Analysis
- max time kernel
150s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
10/05/2026, 15:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
30 signatures
150 seconds
General
- Target 2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe
- Size 4.4MB
- Sample260510-sn4p6aaz21
- SHA256 071467f0f4badfccc08420e9206f92c20b63cb9f0f9793483151d1f50dd63222
- MD5 5f80ad132c19ee4154124c329e5bc46c
- SHA1 83ae5d9934b512e681b95ae2e79c12d5c42c39e7
- SHA512 6847b928f8b06d2aaa13a07aa8e77802fae0736eb3feb4d0f70c5a96a1dc3d9421e68653cd0b4e5c46d3d33a103c4a1087b1db9aaf0fda2382b684a011202d8c
- SSDEEP 49152:bCwsbCANnKXferL7Vwe/Gg0P+Whn64qNpiHPkVOBTKbN/j2U4FH:+ws2ANnKXOaeOgmhnqNp3O0Vj2jF
- TLSH T18126384A6A564662C7886775CD6695B24B102F6B0BF6C0753E24BDCC7D3220EFD23A3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4104-19-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4104-18-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4584-27-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4896-79-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit behavioral2/memory/4928-78-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4928-112-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4896-138-0x0000000000400000-0x00000000005D0000-memory.dmp purplefox_rootkit behavioral2/memory/4124-172-0x0000000000400000-0x00000000005D0000-memory.dmp purplefox_rootkit behavioral2/files/0x001c00000002b3f0-316.dat purplefox_rootkit behavioral2/memory/4124-143-0x0000000000400000-0x00000000005D0000-memory.dmp purplefox_rootkit behavioral2/memory/4124-130-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit behavioral2/memory/4584-28-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4616-358-0x0000000000400000-0x00000000005D0000-memory.dmp purplefox_rootkit - Gh0st RAT payload 13 IoCs
resource yara_rule behavioral2/files/0x001a00000002b3e0-5.dat family_gh0strat behavioral2/memory/4104-19-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4104-18-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4584-27-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4896-79-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat behavioral2/memory/4928-78-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4928-112-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4896-138-0x0000000000400000-0x00000000005D0000-memory.dmp family_gh0strat behavioral2/memory/4124-172-0x0000000000400000-0x00000000005D0000-memory.dmp family_gh0strat behavioral2/memory/4124-143-0x0000000000400000-0x00000000005D0000-memory.dmp family_gh0strat behavioral2/memory/4124-130-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat behavioral2/memory/4584-28-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4616-358-0x0000000000400000-0x00000000005D0000-memory.dmp family_gh0strat - Detects executables calling ClearMyTracksByProcess 6 IoCs
resource yara_rule behavioral2/memory/4896-79-0x0000000010000000-0x000000001019F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral2/memory/4896-138-0x0000000000400000-0x00000000005D0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral2/memory/4124-172-0x0000000000400000-0x00000000005D0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral2/memory/4124-143-0x0000000000400000-0x00000000005D0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral2/memory/4124-130-0x0000000010000000-0x000000001019F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral2/memory/4616-358-0x0000000000400000-0x00000000005D0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess - UPX dump on OEP (original entry point) 8 IoCs
resource yara_rule behavioral2/memory/4104-16-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral2/memory/4104-19-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral2/memory/4104-18-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral2/memory/4584-26-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral2/memory/4584-27-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral2/memory/4928-78-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral2/memory/4928-112-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral2/memory/4584-28-0x0000000010000000-0x00000000101B6000-memory.dmp UPX - Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys TXPlatfor.exe File opened for modification C:\Windows\system32\drivers\QAssist.sys Abcstdfvcfd - Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240649218.txt" R.exe - Sets service image path in registry 3 TTPs 2 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatfor.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" Abcstdfvcfd - Executes dropped EXE 30 IoCs
pid Process 2968 R.exe 4104 N.exe 4584 TXPlatfor.exe 4896 HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe 4928 TXPlatfor.exe 4820 alg.exe 3140 DiagnosticsHub.StandardCollector.Service.exe 1908 fxssvc.exe 3404 elevation_service.exe 5724 elevation_service.exe 4560 maintenanceservice.exe 4124 Abcstdfvcfd 2384 msdtc.exe 4616 Abcstdfvcfd 2028 OSE.EXE 5152 Remote Data.exe 4456 PerceptionSimulationService.exe 1852 perfhost.exe 4836 locator.exe 4964 SensorDataService.exe 5400 snmptrap.exe 3884 spectrum.exe 5228 ssh-agent.exe 824 TieringEngineService.exe 2572 AgentService.exe 3564 vds.exe 1260 vssvc.exe 2248 wbengine.exe 4284 WmiApSrv.exe 568 SearchIndexer.exe - Loads dropped DLL 3 IoCs
