bb637b1951a9e80e632c002c1127168de316da6ca84e60cc4331eecaf8773918

Analysis

max time kernel
148s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
Size 1.2MB
Sample260517-mp375ae12x
SHA256 bb637b1951a9e80e632c002c1127168de316da6ca84e60cc4331eecaf8773918
MD5 a8aa41fe08c92331e4bb33f3a021024f
SHA1 f437316efc6a75f0b9329bace6b754023bd80308
SHA512 a684a6f7d37b1a9c4c65c29f2e7d0ddf9cd7fbe24c448fff654d5de400b91ca4c4e4a99dca6217c74a8fa1498f9be15ff5bb9f6b22acda263327fb09fbfa6518
SSDEEP 12288:86j5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:86NixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1C5552343ABD481C6EF8B3B3C60A9A7FD26D2DED0185449C3C2533676647A2DAC93BC51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3028	alg.exe
684	DiagnosticsHub.StandardCollector.Service.exe
3684	fxssvc.exe
5152	elevation_service.exe
1968	elevation_service.exe
5684	maintenanceservice.exe
4152	msdtc.exe
4856	OSE.EXE
768	PerceptionSimulationService.exe
4616	perfhost.exe
3612	locator.exe
1736	SensorDataService.exe
1748	snmptrap.exe
952	spectrum.exe
2884	ssh-agent.exe
2828	TieringEngineService.exe
4668	AgentService.exe
5976	vds.exe
4776	vssvc.exe
6040	wbengine.exe
3912	WmiApSrv.exe
2160	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\becb9afbee2c9d24.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_173093\javaw.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000010ae15276ae8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a626f286ae8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004fe2ab276ae8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c0c56276ae8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a6e38c276ae8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b37f8a276ae8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
684	DiagnosticsHub.StandardCollector.Service.exe
684	DiagnosticsHub.StandardCollector.Service.exe
684	DiagnosticsHub.StandardCollector.Service.exe
684	DiagnosticsHub.StandardCollector.Service.exe
684	DiagnosticsHub.StandardCollector.Service.exe
684	DiagnosticsHub.StandardCollector.Service.exe
684	DiagnosticsHub.StandardCollector.Service.exe
5152	elevation_service.exe
5152	elevation_service.exe
5152	elevation_service.exe
5152	elevation_service.exe
5152	elevation_service.exe
5152	elevation_service.exe
5152	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3076	2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
Token: SeAuditPrivilege	3684	fxssvc.exe
Token: SeRestorePrivilege	2828	TieringEngineService.exe
Token: SeManageVolumePrivilege	2828	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4668	AgentService.exe
Token: SeBackupPrivilege	4776	vssvc.exe
Token: SeRestorePrivilege	4776	vssvc.exe
Token: SeAuditPrivilege	4776	vssvc.exe
Token: SeBackupPrivilege	6040	wbengine.exe
Token: SeRestorePrivilege	6040	wbengine.exe
Token: SeSecurityPrivilege	6040	wbengine.exe
Token: 33	2160	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2160	SearchIndexer.exe
Token: SeDebugPrivilege	684	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	5152	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 1088	2160	SearchIndexer.exe	105
PID 2160 wrote to memory of 4268	2160	SearchIndexer.exe	106
PID 2160 wrote to memory of 3188	2160	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-17_a8aa41fe08c92331e4bb33f3a021024f_amadey_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3076

