2df8044d59f34638142878c0504343eb8e2a16801596dae851dfaa67e347bb985c68fd78360bd
- SSDEEP 24576:i0Le5ji0hmxirMOdCN/j2GLl3iFSE33b9:iPji0Ac4N/j2U4FH
- TLSH T1B235AE26F6748335D073C0B9C5D2A69AE97130855B308ACB4286D77C3F67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 50fe0555cf5934c4c167a2146cc0e8a876b0a561e8d67b5ded80e5aea5b5b106
- MD5 e12b667ecf38f6d65dbf9309204e6dfa
- SHA1 469725f65e9f3393b736d4e562a5465959b9b78d
- SHA512 b03ebea5d660e722dfcb208370dff326f2662f7a6067e2de85e0ef22a3333da13740d141477bf7390b53c86b9e56edd467bb765ead91dcef15152aee82881feb
- SSDEEP 24576:ca7/ezSC6vUyD/aqgrvWE6q8wyucdCN/j2GLl3iFSE33b9:7/ezSC6vUzPvxHjy8N/j2U4FH
- TLSH T13B755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 ae4d225b151f17ea4530253677693815536f0870e598fbf48b39303f7f8486bb
- MD5 cccde995c2bde08aed93bcca012e321e
- SHA1 178305810ea61585433934e9f5c05ec204ac74d6
- SHA512 d97c41df364c373fd86b03a0df6b324228b8a192ceb32bcf47e32405ebd913660063496fac009b117b46b4fc3cf296ed5c04ee2ee078a7c1cf9e183cf70c4d5a
- SSDEEP 24576:IVbqPb88hv/l+6tdCN/j2GLl3iFSE33b9:IVO88hXl+FN/j2U4FH
- TLSH T153559E65F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 005e3a13abbeb11c3e917d01e8e0cfe0ef2c49d9a03538fc3fcfc0e035d3966f
- MD5 eaa65c539eb40b4688b2517040e8de69
- SHA1 cce17fe549e678ec8c27a6998706a7114c91a4ae
- SHA512 7ca4b8aee5d4a59fc111fae13e0ca252c351e9fff7cd48a46c85cd316696412376cd61f900ec7c2a0d30b28c7a37e2e1fa359f70ef7dfa6abaa17020dffb3fd5
- SSDEEP 12288:xRmJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:xRKdCN/j2GLl3iFSE33b9
- TLSH T14CC42364DAA5B565F66F837903BDEE615200FEE8E525884782917BEB117CFE8C033063
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 750cf788a06bed3cecb89a2ba98c8e5071108aa14dc3187fe4b2e5be8f9332f4
- MD5 49480d293c474c79034bc42baf63e026
- SHA1 8d4d72743b93d142ac3aa0f20a9773921a592db1
- SHA512 3a13dc8d5cf5648ef6b7bc79f95a300b654131a372031d29c7f378d06701f4e024243a0b9c4c0b866a874ad8f20c6aa370952beefdb8f9a647579d69e58f44e6
- SSDEEP 12288:yeBNUbTVO86URJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:yJIUldCN/j2GLl3iFSE33b9
- TLSH T1DA05CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 7050e605819975eb06f4b4725788fd5932401bb95f357166a0cbbc59cba2dc6b
- MD5 4841f885f55dff66388c4fdf2081a599
- SHA1 8efb244e575a6fc6465c54e832ad0f1a9797114c
- SHA512 78fd326023790e146d97c4995c52c5f29e93557e7c62408afb610cdd088586b6651753a3ffd6c0a022faa4ccf2470b7b49c41e21a3b0dd25e298d2d09468f52f
- SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THb:ZQvGAdlCEL8c/yRNw5Cpj2jF
- TLSH T12C267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 c69fb9432a740a12583138987a24b1c15873d9da854e27ece20022c27cc28d53
- MD5 6e2ff455034741c8ef6dd33776aee72c
- SHA1 f9f78ed9c76d0d41c97dde6e6edafa73abdf7327
- SHA512 b821d63f71e2f61b5f35d64ee979e09b756e248185d3228c4f621946f49d09e020a0d60a8a2985e1069e513f2e7955580b986df7d160382ba258873347d81200
- SSDEEP 12288:dAwSfxL/2Dc34DLLmt0LDQewsAjTJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9c:OdewsAjrdCN/j2GLl3iFSE33b9