pid Process 2968 R.exe 6124 svchost.exe 5152 Remote Data.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: Abcstdfvcfd File opened (read-only) \??\Z: Abcstdfvcfd File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\I: Abcstdfvcfd File opened (read-only) \??\Q: Abcstdfvcfd File opened (read-only) \??\R: Abcstdfvcfd File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\E: Abcstdfvcfd File opened (read-only) \??\G: Abcstdfvcfd File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\H: Abcstdfvcfd File opened (read-only) \??\T: Abcstdfvcfd File opened (read-only) \??\X: Abcstdfvcfd File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\V: Abcstdfvcfd File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\P: Abcstdfvcfd File opened (read-only) \??\S: Abcstdfvcfd File opened (read-only) \??\W: Abcstdfvcfd File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\K: Abcstdfvcfd File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\Y: Abcstdfvcfd File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\U: Abcstdfvcfd File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\B: Abcstdfvcfd File opened (read-only) \??\M: Abcstdfvcfd File opened (read-only) \??\L: Abcstdfvcfd File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\J: Abcstdfvcfd File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe - Drops file in System32 directory 41 IoCs
description ioc Process File opened for modification C:\Windows\system32\fxssvc.exe elevation_service.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db spectrum.exe File opened for modification C:\Windows\SysWOW64\TXPlatfor.exe N.exe File opened for modification C:\Windows\system32\AppVClient.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe elevation_service.exe File opened for modification C:\Windows\system32\spectrum.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Windows\SysWOW64\Abcstdfvcfd HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File created C:\Windows\SysWOW64\240649218.txt R.exe File opened for modification C:\Windows\SysWOW64\ini.ini R.exe File opened for modification C:\Windows\System32\alg.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\dllhost.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db spectrum.exe File opened for modification C:\Windows\SysWOW64\Remote Data.exe svchost.exe File opened for modification C:\Windows\system32\fxssvc.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\SysWOW64\Abcstdfvcfd HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File created C:\Windows\SysWOW64\TXPlatfor.exe N.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\9c8f80e1c682cdf5.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\msdtc.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File created C:\Windows\SysWOW64\Remote Data.exe svchost.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe -
resource yara_rule behavioral2/memory/4104-16-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4104-19-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4104-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4584-26-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4584-27-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4928-78-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4928-112-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4584-28-0x0000000010000000-0x00000000101B6000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_166656\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe elevation_service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe elevation_service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\CheckpointRepair.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe elevation_service.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language R.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TXPlatfor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Remote Data.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Abcstdfvcfd Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Abcstdfvcfd Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1812 cmd.exe 4504 cmd.exe 112 PING.EXE 240 PING.EXE - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Abcstdfvcfd Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Abcstdfvcfd Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Abcstdfvcfd Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058dce05290e0dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c6bac5990e0dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bbf9a15290e0dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a507125390e0dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d292d5a90e0dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008348915290e0dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" Abcstdfvcfd Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Abcstdfvcfd Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe - Runs ping.exe 1 TTPs 2 IoCs