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3028

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2716

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3684

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1968

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5684

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4152

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4856

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:768

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4616

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3612

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1736

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1748

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:952

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2884

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2828

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4668

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5296

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4776

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6040

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3912

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1088
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2808 2728 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4268
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2816 2764 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 dcfc9f1819ba75a888851ebe621174fdf74ad83e61cfef78b1e805486d315b51
MD5 70c3aa40b0994ce52c1d1fe690511b55
SHA1 d4adbfdd3d87978bbdf3a7d5dce2b97282eba10d
SHA512 2f64871fa64133bcc83efc75ecb8035f3fe645ea143d4e9336479dfb665560d62637aa655142b49d5c3d743afc57d373595903ed15001f1ab0cedeca47345be6
SSDEEP 49152:Lb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnbixO3hHE8MEXWI4bMQN:Z3q6tjBxo3tzfG9btN
TLSH
T165D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 2f0ef5808b357b4adcb5286effaac0464121c6d339d97d263e284f001b768ebc
MD5 796ef2daf7de15f82e1b9188a3201ced
SHA1 5108162159250fb5e5381c2d98218bbca3a52e9c
SHA512 ef726144afea91f6478188ad1b1714a40561480f506677dec25ec7e0f8fe94879f3934d368eaf743a3adc0786a2979c2681247723bc2ce5742ab53df90bbabc8
SSDEEP 24576:VXYfDtczA2ixOFthHE8MEX1XsdIAhb0VECwN:AtchixO3hHE8MEXWI4bMQN
TLSH
T15865F12977E405F9ED67923CC8A28615EA73B8910760E7CB03A499261F333D85E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 82e8913bf8e12975d2119b931b25282a8468521e38430f0a5bfcf0fbe96ded49
MD5 4cbec335b7d3851221658d8369124663
SHA1 e7014537a24bade2906102c68303d9931da266d3
SHA512 698eff9c0c1cc58dcce00d4751c0273d86f5fb3a78f5f2929faddb4b7b8cd75ac487a817bcdb583e69c9a6d233860223a8ebf28a52a52c997d908d103f4bc807
SSDEEP 24576:k0Le5ji0hmxQrMzixOFthHE8MEX1XsdIAhb0VECwN:kPji0ASQixO3hHE8MEXWI4bMQN
TLSH
T1F5859E16F6748375D073C0B9C5D2A69EE97230821B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e873b735b6e1ef9c7e2a0e9276122030255ab07e088df2845be163ee3373d7c7
MD5 a6548fffd32ba6075273f3d5eb1b6ead
SHA1 9d66e0761a441c6e73b4a01fa10b40ccff13ba3a
SHA512 2fa0925e366ebfd3e1b9827beb0c95520249792d5ba35fe4eba039c65cce6b3c0f55538901c1543413be6e6d4480258c836c4c077aac78b1ae7d2d8b6caeb24e
SSDEEP 24576:Ga7/ezSC6vUyDZaqgrvWx6q8wyuRixOFthHE8MEX1XsdIAhb0VECwN:R/ezSC6vURPvMHjyMixO3hHE8MEXWI4H