- TLSH T1C815E031FE74E436C2BF0DB61B35C716142CBA608B6119C3E3E84E9E59346D26376A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 607f976d83d3a89569113664046a44d8d007bf49d9b322061bedbe0b4689f115
- MD5 f004a46a6f51cd1db170362aee11b113
- SHA1 72547a6fdb84a2fd7d1e308cd525f07d2cc0ff88
- SHA512 61587962fd4a8c93e990defd8e943764b90f019beac3a8c9a858ad56cdbc1c1a2e348d16de44ba5781d8014e139b9cb4b85456b13e3a53e6fd66972e5bc49c66
- SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHM8F:qUEtQevvqc2W1cpV2EI32M
- TLSH T1AF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 adb8bc8e0f499d3910cfaf7c8818ce925d4736d15858e01f53e60ddade31bfff
- MD5 42d9bbe536710d79c0ac250869c35d45
- SHA1 6fa0b8088e742dfe66eed0db51879f8678a10882
- SHA512 384a39c819015d4e2c3ada547a41792747f739428b5bff4564501e353ed7bc28f60fa964347a1731f02e7a29a4c2fe1222e61b7d5318624e5f0156f537357049
- SSDEEP 49152:jCbRquA/m2yL5zQfFiV+XenmE3/zoN/j2U4FH:coqtVjnmVj2jF
- TLSH T1D6D58D0976B8C2E4D1F6C77886A2C647F37178158B3197EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 62a2f1e8559a4a7ec75a944defde48f8ea676a4974af8c30f1ef5ea032e1c96f
- MD5 e67857f92c07a3143c296b533df6ab5d
- SHA1 385d7bf54b52890095cee4d0e3e2e7d82e1c0d41
- SHA512 204b9ddfbe1c67d539563342398038933645abef25dd4747f1470fc567b1709eeb7fcbf1422a8e1429832c39f74ed4d149e6365cb94028a2c20b7308d6785e29
- SSDEEP 24576:HAhGLJIFoiwtA5l7S53wdCN/j2GLl3iFSE33b9:HAMyFoiq5rN/j2U4FH
- TLSH T15335AD80E7F955D4F5B3AAB899B69570EA72BCA95E31C20F1150D21F0E33E909D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 918ede8cea45a560e851fd8f9986dd93b5634da52ae65abf11fdff50c621da57
- MD5 f7645a1ceb382a9ae718f395bdc0b095
- SHA1 4f9687c442710d0a5d158e538a8b408f2330e229
- SHA512 585318bd3a6400bc87d89c5ea741c98ae8fa55c14d8fee0916e0de29dca29055705d174e3bc5171a8e35ed58cc7f6c54f01606adefaaf2f1b633045167b1fa02
- SSDEEP 12288:Fmw5HEjsChNVBFgl0WDm+C0JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:gwuoOWPdCN/j2GLl3iFSE33b9
- TLSH T1CB05F14576E41CF9E96782398697C536F7B2BC512A21CB0F03A0C79B5F37361AD2A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 2172f3b359415de6c4d1e82480d19c775c8cb4c85ede202d233b0f491db82151
- MD5 0d3efdadb8d5ecb8da7f3a1decae8ec7
- SHA1 e177b9ccba6aa6bae0966d7653d1f173df4ed0f1
- SHA512 6ccfb9f100cb74da882c79a2d1231504a75c91c255d4c44d26788bfcef6ab624fcda89e305d27f1886a42c46cab89e97755ebcfe68ace23971faa17e28278712
- SSDEEP 12288:MBZ1IyDJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:aZumdCN/j2GLl3iFSE33b9
- TLSH T171E4125973E471F9E1A7823C8AE59A05D321B8A5A73243CF025047EA2F36FD59D36332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 ec53dc19d924b82acc01d45fd287816a9a18443bed247c24b794e0a9221217af
- MD5 736aefe0544f73fc4f164ac079583b88
- SHA1 5d0e410c0ab8e90d9900dca1600e98831f65f951
- SHA512 aaed4cd917b3d415a64a4c6df860685968f0468dc2818d40bc8141d4d4422d10e5ca1b74d114db58e897fc06dfe0ebbd21ce00fcff72721f9aab993c3e82137f
- SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UP:JQRQyi36YOcPQLvw2gAf+PN3Gj2jF