pid Process 112 PING.EXE 240 PING.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6136 2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe 6136 2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd 4616 Abcstdfvcfd - Suspicious behavior: LoadsDriver 4 IoCs
pid Process 688 Process not Found 688 Process not Found 4928 TXPlatfor.exe 4616 Abcstdfvcfd - Suspicious use of AdjustPrivilegeToken 29 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4104 N.exe Token: SeTakeOwnershipPrivilege 4896 HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe Token: SeAuditPrivilege 1908 fxssvc.exe Token: SeLoadDriverPrivilege 4928 TXPlatfor.exe Token: SeIncBasePriorityPrivilege 4896 HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe Token: SeLoadDriverPrivilege 4616 Abcstdfvcfd Token: SeDebugPrivilege 3140 DiagnosticsHub.StandardCollector.Service.exe Token: 33 4928 TXPlatfor.exe Token: SeIncBasePriorityPrivilege 4928 TXPlatfor.exe Token: 33 4616 Abcstdfvcfd Token: SeIncBasePriorityPrivilege 4616 Abcstdfvcfd Token: SeTakeOwnershipPrivilege 3404 elevation_service.exe Token: SeRestorePrivilege 824 TieringEngineService.exe Token: SeManageVolumePrivilege 824 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 2572 AgentService.exe Token: SeBackupPrivilege 1260 vssvc.exe Token: SeRestorePrivilege 1260 vssvc.exe Token: SeAuditPrivilege 1260 vssvc.exe Token: SeBackupPrivilege 2248 wbengine.exe Token: SeRestorePrivilege 2248 wbengine.exe Token: SeSecurityPrivilege 2248 wbengine.exe Token: 33 568 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 568 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 568 SearchIndexer.exe Token: SeDebugPrivilege 3404 elevation_service.exe Token: 33 4928 TXPlatfor.exe Token: SeIncBasePriorityPrivilege 4928 TXPlatfor.exe Token: 33 4616 Abcstdfvcfd Token: SeIncBasePriorityPrivilege 4616 Abcstdfvcfd - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 6136 2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe 6136 2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 6136 wrote to memory of 2968 6136 2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe 79 PID 6136 wrote to memory of 4104 6136 2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe 82 PID 4104 wrote to memory of 4504 4104 N.exe 84 PID 6136 wrote to memory of 4896 6136 2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe 85 PID 4584 wrote to memory of 4928 4584 TXPlatfor.exe 86 PID 4896 wrote to memory of 1812 4896 HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe 99 PID 4124 wrote to memory of 4616 4124 Abcstdfvcfd 100 PID 1812 wrote to memory of 240 1812 cmd.exe 105 PID 4504 wrote to memory of 112 4504 cmd.exe 106 PID 6124 wrote to memory of 5152 6124 svchost.exe 107 PID 568 wrote to memory of 2368 568 SearchIndexer.exe 124 PID 568 wrote to memory of 2892 568 SearchIndexer.exe 125 PID 568 wrote to memory of 4912 568 SearchIndexer.exe 126 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2968
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:112
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exeC:\Users\Admin\AppData\Local\Temp\HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\HD_202~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:240
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵PID:5084
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Windows\SysWOW64\Remote Data.exe"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240649218.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5152
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4928
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:4820
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3140
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4464
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1908
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3404
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5724
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4560
-
C:\Windows\SysWOW64\AbcstdfvcfdC:\Windows\SysWOW64\Abcstdfvcfd -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\AbcstdfvcfdC:\Windows\SysWOW64\Abcstdfvcfd -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4616
-
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2384
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2028
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k "Remote Data"1⤵PID:1792
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4456
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1852
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:4836
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4964
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:5400
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3884
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:5228
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:824
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:1980
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2572
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:3564
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1260