TLSH
T160755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9858435279055e8d895551a12857485d532bd7fe3e8f4dddee22ec210dd32cd7
MD5 2347c1ac8949cd80527b4a68df969d80
SHA1 a9440f8401dc9c3327158b77259e09a5e84cae1f
SHA512 aa0b45091cc0cd6c4edd4f6e41625af67c766fa78b6c9e167d8999499ba857d3abe09e3e35a46f2b48e40e3777a6fbb0334d00af2d86da69728c91ae08e51414
SSDEEP 24576:LVbqPb88hv/lV7aixOFthHE8MEX1XsdIAhb0VECwN:LVO88hXlVeixO3hHE8MEXWI4bMQN
TLSH
T1B5559E66F6B48321D073C0BAC4D2AA9AEE7234415B318ACB0246D76C3E777D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 291cbe3ea2f3b2044b126c972f1abc8c95af4fa77723b193fe696ac5df89d374
MD5 633f5fcd68f462f5fe0d3cce07658da6
SHA1 d98725b170e1db3298c97afa617cf7c3dfdbb2ff
SHA512 0ada2fb6ed82a1d2888024aa5e4a831918d3551426b98e62849bc9aba672dc36df9e9b5d354638b9e5c48ab327b166fd73935fd3f55561315454cf83b9b2ca9e
SSDEEP 12288:u415i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:u43ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T10D552343ABD4C1C6EF8B3B3C60AA67FD66C2DED0185449C3C2533666647A2DAC93BC51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 0989e21bd38b202f6a8a03b8c73ea145ecb09a3b9466727e96c01ca4df0ee0d9
MD5 eb9d4d5a8b072beeb3967338151b8861
SHA1 ee17ccd08ce2f633e9a8fe5be826a84f4e0030c4
SHA512 7e0c2a5da7ae3ef14644c6c451e841a22d34a3c834d89a49625a48fbb501401f752a90dacb1170f35e396d6432a19eef0c55091d96d5c175dbeb292d1d3d580f
SSDEEP 12288:2eBNUbTVO86Ui5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:2JIUyixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T15675DF2BEE28FCD2C67E5D7856918340E7B278704F21A3CBD165820EDE235E15E7AC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 76fc12873cdb5ddd718cee48d9bd343aadc748b6b064c7daca648a107b82fa01
MD5 7f61573ccdd6968b1dd24735e60597ef
SHA1 cf195cf10d331cea62f039b0c17515ad66777ddb
SHA512 31269a7bf55e3f14f55ca6d72cd7ad4e5b00cd6442b2830dee2ade75eef0a68883010ec3a79bcdffe3b316124acc550dbd7d9d9da2e305c5b21a473b42e13d2f
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THV:TQvGAdlCEL8c/pRNw5CIo3tzfG9btN
TLSH
T166267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 abfb74a20e9a5b0e3893cb501b5d78bd92970e8b5d8e84b425e420e17030777f
MD5 3bcd4e8e917dabf418d92583e05c59c5
SHA1 0a62af98106c7a704e53f89e6bfcb825f98de7f1
SHA512 d333bc9a87621e9fd385e5817b3c2e6462b0ba1f59d11b3e9ea5134c971cf90d39231238b740a5c1bcdc11d9310c8292b763979000dfd4da93759d48d493adfa
SSDEEP 24576:33ewsAjAixOFthHE8MEX1XsdIAhb0VECwN:nljAixO3hHE8MEXWI4bMQN
TLSH
T1EE75E031FFB4E036C6BF0DB61B26C716146DBA600F6119C3E3A84A9E59342D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bf3f63ce5e06126e2f5fe5828f16102b365baa122c899a472c33867a804d1d67
MD5 2994b52ed07f284fcadc970665b8571c
SHA1 a1d6d20864006dc2643df23fb16aecc1ffa57f80
SHA512 5cf2778b875d0f2f7f92e38d2bb439f79969b6c907f1271be289b702ff5f198be14f37baf7481b953d54164b0e4b6f9f6e3f30be0294ee954484d67b1763c52a
SSDEEP 196608:3UEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHU3U:3UEtQevvqc2W1cpV29I320
TLSH
T150474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 90bf9050fbf93ee434e6b96163b2155ab1073691821a6fa1ab6987d47a0bf634
MD5 efaa3c476027ca44690b12edbc4b84ea
SHA1 c66d3a3836c1a3c4ca5596728e65339105572805