- TLSH T107667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 9b9895a2180f01947926e3f9cbadba75831d9e2baa2a0437e355b8739af1710a
- MD5 0f6da0452bfc00754814d36a750911a9
- SHA1 e51b45078eb3de57e9434bd2dfc1482912cd452a
- SHA512 d1d73717cc7fc4bb42ed19d14eef19938d448fa58846b28797f92d7429b36c34dcc034b4ba0d98d35d635d884c0097b6507b761b56024050063e1d4d09263afb
- SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UP:mQRQyi36YOcPQLvw2gAf+PN3Gj2jF
- TLSH T1D7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 960e07a0b062f3c8807b1cd775fc43d7020b9363fd83958ce29e4f2855ef7187
- MD5 136004647db2aa8c3e5c7a17104d2952
- SHA1 b64431b1a1f23d541316491ba879b93bbe66d441
- SHA512 c02e08d510d82d78e21e2a54181c773e99456fdc5d69f8397c7a70289ae5ce0df57da9194d6d591f493c37df7fab530cd9b310a3c30ccef9f57f9ff0fce63500
- SSDEEP 24576:4wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0WdCN/j2GLl3iFS+:e68Qg55nhheWu7PNU3/4N/j2U4FH
- TLSH T171B54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 08405d4f965455e25f6e6541965cad583f083981c1f64e719b66721c1cd257f4
- MD5 37fc153cc88d81a0528587c2af0d2150
- SHA1 25101e5a62e74cf13c46e05ca151603bb7811900
- SHA512 a247f4e986222a437176206d4e4dc247087c6d6d9982709af42f275edfbaf733e7bfeeb04630c5388d0e7ea94a5c56b6971a3a1698ef9fc2f531a9ee8b4c781a
- SSDEEP 49152:D3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99p:Wy5112gYy5azzVvL69nLKnhZDj2jF
- TLSH T1B7168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 60b9168e5e7324885faab914aab139627f48e92b261c825798407fe2ffe878c3
- MD5 b7d06184c58b4138980d0406ba8c9cc8
- SHA1 d547cfe26d6fa5e48d8b6d09493e49ec4e8b3d4f
- SHA512 e0bebe3d611a4bab93a85a6e54916df4fb50aa2d8dbe29ec79f653212406691ce1b57fc70da9bdf870dfbbcdf97ed25b5aceb28ceba90aca6e31c78199e0506b
- SSDEEP 49152:eB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glWN/j2U4FH:Mu6JmVxd2dOj2jF
- TLSH T134D59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 72f4cff997dc7ff20064c55cd5759253e8431638a6563229670b75568ccc19ab
- MD5 02f736a413513a9a7b1ec3d69527aff8
- SHA1 fbbb37797f1e19300dc70e799c49f760e13f8bbb
- SHA512 189fce2e57f3b6511bf30a3d8c7ef04566221db5b4c3d11ac7558831661dab242394a254388de09ee569871a22f2ef4e81db82a6f53e2edf2a31f8c202b9f055
- SSDEEP 49152:n1hpsNoJpF1A6UU44CwH7R4x6N/j2U4FH:nmifPbRVj2jF
- TLSH T108B5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 4617959c50e1066bf116b43c0374c5cc8897c9f9f9569fac3a68ee5c2b948bea
- MD5 2a93228a2ec48fcc7b712fac8e61f7de
- SHA1 e1e0ebb2cbee05325a57f6ab1882d24e72d0cbc6
- SHA512 2edfe88a859dfdac711a6f34d8ca58d52f67a86069d6caec74c9999218d2c5576a2916826c9bf5658c761d0c83cd4b08706eeb2bcef9c13d91b1b019ef96e898
- SSDEEP 24576:qcP4mcvIjkGOxhKP2l71nNKbrh/8KB+dCN/j2GLl3iFSE33b9:1P4m4IpOO67W8KXN/j2U4FH
- TLSH T15E65BE2DABDC0096D0BB817886658A49FAB1742A1F3286CB1160937D3F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 ee85972c916dfcf2a359882337f24d4d93c54b81fd54491ba048456203fa71b7
- MD5 faca7687982a93d206669e2b80e9b836