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2248
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:4284
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2368
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 940 2976 2972 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}2⤵
- Modifies data under HKEY_USERS
PID:2892
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 940 3012 3008 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}2⤵
- Modifies data under HKEY_USERS
PID:4912
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 876e615e709e3cee5ca250bef64f5cbcc026aad8e89cf51ae0da8f49b4dd1a4c
- MD5 ffd7f1b4168f8ced13ea0151371d5b3d
- SHA1 53d653ac0cb562342b33d86dc4a03d1b2dcc0e01
- SHA512 b05cfbd52022fea41e1c6ce7f07803e91ede039d0d2239bfcd4a08068483d716a5deafb67dcf51ec8548078a500a461c5ee2c6d2181b489643e135ac07bdd07a
- SSDEEP 49152:ob+632BuPkFKRrdE6ohmstBhuXjfS4LWxndN/j2U4FH:C3q6HjBij2jF
- TLSH T174D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 795ee6ea40547bd08ec2433ba7455e07c6a071eab5b4df4ee9fbab9655f07849
- MD5 a76eda6cea414e05532dc9b8f3f4138c
- SHA1 a2228070ee1d80342487b647872433725b2bf706
- SHA512 74fd4250b3fe6942c99caa44b0ab1cd534a58beb2810e3e33a11cfcc6523e546fd1480e6376fa063dcf65e99449b85603feef5ff4a0841abd7f93649858627fb
- SSDEEP 12288:Z1XLsswWkxy2lRq2czAVJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:3XYfDtczAxdCN/j2GLl3iFSE33b9
- TLSH T1B605F128B7E409F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 c9ef2dc0513be4afdbefaf128371bcba44465d85c9dfbbd89eef50a64c0c7c59
- MD5 2b31bbdbaf5daa63785829350664f42a
- SHA1 1a53a2d0f8d35e4b27aa9e808539ea06dfce3369
- SHA512 2a4fc05a90eeb9db89b6783121fd26c8995b935d93fe3fe5f1d3891916f0e53e7e36fbf9a97d091c0e4fcfe97b8bf9eee30187f4dc517c065cb49e3195aeaeee
- SSDEEP 24576:P0Le5ji0hmxirMOdCN/j2GLl3iFSE33b9:PPji0AcMN/j2U4FH
- TLSH T16135AE26F6748335D073C0B9C5D2A69AE97130855B308ACB4286D77C3F67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 b928d509737c98cb9102efaed20250a32c0a65cdb57e42bbe90133044eb2b2b6
- MD5 eca334f66ddf17b9f8b24b534bc4a295
- SHA1 ae5f3a014c9ef4a1ae1c354f51382df0d3c80eb0
- SHA512 6196263c341037fe926ddf593dafc63e605922c97a8a2fd308bd97c09b8a03d4f96e55d6137d7eb2dcd5054a88c6597dd33532c779199a671e472cd1b364504e
- SSDEEP 24576:Ea7/ezSC6vUyD/aqgrvWE6q8wyuodCN/j2GLl3iFSE33b9:z/ezSC6vUzPvxHjyAN/j2U4FH
- TLSH T128755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 d2fc9f33dcc84061ea4949a424c99d1ea182a692f37df29bf696ced810a65d6b
- MD5 e7d8f9b052b54326248d905a6cb1dbfe
- SHA1 61394885d45322931cee054e3f315ca4e4b8ddcd
- SHA512 afa24be1c5cdacd4752550b1fa4d418e9a812eaaff642d4d2d8d6279ff122047764e6f89dd7cbafc246455cdb505107b49800674218f7965e2ba6c803d271848
- SSDEEP 24576:RVbqPb88hv/l+6NdCN/j2GLl3iFSE33b9:RVO88hXl+1N/j2U4FH
- TLSH T101559E65F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 7cd9dac287486860fbf4f490086507d4d587bf7d5913ee143d1f72795da22015
- MD5 620f043df44b0cf46bfbc00b0b502471
- SHA1 40268c57397e240e397378aed06a433b926e17b1
- SHA512 a80448c9a5eb9a4f99ea32a637c861c82a6990b7c0dfbc9704a50d950371bfe4f1e8be8ff45993249a8f37bf0a004b2f94068d1833f5da812095e5b7dfad98f9
- SSDEEP 12288:IR2JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:IR6dCN/j2GLl3iFSE33b9
- TLSH T1A1C42364DAA5B565F66F837903BDDE615200FEE8E525884386917BEB127CBE8C033063
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 bbd6abe56ec568d7149ab1f11aa3dddf8bae73540f506ef95849027bd65a5529
- MD5 6d2b5a5b050465a7d1882a16ac2731cc
- SHA1 037ab18a287a14a3f1ec2d1b89143071a5c5856b
- SHA512 f5a07f8a2fc3aa1afb5528aea420b462370a876c25b2b6f1a26df6725d67b818e8c9a5e76f4406b181e30e602d5f76c00cba5a12b1cf697c2c48be04fd742ece
- SSDEEP 12288:deBNUbTVO86UxJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:dJIUFdCN/j2GLl3iFSE33b9
- TLSH T1AF05CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 e118aef61c9acb2066f3303d3c01281f629b6a4eb1a5e8e88a3b4909232d0499
- MD5 f6a2ef28f429acb9ca3af8ed1eaa479c
- SHA1 f49e3290f4a2c51fc9574649d3e0cec5444ae982
- SHA512 3a4b5863e652942258b52330dd0395b5b26448055adf3cd38fd3a42afdedec959538ce9bc6f3191d1ef8e935ad5fa5c75da2e3b230bf1aa42603a540f9d18004
- SSDEEP 49152:aQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH7:aQvGAdlCEL8c/yRNw5Ctj2jF
- TLSH T104267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 3547d358b950f6a1e29f5a33996d05bab1899c85a8662f9aaa7e8d60a709b00d
- MD5 209e4be3633316b8647b1a8f44c4ddb0
- SHA1 16b6650e021f75d6329c758f3b26ea7b3698ddc2
- SHA512 6f519d2a356a61d5ca5d246e5f50b97019fe1b3b9b8acf32dbc4f006cb5844a75ce562f13c2ef683f02875a18a62aff2eede4a0a3cb53a963706f08f7231f818
- SSDEEP 12288:9AwSfxL/2Dc34DLLmt0LDQewsAjfJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9c:udewsAjPdCN/j2GLl3iFSE33b9
- TLSH T14415E031FE74E436C2BF0DB61B36C716142CBA608B6119C3E3E84E9E59346D26376A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 c0ac90120e2e25fb4b6ff1ad53efd55495d29297965082be4df48595d475c2ae
- MD5 96011ea7c6d19b9d7710e48ae0c6697f
- SHA1 231d4bce920a71a77576e8219f10f0dfc5ac87c3
- SHA512 47726209603c4ce6f15613bb458db624bd1d89f836e950bed268752e0b381d33c4a79cf4a1e7285ec9c75111bd76ea301a27bc2b6cc736336d9d58de114ac4dd