SHA512 ea6c87b6cef286db1370e6c45180a39ea0030588c2d570bbc68d2e1a0885c0dc10e316d035cf2f07a497bb39b76f31df0f6476a77d42c4d85c27209bc0c9850c
SSDEEP 49152:LCbRquA/m2yL5zQfFiV+XenmE3/zgixO3hHE8MEXWI4bMQN:UoqtVjnm0o3tzfG9btN
TLSH
T1D0D58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 aa5cf0e0d57da15f29cfc93274ff5ec0f0fe893bbcbaf1087cb908952264380a
MD5 d7806232ff31d6189002ab95e27d3e37
SHA1 fa908caa16e813997396beb8eda49ed012cfbbb9
SHA512 c8f597f10145dce4d8c2e150739ef6bfd9db3934690db9a7650cddbf0ec5ff3d4c9ab1c692fc8d5c57390420645dc50b3740e70598dfd203b9b6ceb19588ef4d
SSDEEP 24576:RAhGLmIFoiwtA5l7S53NixOFthHE8MEX1XsdIAhb0VECwN:RAM1Foiq5dixO3hHE8MEXWI4bMQN
TLSH
T18A359D81EBF951D4F5B3AA7899B69171EAB6BCA51E31C20F2150D11F1E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 d2f9e8692b5d09a59445782b3406e0ea3e3949266fd4ac9cb822275081a1c438
MD5 9238c8e89a1e1ef078f248e1a3a13e0f
SHA1 f4efe2cf14e1a01fef36db8037895ca93e91bb5b
SHA512 203f6c7c99b0f9ebc6e18863ea7c0ab2b29efb15a878db447ef3a8e3001f4c6911dfbba624432c0edd8105850e561bc654cc8ba51711726efb60c83259b9bb6e
SSDEEP 24576:5wumOWsixOFthHE8MEX1XsdIAhb0VECwN:5wROJixO3hHE8MEXWI4bMQN
TLSH
T17B65F14677E408E9E96752388557C236F7F2BC112A21DB1F4360C65B6F373A1AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 6c66b98a5be8fe8bea1e09ca0deb4cb8a5526f1cab88043a8b1017cb97f2642c
MD5 15cc93800f73986fc75c97b7c966753f
SHA1 26200aea1ba0e19c00d978b1e73d674d9ff08278
SHA512 48a5bd34b6bf305251288ba6a1aa16f0aaedff937f2be929269ba8a9617c7429c78f9a71b9e48d29707b25e83b054028b0ac4760c7f30ac80235284c06004664
SSDEEP 12288:qhZ1Iyg5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwNi:4ZuLixOFthHE8MEX1XsdIAhb0VECwNi
TLSH
T16C55124A37E460F9E597123CD4E55799D7F2B892273143CF426202662F33BC65E3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d6f509ffe26c39644e272ea410c75b9ef14fb99ff3dc1dd5ff74db0d34147c75
MD5 245786f88655d3cce32887b31e00b091
SHA1 9d882d2b49c7b2d8309c3a69bc724e354fbcb8c1
SHA512 1c3fdb05dbb1dc7a2f18f923f921656d23795a8da4d30d07687b2c9249d42483c96f4623c0b1c5ad9c89cc1885d5a277dabdbd125c96daa9ab7121470a5850e4
SSDEEP 98304:XQRQyi36YOcPuLvw2gAf+PN3lo3tzfG9btN:GQyiKakX+PNm3U
TLSH
T1B7667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 71e334c6d7e3e4d416ec58c79bcf1eb2de86e88c43335ae6a12524d5da9ba1c5
MD5 048956e47920f6d970fcc7a0035b5067
SHA1 f05f9b1a4513b9ffbd41c9f92963cd3ff72d69bd
SHA512 da770b95dbb4a8025e611f32f7b9004aa3a4abacb4f1b849f55451ebbddd07e8393df095cf877605a2aaccd1e9767eb1950c4650a4ec9f1d2ec13a60508b5895
SSDEEP 98304:AQRQyi36YOcPuLvw2gAf+PN3lo3tzfG9btN:XQyiKakX+PNm3U
TLSH
T16E667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 530c2dbbf5caf5d95b8c504e75ab8d5c4a825b4da41ecbaa64988ece86ef2f9d
MD5 9b6421a0d041f6b72d8fb6281f963865
SHA1 07a90d81c69149ef8d63231c435fff8ff230f873
SHA512 0944ced5bf742f2bed17b7bd0b4d5f028d4c9e594e1fb180febdfedaa07a9a1765b49d51b1df3933a887c15a7161482482377c3f4d03b41e181b79501231d1a6
SSDEEP 49152:s68Qg55nhxeWu7PNU3/QixO3hHE8MEXWI4bMQN:mthGRc/ro3tzfG9btN
TLSH
T154B54933B2F60099C44DE1769F4A973196D27C758FE0E3DB8111721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e9108a48a692817d60a5076a4fe8f6935642d034f94ad3586529e64d7904da8d
MD5 eee72a0662664b4c2e8a2b26398f4d8d
SHA1 c972724fb7194dbd153c82d227117aa74a82d3f1