- SHA1 249b5cb84187ebc9cbf3e39bbbec96cbc8683a23
- SHA512 bb786e603a5aa9812d809cbaa95335b4c98644475ac46012d78496d5b823abebeb8cc071b62e88a8b09de7a83b97c5a39e70953e51b3d9f50a1a39934f8162ec
- SSDEEP 12288:QNsfaJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:xmdCN/j2GLl3iFSE33b9
- TLSH T1B8E40119D2A412E8D06E9279C7558A41B3237CA493E1C3CB43C0F5BE1F7AAD49DFA613
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe
- Size 1.8MB
- SHA256 4cf29ad88816d6319ab9a5de7977be92dec6c67b8d0e90ac1f9c3640a959bdef
- MD5 e46faab43d33b772adfbd35b70c10dd1
- SHA1 0deb7068df6de9c445cffeaf00bf4e8ff5f14a3e
- SHA512 c529d36f250a43b542ed324c30ca74da08e020a7aa86eeb0f3de20d82088256e6defe80804e4fdbe7f5904803f495466e89866d5f4090407b28e42e1b5fa6756
- SSDEEP 24576:tOyHutimZ9VSly2hVvHW6qMnSbTBBhBMNNKdCN/j2GLl3iFSE33b9:gHPkVOBTKbN/j2U4FH
- TLSH T14895F1581BAB4256DB5877B9C8A6A69409090F436F18C0B15E311E1EBD2734FFC23EBD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
- Size 2.6MB
- SHA256 c3a1d1984134d505370b7fc5057583e56449fc884723b724b66b51ccdd22bdd2
- MD5 d4d65604699f7a790c53c3e98af80e94
- SHA1 bb9d2b632e2dba4f467b96615d3db1532a4a4ae8
- SHA512 156de593a1bdfe3d1fcffc5418ace36815b93bc241e5abb9ed58623ee2f80faf7f5ac9789be8c3fa2a6be192584bd493e4599353bf0dd9e0f0865eaf7c5d765f
- SSDEEP 49152:bCwsbCANnKXferL7Vwe/Gg0P+Whn64qNpk:+ws2ANnKXOaeOgmhnqNpk
- TLSH T13FC57C43B5964872C7C94571DE77DAB39B207EBE47F306367A48FEC87A342447A22224
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\N.exe
- Size 377KB
- SHA256 3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
- MD5 4a36a48e58829c22381572b2040b6fe0
- SHA1 f09d30e44ff7e3f20a5de307720f3ad148c6143b
- SHA512 5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0
- SSDEEP 6144:5UGp2l6zRmeVLNHfkQ2TAygOcqAJwQZgb4YtjH6/MuQafORzEOmFfMzi71o+YHL7:HclcceBKlKwAg0Mja/UafOVwbha
- TLSH T152841241FF520127C74AB0B5C9984E7F8E7A03888E650C3A7F795E4E1B603EE6923D59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\R.exe
- Size 941KB
- SHA256 bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
- MD5 8dc3adf1c490211971c1e2325f1424d2
- SHA1 4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
- SHA512 ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d
- SSDEEP 24576:N+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nH1PXw:cerL7Vw
- TLSH T105257D43E6765C93C3CC4836CC7AD27273217A5CB3F79636B180AAD7B6B52603D2065A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\240650187.txt
- Size 899KB
- SHA256 896424718c5519ea8bf81b550527145be2ea6b3c524883be2ec10d2348b48064
- MD5 fa679d94aad14cb62d421c6cd8ef26a8
- SHA1 3070949a43d8b7bc04135a2076ca5f300c170929
- SHA512 56ae9a0f43ea9b427d5619cd872ac38bc18df41d45334643b942ab568f078b461be9c00c8350a64b3acaccd9274290b43c3e848cb2e5b97c932e3b422bb917b4
- SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXV:7wqd87VV
- TLSH T1A9152983F6B68CA3C7C90435DC7AD2B67B24761CE3F786327280E9D7B5B6251781421A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Abcstdfvcfd
- Size 6.8MB