- SSDEEP 196608:fUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHI8F:fUEtQevvqc2W1cpV2EI32I
- TLSH T117474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 f2ea1ce69e5c53e68e3d73c2bb7695e507210471545c138d2408a7043cd0f415
- MD5 755bfeae7408184f02b0b9056bd922e4
- SHA1 e908e13f57b924ecf58012c0bc62f3f6e792ff75
- SHA512 2eac4ecc103b4a43f7f5ed94a350084d2ac2b0e4a45ca4e508211f1c06e0ab9546cfb063859a707448e80e9e884288424fb1d0e23ecbf8058eb7ad2ca899bd11
- SSDEEP 49152:3CbRquA/m2yL5zQfFiV+XenmE3/z8N/j2U4FH:goqtVjnmZj2jF
- TLSH T13CD58D0976B8C2E4D1F6C77886A2C647F37178158B3197EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 907522d77de8782ef1866d8f669a7751abd1b6cb7ad6ea80781e851a4e148f17
- MD5 b57c761cabc89afed7cd154bef45c7b7
- SHA1 d77a942bc8dca0e5d0d8efbe5852377ff53edec9
- SHA512 2e9dfe2a406d18a50c0e9cd55100435eb3605e9929b8fc222cc4055e77b22d46e86bddd5b31aa19dfc5fdf205dcc4e95652a960785044cc7db5ced2238a819ed
- SSDEEP 24576:3AhGLJIFoiwtA5l7S538dCN/j2GLl3iFSE33b9:3AMyFoiq5XN/j2U4FH
- TLSH T1FB359D80E7F955D4F5B3AAB899B68571EA72BCA95E31C20F1150D21F0E33E909D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 51972c8d6bbd4ef2b5086000e870017a5e6ec89a72eafa50850a7aee1a080de6
- MD5 de01d113c09af184cdd15cbbd6f87d4b
- SHA1 66ff403142d1dea94a6fbf7b54d78eb8ef1f016b
- SHA512 d16d6eb358fbafbfd8d7255a016944156e1f74ddf2aba02975726ab577cc4c293afb1b27339f818849150b54a2362db571228fd4ba8ed72ae63a87bceb41ccd3
- SSDEEP 12288:mmw5HEjsChNVBFgl0WDm+CoJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:/wuoOWjdCN/j2GLl3iFSE33b9
- TLSH T16805F14576E41CF9E96782398697C536F7B2BC512A21CB0F03A0C79B5F37361AD2A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 00aea46a1323f303d5ae20d1faa0e3e9226b96fa0e2e218bff4adcd49f93e600
- MD5 2c0fef2c54174eae6eab9957bf1c24d0
- SHA1 36c3950d9b3192df58b9b1793ce7e7be99117daf
- SHA512 eeb6e04ec824fbd5b918f804643aa68b950e7f6054b575dd41c4dfabfdb1fec636ffb3093714c74483300c609d61f8a6ff56e5ff7ffcd8b48101e2e5dfd5b8b3
- SSDEEP 12288:rBZ1IyPJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:FZuGdCN/j2GLl3iFSE33b9
- TLSH T1C1E4125973E471F9E1A7823C8AE59A05D321B8A5A73243CF026047EA1F36FD59D36332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 60985a50f0b977a489b75e4ea72c26d950561340fb0e3bdf0b5336d7fb79aeac
- MD5 655ce17267f879d3348e346d68fab743
- SHA1 7254dccd4c57ddfa12b7c0674c422a5b0632278b
- SHA512 0ba6908a4228f2379d614644757881df32550b6ddd94da40caf14a1c0446aedead26d82332a18ddb1aa5316db41f8d95a8cb4d38f2edc09c6468e3b6f09d7191
- SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U/:cQRQyi36YOcPQLvw2gAf+PN3Wj2jF
- TLSH T1DF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 35530fdc7e1b64ffbd3e69b2944bad874d0f2d5ff2157f16dce932d178fab20e
- MD5 4f50be49158778c0215b0b020a7f1342
- SHA1 b2610df3ad31c42f7a8b8801db475c712f05cd3c
- SHA512 e1d24ec0231a5597f269f6afdf69c975aab25576150c6c3a2e0d2509a913430d2afd2171a6b341555c96223817fc2e6fa6748d699c79ed1ef6cf7e02f9a85827
- SSDEEP 49152:kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U/:7QRQyi36YOcPQLvw2gAf+PN3Wj2jF
- TLSH T189667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 0d39f2a77163749ed60472522dbe4b76749d8266715df4a6674e994dc2c76588
- MD5 49db302b3c3b9251a504b3ce85f43b70
- SHA1 d859e16fd6f3f43573cadd7fb85331728b316901
- SHA512 e8f67e821ccb0a51494cec55b278c22cb84377b340f5bfabe2f9c274d630c39a27e7f2ec44bf6d2a595b1cef9f5534dcb5ffae9803cc46ebb4959c04e065fa10
- SSDEEP 24576:JwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL02dCN/j2GLl3iFS+:V68Qg55nhheWu7PNU3/MN/j2U4FH
- TLSH T149B54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 9c44c56906965639694e03ab9b27f95eb2214a554498adb7922f7ef9ff1a6008
- MD5 beadd2e9d4c75f878f2f9c7c8e23e51c
- SHA1 651ac9bc8db60a3073d825fa8374793524ab904f
- SHA512 71f3acd813d45df1da53fd2c8c9c6340f8a78018dbca5cf98977488283b55f8528d018f61079716fbfa4c8263dc0a77dde67cfc65202a7d4fd86557d69511d37
- SSDEEP 49152:z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99t:my5112gYy5azzVvL69nLKnhZzj2jF
- TLSH T142168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 2aa5fdc92fdd1be0fce90a17e1f612dcc0199d3f378f3d36cef6a3918c860316
- MD5 bd9809198496d94c9dcdcda838e31de4
- SHA1 e640cfd27f3ec7c61a3bccd3c0e5bc7abce2dc64
- SHA512 bbf151964086454299936f78ff3ed836b5be7eb6a90519161b461deee74a98242d49994b2a32ec65468410298a950a94ba07171d952c51c50e14f63ac788a8d2
- SSDEEP 49152:AB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl2N/j2U4FH:au6JmVxd2duj2jF
- TLSH T1E3D59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 1516ad7b736b56ca666a3199be2e10312ae09f7a86c77284f7c24ca47f79100e
- MD5 bcfd1159880923ce5e599e0257426aa5
- SHA1 ddef78fda8841f4fa55d3ba90d7235e941b418e2
- SHA512 871a66373f94e8daeb5f1f80a4369806378f39901fc1d3e09a1b83e80164a1c0c6046fae11457d3ecbfda5a9ac452900c4674ecdd63f89bc241d34d7cdfb53f1
- SSDEEP 49152:A1hpsNoJpF1A6UU44CwH7R4xaN/j2U4FH:AmifPbRZj2jF
- TLSH T179B5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 94193d89866e42a852ac797e0966900f23554fec4667b519f0fa5e523fda9823
- MD5 f27b9906b2b7c69d55ae13fb2bef227d
- SHA1 2221392557bb8ce621351f46fb4742eec2d869bb
- SHA512 92afc35c70942af32cc6e9c3b5f5e89e287e1ca2297440668e6203ac987a3f6ec71514fbbb91e331ebc9d26e9cb9b50b16293741f0bb055b6e2b7153d613fec3