SHA512 7167d9e88f6a5dbcf025c7a0f0799afc037ed688ed43bcd7c38771949505cd54c2d24fe18b44bcdfc08dbfb95c331d318e067211f6753bcb6faa375d1cf64a45
SSDEEP 98304:Sy5112gYy5azzVvD69nLKnhZSo3tzfG9btN:bLIH+Wh13U
TLSH
T1F0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bad5a5472a6c75a4ff59230369146967f9bcf5aaf73ce11c7f2454966a262598
MD5 b478b6ab35aa64ea9d6b08079c246040
SHA1 c5efe803a71ba8145c94ff043e37a7acf4c4b8cb
SHA512 ad3886abd6ec6d197ef2189098cfd9c812183e176480956b30ce63266b8828bd9c41285c72e6876eb8095c5f51730ec8b8967c963651d650b0fc417492fd3c1b
SSDEEP 49152:rB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glGixO3hHE8MEXWI4bMQN:9u6JmQxd2dto3tzfG9btN
TLSH
T18BD59D13F2DA01E8D05ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c9aa147fd83c06c12df74059a71d4cce807b24174847f917d5e9ae252f590727
MD5 b7ec243b819d3780a7f579776f3369de
SHA1 a5035b8100071d2d3e1c4d5833011991a298ecfd
SHA512 bfbd71a609ff9a75de89d9c25cec4e3beca15cd7aca4fee91411d173b4752e663c43b1bbe3aad708ffbea4903bb48c3628e297eac5cd669a3e863b45713a9a01
SSDEEP 49152:W1hpsNoJpF1A6yU44CwH7R4xSixO3hHE8MEXWI4bMQN:WmifPVR0o3tzfG9btN
TLSH
T166B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7e1957858c63107217129710dd5c6b0029b6639d600bfb540457c5ce2601f678
MD5 632752a379f5d6b4d3d39fcdffed6e0c
SHA1 e85646424668688b18434e2a4c94ae9ce0ff5a71
SHA512 6b54fd7534434a9d095ac4846f49a77cf96851fa9d58028365c9b794c956cfcf13ddc2f93fd2237303d42072f465656a66522d47e7131339fc0b50119e9d9914
SSDEEP 49152:7SuZQIY0Be2KIRVtOnks6NMHqLixO3hHE8MEXWI4bMQN:p5dKOi61Go3tzfG9btN
TLSH
T12AC5BF03F2E941E8E0BED67887669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ca6ff0c20e4cced8b75e8eb386d04ebdc8412d879ec75856373da82930f65662
MD5 7e20036251b1635f47b235d7830e911c
SHA1 2cb77e9016d7500bcbca1082ccde16a11838f96c
SHA512 87634b27a526395f32d30338727e3571d61b40a2e031990cc7ebf70807357cae4671abcce1ac362cc384699000ed6e731b6207c36d7052d10fc4f6a4187102c9
SSDEEP 49152:vhtSn8EApI0figGgiDn0AP5w2ixO3hHE8MEXWI4bMQN:+X2i/phAo3tzfG9btN
TLSH
T1DE95BE13F2D900E8D05ED178C7468632EA62BC150B35BAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b0a07d32fb5ae5e3167f4f107d5477526d017126f754e3bd67cffb329001ee60
MD5 63e1c5aedf7a512693495b923962d260
SHA1 7469cf635b8857f8bec95e2bb46ed8e9e445913e
SHA512 655b7139827ff89c3d9aeae98c271b02c9533949d078b168d239adb5caf9db11ef93f708993f1d6b3ed398201798a074d86563703cc1191cbb99f703c685a046
SSDEEP 12288:Tt5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:TvixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T14A552303BFD5C2CAEE4A3B3D909663FD66C6DED5281404C3D257203268BB6DA593BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 05f8d27ea5db86f357069bf54881e19eefbb3e548d89b39880a41e0c4213bf80
MD5 e0c1fd3c0d12c250a2eaab7411dd72a5
SHA1 12bc574c0126e00cd69e2de78421f58d7e7cfe4c
SHA512 fefa1e248159443f8094e7615ab2f35a59ac3ac6d8d36d453e261ac5162e6e7a43819d25bb90f444573e86df347b9b3b6b69b3cd39d7981b13ad270f405454a5
SSDEEP 12288:Zc5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:Z0ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T143552303BFD5C2CAEE4A3B3D909663FD96C2DED5281445C3D257203264BB6DA593BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 8c0682452e14f481e9a0e36a259acb62f7bd0a3be76735aed761e318fb1f5f92
MD5 d9070a5811c8c556c9fd4c05f66740c7