- SHA256 f7f8e74acddd178ae1c7b9f4318bf813729b69cd4711ab0bdb337e465436c6e8
- MD5 fcc95d29b92f10d4f5e1b9d7f6d8053e
- SHA1 1fed7188d180f719f729d9f95eb70e77a8b62fa2
- SHA512 c1f4b44f169a80ea50d7719c0eaa4366eebdd454e1ef525acb121e379a7d53fab9dd8210635f4756c719bc861799aea0c4922c948cb8b780b0f1b3035a67ffd3
- SSDEEP 24576:tOyHutimZ9VSly2hVvHW6qMnSbTBBhBMNNKdCN/j2GLl3iFSE33b9W:gHPkVOBTKbN/j2U4FHW
- TLSH T121767DA503277C01E30522B4D92404442171AED7BF6DCE346E7A598AFCBB29CDC7BA6D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Remote Data.exe
- Size 60KB
- SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
- MD5 889b99c52a60dd49227c5e485a016679
- SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
- SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
- SSDEEP 1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
- TLSH T127532AC2FA00C171D4A7563019778F1A5766AC13DB728ACB94B0B4A41EB3291AD3E5FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 78729b3e08996e5ad24979f82f4ad035b18c33d0e643636c36edd63769f2a7e3
- MD5 7cd309baa69af40004d791e5d0d0c1b1
- SHA1 bc0c60bf37cfb683f5193ee7746140c5ca39287a
- SHA512 81ef391b7f17dbbdf9552920bcf61a88025c2865356aec98492270007c5b7202956c3132296238dbecf790bb2a49788d97c77d5154830097c1160469ca1a2f65
- SSDEEP 12288:t6JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:tGdCN/j2GLl3iFSE33b9
- TLSH T1D1D42364D6E9B616F17F83780369DA356200FEF8EB258487C58157EB1278FE8D832523
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 ebc7ad420619559459f36a0d27d38199c8a95850f18c87bbd9550f542453360f
- MD5 aac22c54c510eb5e5949a0c4f8a11093
- SHA1 1a899963ed4ee99d8c3e6b301818d22872605502
- SHA512 8ebffcb7acd101e22f90e2f4339dd38836bf89d4c0d68e830effb61174ddd3298284b0b73aca4ddd774212e99b6b8887d0ec1a2aa8e108f6610597bb45440948
- SSDEEP 49152:ua0h2GEkuAe73q3pp46zwwQjN/j2U4FH:ua0hNYG4JwMj2jF
- TLSH T17285AF1D67EC82B5D0BAD278C9A6854BE6B2B4260B3156CF1150853D3F37EE84D3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 659KB
- SHA256 335c065ddfd12e1b35595fae1a577b7e0feb99f59adb399d8ba6224bb64d679f
- MD5 5dbdef640457ce89a454adea904378d2
- SHA1 0430b3b9924db10eefe8d935d79ba979532a1534
- SHA512 6b7cfee5904f4ece84482a1714b1348a577b418cf8b17948813923dfc366cf99c9238fbe456aafa05fea0afa6a2161343f90d485ab0ed112ceb6289bf3f883f2
- SSDEEP 12288:vhbHjfXnJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:vhbHjPndCN/j2GLl3iFSE33b9
- TLSH T110E4027D66AC2199F176D27D86958A06D330FCA4572183DF43C182BE1F3BEE84C35A52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 4111acce88e76692ac134ca4d223628c51c4214a20d6b49212fd621aaa09df56
- MD5 8ffd053d263b7022a43c892bc3e45282
- SHA1 059eaa3daf31b3d0f460fc3bfef466ae8441cb76
- SHA512 809eda719bfdf6c0c24cfa5cb915e20f41047c4dcabf2b1be3ac394b72842c3cdb3ef4c8273e145f77fa808acfd31e2d4187a43f130ae59c3db201ab28fe7216
- SSDEEP 24576:N3YgnJcRTk4yti+R5dBR/PdCN/j2GLl3iFSE33b9:NIgnaTk46pBR/cN/j2U4FH
- TLSH T18345B02DF3B910B9D8AAD236450147B5FB71782D1F209ACB0170C538AF1AEE85E35F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 578KB