- SSDEEP 49152:mSuZQIY0Be2KRRVtOnks6NMHqJN/j2U4FH:o5dKTi61Hj2jF
- TLSH T15EC5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 bbeda51d89837f31b4e0015ea8a4675c20398e1de58c62aedc505d03838903ec
- MD5 520ffd138981a711cb0e121a6c196766
- SHA1 b454780bf2c8dd5f40222f8bc14b06daf6d9e376
- SHA512 161a8b0e1b3b8c442a843c632216d270e207a6c340b91590dea1320bdbb930b1a412f55e3e191d05c3eb66c6e11a53e8ee899c9af06e54b0ef29925f1caf0a59
- SSDEEP 49152:XhtSn8EApI0figngiDn0AP5w2N/j2U4FH:GX2iyphlj2jF
- TLSH T18E95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 2fa8093606129335ec78943a233d09e157879ad980d39e148af9fbe843f77359
- MD5 d5a26fa2a9cc1b71fcdea70c52d9ec6e
- SHA1 3e9c4aaa31bbb03b8200f49ed851e4d8caef5abb
- SHA512 c0e6a688b49137c36a224c37881bdde409e40731397dad14691bfdc001a48f0112b37851e0d58f7b6193925bb09dfc05bdb160bbefed8bcb93acb4e314f85678
- SSDEEP 12288:KNsf6JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:DGdCN/j2GLl3iFSE33b9
- TLSH T1D9E40119D2A412E8D06E9279C7558A41B3237CA493E1C3CB43C0F5BE1F7AAD49DFA613
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\HD_2026-05-10_5f80ad132c19ee4154124c329e5bc46c_elex_emotet_remcos_wannacry.exe
- Size 1.8MB
- SHA256 4cf29ad88816d6319ab9a5de7977be92dec6c67b8d0e90ac1f9c3640a959bdef
- MD5 e46faab43d33b772adfbd35b70c10dd1
- SHA1 0deb7068df6de9c445cffeaf00bf4e8ff5f14a3e
- SHA512 c529d36f250a43b542ed324c30ca74da08e020a7aa86eeb0f3de20d82088256e6defe80804e4fdbe7f5904803f495466e89866d5f4090407b28e42e1b5fa6756
- SSDEEP 24576:tOyHutimZ9VSly2hVvHW6qMnSbTBBhBMNNKdCN/j2GLl3iFSE33b9:gHPkVOBTKbN/j2U4FH
- TLSH T14895F1581BAB4256DB5877B9C8A6A69409090F436F18C0B15E311E1EBD2734FFC23EBD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
- Size 2.6MB
- SHA256 c3a1d1984134d505370b7fc5057583e56449fc884723b724b66b51ccdd22bdd2
- MD5 d4d65604699f7a790c53c3e98af80e94
- SHA1 bb9d2b632e2dba4f467b96615d3db1532a4a4ae8
- SHA512 156de593a1bdfe3d1fcffc5418ace36815b93bc241e5abb9ed58623ee2f80faf7f5ac9789be8c3fa2a6be192584bd493e4599353bf0dd9e0f0865eaf7c5d765f
- SSDEEP 49152:bCwsbCANnKXferL7Vwe/Gg0P+Whn64qNpk:+ws2ANnKXOaeOgmhnqNpk
- TLSH T13FC57C43B5964872C7C94571DE77DAB39B207EBE47F306367A48FEC87A342447A22224
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\N.exe
- Size 377KB
- SHA256 3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
- MD5 4a36a48e58829c22381572b2040b6fe0
- SHA1 f09d30e44ff7e3f20a5de307720f3ad148c6143b
- SHA512 5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0
- SSDEEP 6144:5UGp2l6zRmeVLNHfkQ2TAygOcqAJwQZgb4YtjH6/MuQafORzEOmFfMzi71o+YHL7:HclcceBKlKwAg0Mja/UafOVwbha
- TLSH T152841241FF520127C74AB0B5C9984E7F8E7A03888E650C3A7F795E4E1B603EE6923D59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\R.exe
- Size 941KB
- SHA256 bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
- MD5 8dc3adf1c490211971c1e2325f1424d2
- SHA1 4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
- SHA512 ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d
- SSDEEP 24576:N+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nH1PXw:cerL7Vw
- TLSH T105257D43E6765C93C3CC4836CC7AD27273217A5CB3F79636B180AAD7B6B52603D2065A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\240649218.txt
- Size 899KB
- SHA256 896424718c5519ea8bf81b550527145be2ea6b3c524883be2ec10d2348b48064
- MD5 fa679d94aad14cb62d421c6cd8ef26a8
- SHA1 3070949a43d8b7bc04135a2076ca5f300c170929
- SHA512 56ae9a0f43ea9b427d5619cd872ac38bc18df41d45334643b942ab568f078b461be9c00c8350a64b3acaccd9274290b43c3e848cb2e5b97c932e3b422bb917b4
- SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXV:7wqd87VV
- TLSH T1A9152983F6B68CA3C7C90435DC7AD2B67B24761CE3F786327280E9D7B5B6251781421A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Abcstdfvcfd
- Size 6.8MB
- SHA256 f7f8e74acddd178ae1c7b9f4318bf813729b69cd4711ab0bdb337e465436c6e8
- MD5 fcc95d29b92f10d4f5e1b9d7f6d8053e
- SHA1 1fed7188d180f719f729d9f95eb70e77a8b62fa2
- SHA512 c1f4b44f169a80ea50d7719c0eaa4366eebdd454e1ef525acb121e379a7d53fab9dd8210635f4756c719bc861799aea0c4922c948cb8b780b0f1b3035a67ffd3
- SSDEEP 24576:tOyHutimZ9VSly2hVvHW6qMnSbTBBhBMNNKdCN/j2GLl3iFSE33b9W:gHPkVOBTKbN/j2U4FHW
- TLSH T121767DA503277C01E30522B4D92404442171AED7BF6DCE346E7A598AFCBB29CDC7BA6D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Remote Data.exe
- Size 40KB
- SHA256 8dcaeeebef9b9f3d41d295db145ffb3850f309d089c08125c7fa7034db5fd80e
- MD5 22bb5bd901d8b25ac5b41edbb7d5053e
- SHA1 8a935dd8d7e104fc553ff7e8b54a404f7b079334
- SHA512 cc3fb68fd6791a08e4a7d1a8db8d07cfcc8c9b9dceec10b53f0cb7ee86473303a19be4f23e379f84c59e02d0568e7c066e21cd1300f6032dac4ba52f609f62e7
- SSDEEP 768:C67uhQpPPp0nnqFk509FRdVcQX6N58hJYim1jLP3RRe:C67uhQpXp0nnqa5093jKNAmB3RR
- TLSH T10C134C02BE88C071DDA114B41A5DB337939DED604B1586D3593887EBAA2D3E39E343DE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 d42558920bec14622cd1d36f05ee503d1bf3df3eec5a88a57a844a3422b7606d
- MD5 90350027575c220708c073c4e51e79e0
- SHA1 30f66794fa3b256c1b391aee6db890a36d548362
- SHA512 e3acf8d7db6bf7c1e8f5dcd0e5ac6a190b89b17e2514d76628e12b5064761780c7970de0db13e73867f3cd8e8d73b425d49053fce23136b47bc7454acc9c4bd7
- SSDEEP 12288:O/JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:OvdCN/j2GLl3iFSE33b9
- TLSH T1EBD42364D6A9BA55F17F837802ADDA316204FEF8EB2184C7C54117EB6278FE8D832453
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 a203a2c5917cca1f614a9d7b2c828ee55d66b129acccb44df5087c2d4d15bff5
- MD5 e02d58a7b7aab6ea3b1b8529d12fd1e5
- SHA1 023bb6652c5fb87e663cbea9a1d88577bfbe0d41
- SHA512 02dd50569edd59d33ad3d049ecae3880f830798ec1ed28545b61b3f780e8ae29941f04452f8eeffca53ec10a3dada161ec901d51d1b755eb36ecccf5bd2fc0e6
- SSDEEP 24576:V8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCddCN/j2GLl3iFSE33b9:KRZwQCyiHiQEaaPnMjN/j2U4FH
- TLSH T1C985BF1E62DC46A5E0BAD278CDA74407E6B27816573197CF0290C27D1F27EF49E3AB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 676KB
- SHA256 78d0d779e4884fe65d2973cee05d0c2b662e911688a8f1c5a5af68f71f919cfe
- MD5 a739dd5f0cbfabdab1aa48e71ae7b0fd
- SHA1 fd7c0053f35d4a9714c8aa65e73a391d840586a3
- SHA512 c76ed361df9270d606924878d3c4e6f1d2136253c864ab1b08bc93d8a57dd68a618d10fd2508ee86cfb9082eb48155eca4ec0c0130415cdd45e89abd191c1043
- SSDEEP 12288:BbxA1U7KpJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:BbxA1UGtdCN/j2GLl3iFSE33b9
- TLSH T186E4022D66EC24E5F176D23D86D58605D331BC69A72187CF41C182BE0F3AFE89C36A52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 0e5fded1b07a80023a3be3c210e52ceb0f8c0b8602f4d55891c56eb3f93a7f54
- MD5 dcb92a131594d0a651b7c2cef97199e2
- SHA1 8ca9f17b74bf7afc2078232972cd4c723779deb3
- SHA512 65d82cfb166ab80f4421b2909486a052ee8628383c6f66fef07c6e42afda62d5524a0bfae671fb91eeaedb08374cb0e764d2651596bab3a55b9f09670a07fd8e
- SSDEEP 24576:qjsmP0yHaqrVqHra44KDzMsrn4dCN/j2GLl3iFSE33b9:qjRP0yHfVqzlAsrnjN/j2U4FH
- TLSH T15045AF2EF2B910F9D4AAC136454507B5FB71B82D1F209AC70170C635AF0AEE89E35F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 596KB
- SHA256 a9a5614fa8b3f9bd786d96f7150f772b54293660b31c10172a041a0ae47a1148
- MD5 242401168c11d23dd5c20d9401cfa83d
- SHA1 07ba9f6806e07843531182ccd508614600ccfc18
- SHA512 fab340fb027ae98c6573bf70817ddc7567a7a3c18d26697ca2bc80b95f8f8d34f5aa7a9998ba47ba98d34dbb51698a84d39928bdb2e8ee93b97bd0f0eeee2d8c
- SSDEEP 12288:MxJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:MFdCN/j2GLl3iFSE33b9
- TLSH T1DCD42364E6E5B659F16BC37D03A9DF216200FEE8E72645C7858166EB137CFED8032062
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 940KB
- SHA256 45b2d325653e37e8577a372568e068ec6edc50a41117369df5a317438b82239f
- MD5 0e97eefea0744ec44a6de106e991fb1b
- SHA1 81134170027765418262b9c48a3bd0a7ae4ea1ce
- SHA512 e5b7c364d266211728f25345ab3e588ade17f6319af773acc75f9e5e7bb0138bf75091a6159883880cc846024cc61f6d43094bac33c25bfd3f61364fe563b0f9
- SSDEEP 12288:0Ob9A4LWO+vAYFT7JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ZpLBUTjdCN/j2GLl3iFSE33b9
- TLSH T19025F154F7A410F9E96BC23CC5A68A16E271B89C0724D7DF03A84BA61F237E54E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 800KB
- SHA256 10a8317bb5c5739710d9505eb43cdc0112207ce9196c3d88430fd3aed04e6eba
- MD5 ed08410ce0e2a5a49b0062bcf7381e85
- SHA1 aa0990870cf16d7339dc748551daf40ce14dd801
- SHA512 13fccdd7a5df857216ec4274d8962e1505bc1bc5fd95d8d0373deab41aaaa11d094ca34f0095e3b4c1d4e8689c258c4cea97bde955aecd3d20376b83ea72e3c5
- SSDEEP 12288:670VmvIYNvUyBpUJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:LrYNHudCN/j2GLl3iFSE33b9
- TLSH T13205F22E92AD1DE4E57B917D8AC28605F23278A5571192CF05F083BE1F17EE8BC3A741
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 fd292f9c84401583b32884ed0a885e9e75c1e80f10169e1b48e7aafd40c3ffe3
- MD5 8d5828d2f913a0b2d80f83975f8a940c
- SHA1 d8f3c6b9a37b757840bc97d96065311e91e0168e
- SHA512 afacc3059074f15781bf9560b902b68223b526d790b30c33e8cef4c12287d7de5e9604a42a5efc961fb607bda738d0278f49402f3f53b828014d4a87d50d033b
- SSDEEP 24576:jnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKn:jnXoJJYH84VVS6AmEcJas+cHBjSSKHP3
- TLSH T1C365BFADA2BC04E8D5BBC17DC5C24506F5B178615331CACF026182BA7F27AF59E39B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 26ba5e6cc40ec44244714c71d2f7824f7e429fd47985e1073455bc8f176c14e3
- MD5 b91ee286eb84ac5e35688d78bff5613a
- SHA1 bf813cb89883a9e1ff1c5b76d7f705a4e5d85e59
- SHA512 2f3ad99738547e2f87123e3f96013708765765b49734c65f36ca778602c89d36d32d9f2a7ee9d1495add5c8742f7543a82b3e1dd8cb030661d391e90a545619d
- SSDEEP 24576:rv7Xbxd9Tuycf8M/TYlSuxwr2PCEdCN/j2GLl3iFSE33b9:rDLL9TuJ0M/TYW2PaN/j2U4FH
- TLSH T112858D5EA3EC42D8E07BD6BD85B79146FAB2B855173081CF0291856E1F23BF0593DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.3MB
- SHA256 0eb70366fc4ff5def3f50fea67f5c34864572470df2e7d675aa2af7e2e88ebe5
- MD5 9cc22e0ecd0755fc7dc2786a2051ba38
- SHA1 3778396e1849ee7433748b3a3394982ce237ceaf
- SHA512 618a5b4c3a1ca414707fe48e71a9e216de90e39bee480faf32c35aee2483481077d906d8fc7e4b98e16c789bb0882f7d144d758db5ae7bcd8974bb6aecfcc9fc
- SSDEEP 24576:2egJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wjdCN/j2GLl3iFSE33b9:2ngOJOmPOHhgN/j2U4FH
- TLSH T1C555CF3FB7BC15D5E03EC17D8A968916F670782603255ACF016082BE5F1BEE46E3AB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 904KB
- SHA256 4dcb314cde09cf2f9d569a824679b2c924f1a94a8a905944f68f452c99d8c3e2
- MD5 8e05824e528406a20551622b5914f512