- SHA256 d7979c5fa2a4e502982843de35cbe1aa412cf584578fc2ba0b596370d3022ba9
- MD5 cd6e6c2d6c37477991d0e84f51c4f954
- SHA1 6c1656ce9d7e19f848b4772be38ad676a0064074
- SHA512 f750b6d70dc1cd7f9db3fd4ad74efec0de10d7d8642c779e42bd432329e0fe8008008a75a74b014a2a1afe5a184136f560c4e9ab7c16b51243a0e2c2ac096fb7
- SSDEEP 12288:fGJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:fqdCN/j2GLl3iFSE33b9
- TLSH T176C42364E6A5B659E16BC37D03A9DF216200FFE8E73645C7858166EB137CFED8032062
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 940KB
- SHA256 939b8a846e037f3a8084fa2cba40d659d90d2ed949e2e26e0f6dbb227c6b91ac
- MD5 1be3d10f2312828be1ad2406c429b379
- SHA1 32c9e778c184aacd429082f9ad94d59169541b7f
- SHA512 809b5dc867dc0b47b417e36da0c8fd69b91a86768e4ea16797cc1443ec4b329d8e1860150061623ee0ee2878aa0e7718307ccd017563b3f7632c641b3d6f0a71
- SSDEEP 12288:AOb9A4LWOsvAYFT1JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:9pL3UTRdCN/j2GLl3iFSE33b9
- TLSH T11025F154F7A410F9E96BC23CC5A68A16E271B89C1724D7CF03A84BA61F237E54E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 671KB
- SHA256 e648263a138f7ca32c2c8a49047b933c54f5ae0fb8d0d6819129e2317b30b4d3
- MD5 82090c1671aacc9e8c940593de337295
- SHA1 fe2b0cb93ec474218721c541b84452c16ad83979
- SHA512 dabd6e4f2d9bdf6ce4e92c030b28aaa952ce3724eded1ab1ab2c6d524fcb8b0e9bdc82d27e37e94e4ef215adc30d4c60fec7d38da80b77d389e56b7ab95921bf
- SSDEEP 12288:ApFtpOxJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:COFdCN/j2GLl3iFSE33b9
- TLSH T1C1E4022936ED20E5E17A923C86968709D331B8A5572247CF42D081FE1F77FF89C36A61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 b49fdbbbc08a1e899ad435d2c283b43c62bd2ea8da928480804c34c2b48b9327
- MD5 9bc74dbf3541734172f1d74ab678109d
- SHA1 687592716e476beefc0bfae4751cba432f26451b
- SHA512 91b4b769ea4f90c3ce09f643ffd718f16762d53bdc3c9a25f1aacd8f029c56e89e704e400610d9e4108a9ae7420464d0cae0e7ba9aa311608d0684fee15598ac
- SSDEEP 24576:n7NM9YqZqmWMUkPjZM48Mv6bEhs2dCN/j2GLl3iFSE33b9:n7cBWMpPjN8DbEh0N/j2U4FH
- TLSH T13465AE2E6BEC81E5D477D13DC9E28605F2B1B4611B318ACB5162833E6F37AE44E36721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 260292a5f6491b193193c2752379cd5b47a22a8e9f84f2cc86f55c06f19f4b16
- MD5 596b00e103aaff71f5c86ead6cf73a63
- SHA1 b831d83e42b08ae83dd462b48e01e83f106f10ec
- SHA512 896f0a1438cca86cc5d6d6bd5b9076a54a00473678e4075e2c54b296130c83377638b7b4b5bfc541b0fee7fb70c636d574adae2e8e0dac86e06e5c9734a3f1e5
- SSDEEP 24576:fW6BApg2YuyuNDYTabvcdvNYf8km1EdCN/j2GLl3iFSE33b9:fF2YuHNETovAvNYf8kmZN/j2U4FH
- TLSH T19A858E2967ED80A4E0BBD27D45B6D246FAB2B8511B3056CF0255862E1F33AF44D3DB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 0fa7aded368132771d5c8ef01f1d20dfde62b66f1d2faf5593f99fe188f3edae
- MD5 8b62bb29aafbc60900a051b31893ef7d
- SHA1 9674b1c67b3de0b260addca8be517abe3a6e83ca
- SHA512 bd7359d5603edb3592f107d39f6696631d1944dbddb71a8568da7a85c639b9341fd2b6c3bfcf3b350b5c35b53a503bf92861ce702718b7edde7b335a66f94d98