- SHA1 94916da25c3ee05472d6980bd291316b7096e42f
- SHA512 0fa334fbb8d86403389f88bffbb53a706cb041af8356d5ec0694a5f2b9197862528c6f16ffe208898af475d1ab2ab42f49959b981062d2b4a722a69f657708e4
- SSDEEP 24576:aLJnJiTk3R3waE4JrOldCN/j2GLl3iFSE33b9:aLJnJK8R304lNN/j2U4FH
- TLSH T17515D03CD2A810E8E4B7C2B4825A5B56FF31347C2B2169CB59B4D5353B12FE0AA39F15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 809f51cde7865a6517af0c7d51fb67bda279550c9b8e5432bb3a7d03f8ced132
- MD5 fe534dca6eccea8d297197d431f1ac5a
- SHA1 3e814d93d0f3cbdd4cf205e72a4983bd35685b9b
- SHA512 e3eab55db25c11d61006dae28b9d35ad07e4b25788f5c81a3c5eba4ea44e9aeb894069f65b9efe42156d3eb8b9fa45988320582db0c967f0520b53c416adefdc
- SSDEEP 24576:mA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6prdCN/j2GLl3iFSE33b9:B9GqCzDScAZmlvTcFg8Ph6WN/j2U4FH
- TLSH T12C955C05F7EB5298E8B3CAF1C96694169B327C409B34F7DF0A80CA6A1E32BD1D535B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 676KB
- SHA256 5d0c97cf5ac4d886ef289b89f50f8ace78227ec426279c0bb474ead0c2ca3948
- MD5 0133a34b70ff6010196356dbd33b23af
- SHA1 9853e8cfa134c25495d07cd58e9648ae10e015f5
- SHA512 d91811504527bc6e6d5cb1d06cc661c3ae854669ba05688ef58d6deb6b6ebb9e82ea87c3ff4799293ee70b7b11348662ee33f7575d757ef806a7639519fc8925
- SSDEEP 12288:jlYJeXm5nkEUuEFJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:jlYJeXm5jUuEBdCN/j2GLl3iFSE33b9
- TLSH T139E4126C76AC70E5E12FC17D86A58A14E330F4B4A31247DF41E0C2BE4F6AEE95D39A41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 732KB
- SHA256 8a582d7d73e7b06e4ca3a979f827cece69578614689f675335a130adcf9513b8
- MD5 40f077baf73b7ab2df66dd2fab3fd241
- SHA1 7f682b723b5f12c84da5a47025db943cb296d19f
- SHA512 df5226765bb4c808229f2576473c06dfc57840fc710b7bdbf20b5057dad5cd1a364df229d1f6874d250ae724ace3c445450fc69165171f4c3f82ad931b2370dd
- SSDEEP 12288:mwu6kyYJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:mVtyYdCN/j2GLl3iFSE33b9
- TLSH T1FBF41214A3E465A8F5BA477887A686609B30FC74DB2146CF41D0E77F2B39BD4A831B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 604KB
- SHA256 ef809988f75afa77ec4119f93fd268deed6c34f6357716a30457760b6b467a5f
- MD5 40ae96a9a3638ea9ce7c561d59d5ed76
- SHA1 d00e9023d49a95a9363f1c4bbf8129407992d406
- SHA512 d7d5a31ed9be1e7f8cad33b8bff620e755b99a3cc35ca1be197e0d82e0e2413dd0c991c3c3a1586d7723354a5414c509104d890e7a1c17d3dd57e6b3f65f5982
- SSDEEP 12288:3P7JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:fjdCN/j2GLl3iFSE33b9
- TLSH T13CD42368A6F5B669E42BC37C43799F116210FEF8E72144CB41D0A6FB577DBE88032852
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 fa9908b87e06eb8e6b9033d243f45a8a7aa27d06da0393ab3df5bb3af86c03ae
- MD5 570806d2016946f8bdb58776b670674a
- SHA1 b168089c4e5a5905733b0ea228a79e5b5b9605ac
- SHA512 1488f13744992ab9d3a9f32ee73b020dda5b68d2b57a21ce5c03896ab6be9de4552776e20562c450623c1685fb3bfff1848f736a6769d26484d280b3ba099662
- SSDEEP 24576:MC+TyQIu93VAumZr7jmAdCN/j2GLl3iFSE33b9:M/TfIq+YLN/j2U4FH
- TLSH T1BA558C1DA7E91DCAE276C675C9A34493E633B871137186CF2044C07D4A9EEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 768KB
- SHA256 42056f5ddca586499453c2bf28649a59ab72503016e9b8f404c0160849f09ebd
- MD5 c571c122a5ca4932c761d526e751fe36
- SHA1 e62dffa6d611a0534acefb9092a112fb39027ce3
- SHA512 760b5c9fb966472cfdfaff4ed72e33f06de7e0b46101a0d9092b7a6a7de43660af1a221a740b66884e6db1d43128602f949800c17953250adb655480e9a748f5
- SSDEEP 12288:zcyrWOstaa3kcs3JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:yLQikZXdCN/j2GLl3iFSE33b9
- TLSH T1ECF4F10EB3BA10A5E0ABC23C89954611F673B474971257CF42D0C7BE0BAB6E9BD34B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 22db33eb588cc9e3dfba2331cccf711a893fb25f1c7d6ba7db4ceedf19911379
- MD5 62c2477148ef62f248b035f7f5174c1e
- SHA1 924a7c51a895459aba4f06a93f2d7a77faaf99cc
- SHA512 bc7f986757e4b6650d98dd648f5d80dc7f4976a93c13c7330f352b6b42963c9ac4a7ff5c9345d7bfa75fa9234ff42e38950e54191ea2cc377bf91783154584ff
- SSDEEP 49152:8pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPdN/j2U4FH:9pC7b4+80GTk2j2jF
- TLSH T1E0A57C3DE2F810ADD8AAC37585461665EE71382E3F2015DB01B0C578BF1AEF19A39F19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 10ef67c3c42237a2343a342396745305954a33922b30984eb469e54bec269c77
- MD5 ab3e2c0573870091ae24094530279a4c
- SHA1 12dedf4b7727a1670a134c4f1cd1b1ef2917c89e
- SHA512 781c12aa47ec4c34d01a698d79d1d7c3402da01bd2f70be8e2dc52491ec1c5bbbcef52d27860616bc9e546c7d96de4aeaeace8f7c7655bc4c8be3c848c993053
- SSDEEP 24576:SSAwJPE1IDAo+4Kt+l44135UQgdCN/j2GLl3iFSE33b9:SqPCIo4Kol4/QrN/j2U4FH
- TLSH T13E55B029A7F956E4E17AC7B4C663C611FB727822533163CF4290817E0F16AE89E39F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\QAssist.sys
- Size 76KB
- SHA256 6cce28b275d5ec20992bb13790976caf434ab46ddbfd5cfd431d33424943122b
- MD5 4e34c068e764ad0ff0cb58bc4f143197
- SHA1 1a392a469fc8c65d80055c1a7aaee27bf5ebe7c4
- SHA512 dcea6d76452b1ac9e3c1fed7463fe873b4dd4603ec67a4e204c27ba2c1ea79415508c3044223626f0ae499a9b7a3d6fb283f0978b5e20a58e959c9440376e98b
- SSDEEP 1536:svHIPCv5eT9OrLPC5VwHrhpTrkt5Ad53vE1qXn9Jm6Y:svHIPmn/rHrhpTrkt52E1qXpY
- TLSH T1E173C74AD26511EBC4B6D239E15372AFFAF4B007471E57DBDD80861A8711BE0AB3C391
- MD5 SHA1 SHA512 SSDEEP TLSH