- SSDEEP 24576:PAFs06+Omlf3NXEbTopdCN/j2GLl3iFSE33b9:YFs060lVXuDN/j2U4FH
- TLSH T15D65AF2F62EC00D5D07ED17D8A97C91AF2B1746307255ACB0260867E7F6BEE85E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 885KB
- SHA256 ba48c40afb9b45e835be97244c529292548ceca099428a01e3e822d2b360522f
- MD5 ec8e8258f0648c462f520dd96fb2fc09
- SHA1 0f1291155e9552ee6515c39c0d92676d207593cc
- SHA512 6ca98e1a289032eb68c961417f6e8e53ae556ae50d549ee7dd3e27ef2e638847aa43bc2e7e0a21bcee33dd94666f210d57dd08172ac7a547c4c091e40de55a10
- SSDEEP 12288:3CJnJ5D3VkrDzxqJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:SJnJ5D3WXYdCN/j2GLl3iFSE33b9
- TLSH T16815D02CD2A810E8E4B7C2B4829A5B56FE71387D2F2269C718B4D5353F12FE09979F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 e924b91872b5b6ac3dcc6752187770a55f9d8e09919b98bccfdf743123ab0d77
- MD5 f48b0ce3f4e2a67a8d78a86aed2706a1
- SHA1 064fad4d84fbbba209c427f71cb85b06967e2d48
- SHA512 6b7ba96b4ec562a3dfd980591e873411cd2dbdf8b0bcdeda79366a994252d010af5d39fab3ca97a6f06609a66704493e1653501529e0707fa5c5581d6008f9b4
- SSDEEP 24576:hEPghm6/7IIXdwcXrif7qQncjlP65i3VuPdCN/j2GLl3iFSE33b9:Gg06DIKdwc+eQnSt65aVFN/j2U4FH
- TLSH T19B956C15B7EA5294E8B3CAB1CA6295169B327C509B34F7DF0AC0C92E1E33BD1D934B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 661KB
- SHA256 cdd99f6774ded77c562c5771ef502a82f2aa410789a53f6b02149cb981d00c73
- MD5 b6116fa1a41e029420b92d0de037ef71
- SHA1 4d957835ec62373f095e77c1ba88a2da0d689295
- SHA512 8bff78c3c319435f1a263ea92efad5de2a94a24882299c20a9e4d0f125199b32a066abfed951a66315a4d7d64c39f80620963e413d490d26731b35443b409c69
- SSDEEP 12288:JEP3Rn0JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:an8dCN/j2GLl3iFSE33b9
- TLSH T130E4126D67AC70E9E12AC13D82A18605D331F4B4AB2217DF42D1C2BE4F77EE85D39A11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 712KB
- SHA256 f5196fd149e0cbcc63229f6a46fdb2a45885fbf2a7c518198c8ba655847dca06
- MD5 05b6c897926f2181d951297c0a4398b8
- SHA1 14076f0dcd24c8d171ceac873e64ba6b9d52f0b1
- SHA512 710c561f693e188c2f9a17099e6b32e555ac5f2b19972e7bb4016afc78ad19c790a4006cba0f925f3fc4ee67ae408daf45f247ab3d22e06329ac84842a3d53db
- SSDEEP 12288:EjkyXJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:EIy3dCN/j2GLl3iFSE33b9
- TLSH T12BF41214A3E4A595E5BA437C86B686509A30FC70EF2146CF41C0E77F6F7ABE49831B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 584KB
- SHA256 62239dcce9a0c1bf0f293bfec2cb9c0ae6fab89005efcf828a8346513e864c35
- MD5 4c63bf2cd473dfc1da87bcbccbdb0287
- SHA1 0597413f426a61a2273f659c79acf26bc426f3b3
- SHA512 bf223052e103de24c930240e17a5b454b414a4b2cfdcf45c66f05ceef2ccc76ec59886e8d7d4d1b8118907e461155f791e51e59a687f7a6e0d9b8e63f3927746
- SSDEEP 12288:4yhJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:1VdCN/j2GLl3iFSE33b9
- TLSH T1E2D42368A6B5B669F52BC37C03699F515210FAF8F72144CB41C0A6FB537DFE89032852
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 25d5f9d78dc94106a1ed0aed3de006bfa74234794d1c1cfdb3b7330f652b829b
- MD5 6a63ef2af582530ca6be0a7c5e7510ed
- SHA1 e272b60002591961045bd8dcd33ff6f78a1c4595
- SHA512 50a60b5f7e5fa1983c074ac9c899a7eb0877055d492d31ebdada570af766e1f47138210609886d030757aeaf51c3e124ac6862c6ef419c80beb7fbae73e9e3b8
- SSDEEP 24576:uQ9MxZKdcz9dw3udCN/j2GLl3iFSE33b9:uVKZxN/j2U4FH
- TLSH T1DE558C2DABE9159AE177D27995A250C3A633B4301B31C6CF2448D03D4D7BEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 772KB
- SHA256 a94c89e516c43fd6906f2cba03f4160c18917d6eb35635fb384b234909f817cf
- MD5 8a88aaeb05ede9d70be3eb09b820263a
- SHA1 ba11782ef660415cc1636faef192056c57417371
- SHA512 b044fa0aff5db9b23ef3f7af815703a4869ff52191a17b26a48802f7eab05132194e8af2ba0f84b42c21ef3b3e04a6c787ebd5498171096a72608b156924e391
- SSDEEP 12288:CyoKo2JRple9pTJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:CyocDAprdCN/j2GLl3iFSE33b9
- TLSH T189F4E01FBBA940A2E076823C89858745E773B0705B2253CB5691C37E4F27AECBD35B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 0f5570d8d21b2c92a4f5ada1b4da30f43fbb5a0fd1e58c5268bf2f226e86c655
- MD5 c872fd26855f269063fca5ffda671d71
- SHA1 bb2fbeeee1b730f62d77b40bb1eb98a0a83eeb96
- SHA512 b725f30279f3b14b514bdea49c7f011146cc24a6047fd66be93ee2c50295dff4f342d659a2e24d21eb2c4584ec2265c3b4d035fb8d2d760c9b8a09460e813f22
- SSDEEP 49152:eWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKIN/j2U4FH:40zuNIej2jF
- TLSH T17BA57B3DA2F800A8D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A39F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 69bdef33666043dad4747fe8d3298b8abf9ca446d8a401cefc1f6ba1f2905887
- MD5 3a7f06b3da3b2d8711fd45d038b2242e
- SHA1 e4254270c67c8c0b8d14dd821844c91f2dd308c8
- SHA512 97210cc892f78968de39262a80c605da3fe18fb95d0f202830c00ef7d2f98c8a42e4bdbf21db9320633fb3694d582ba5e5a4ab3f1db72116c8ab83b9c580d446
- SSDEEP 24576:t1QT7EcpfxR+N5AWAz3ooiYtjMqb8dCN/j2GLl3iFSE33b9:YTDxR+N5YzTfjMaN/j2U4FH
- TLSH T12255B02EA7F815E9D17EC5798B23C512FA727861033193CB42A0C17E1E6B9D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 877KB
- SHA256 f32aa019a1150f392e6be00fd20d66be7c854cebbd7070ff2cd9fb1c46e4333b
- MD5 bf84ecdab59cf98f00cfda347ccc8e2e
- SHA1 6f8f5f249f06e610bf1c4d13e7547295a09c69b1
- SHA512 d944d303338cd86def6870b2643b4f28170b51b93a3f3213d7072a43961cdf237bfda21276bfdabfddf05123c215bd47eb6b13f3e9038aaa91a82fe0f33a8c98
- SSDEEP 24576:uTMdOz0FFS+imSLQdCN/j2GLl3iFSE33b9:a0K+imSLbN/j2U4FH
- TLSH T1E915F13EA3AD14E5E47BC27C9653C906E6727465032266CB06D0C1BA3F5BFE4793AB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 635KB
- SHA256 3718f62838e04b0a49724d766be162b74f663645ea1912b24ab492ff89df232c
- MD5 24803d0e996bf33652c2cb51de806de2
- SHA1 4efecde8105b9eeba2ec077a93c10fc098d10618
- SHA512 bd2ac87dcbceef3a34b7ff937ddc1c942ac5d864a8b499aea2b95822fb44c2b944839ec7841b496fc9ad37b148e8f32fa1bf17b7e5670fbd89a14cee518240a2
- SSDEEP 12288:04K1JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:SRdCN/j2GLl3iFSE33b9
- TLSH T10DD4121CA3E830D4F4768279877A86159230FCB4A72546EF15D0CAFF5B3ABE89435B12
- MD5 SHA1 SHA512 SSDEEP TLSH