SHA1 1d502ccc7cb90e779c379a5447d2d8707359e72c
SHA512 c3982c2ecdb08323afb8ff1a7c6adfb0be5168af1052cac5e8ab121bff0b99de0643229118c16252bb255062ca5395c25ce714b432652c6c235f5bbfb90de007
SSDEEP 12288:o65i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:oqixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T180552303BFD5C2CAED4A3B3D909653FDA6C2DED5285405C3D257203268BB6DA5A3BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 28ee4f907e58cc1b22d8b7a431e00c47443c97e31d4c2094b2b1545b584cb6cc
MD5 5a4e9200f5e84791806263e1f3d572dc
SHA1 ce706b31f94f1db09a268c5ab004521762e3b530
SHA512 65b4467a606f1594eca2135ed80504aa4bf0aede0b794a1776931a2a87bcbca5b7ba538dcc2a358ab674ec37ea9af2151accb0a942f50c97083f88b005bf3f51
SSDEEP 12288:mVD5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:4ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1C05523037BD981C6EC9BA73CC0A693A9A3E2FDD42A3156CBC20215261D773D59D3AE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4d7fd8f6babba5920cf4f349d32ff57bc148b16c27adedf63f93ccf1ebcbab57
MD5 32eb08310b7955e1643dc0a574f4a129
SHA1 a4f5224be3694b13933d9a9f4a98b509bf4531bc
SHA512 50ef0709fd7ebe1b771a643e2e7e592bce2b7c29242bf6aaf7f4d38ca4ef08abb8bec48692f202bf1f11025c7cfad5e81312155aa6f970b4705eaaf94a719ff4
SSDEEP 12288:er5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:eVixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1E5552303BFD5C2CAED4A3B3D909653FDA6C2DED5285405C3D257203268BB6DA5A3BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 dc8e149477ed75cebe9b9becc97f75add17ac74dadd04c77be13e0fe76227376
MD5 aacee6300fc103ecfc583e4f749c4bf1
SHA1 813b52a3e8b5706f8837d33d24c503cd6f268788
SHA512 b2a7c27c80df761bd01cd8c3d224a73bddcc716f38d88add1c07bd46f25205811a141f0bfbf2a5d46567aaf0b24a99b343cd703539573c98ac73b8f57f8dc9c8
SSDEEP 12288:0o5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:04ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T14E552343BFD5C2CAED4A3B3D909663FD96C2DED5281405C3C257203264BB6DA5A3BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f2c5780d58f873e672f5795a96509021067285f6342b1c7df669c9cdb75a1bd0
MD5 868dfc2051efab91306f7b7125db79f5
SHA1 adaa952b9286d6b58927407f088cd2bd7570d028
SHA512 01545fac90e24b0eadca5874fd65b0fd54090a77ad89d173d25ed0242b6e1b51b521c3a41c7be755aeb1fd3143bd2edcbee8d5b0acdd7cbc022b7dca288ce583
SSDEEP 12288:Hk5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:H8ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T156552303BFD5C2CAEE4A2B3C909567FC56C2EED5285445C3D257203274BB6EA593BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 723c157f3827a0c014fa557d21db92f091079a7e8c388688660fd59cd181123b
MD5 66c2060dc2543369d79503140573fbb6
SHA1 d74132f82705cd9ab0da570b88b9cfa6c0fb21aa
SHA512 ac3c0e53e6e04b40ba249caaef9b59cef8476ae09cf320996f1e40a9d5fef6121d14f50cdc7e7bb801f425ffcadf9d43d67d765fab5710b61447e62a15923568
SSDEEP 24576:OZMKzFVSOUixOFthHE8MEX1XsdIAhb0VECwN:OZMKzfoixO3hHE8MEXWI4bMQN
TLSH
T116750195B39018F8EC67823EC8558A56D6F2BC5A0A60C64F03A536275F333E11D3EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 4a9f719131d1119c974464ef9467faa67b23dd51d57bb8da7522ab128b80a13c
MD5 d746658efe04742360c1f43698150474
SHA1 9a08a9ea85538f4138dae89e5cb12b92edb99e78
SHA512 42d8296f5fdb0aee30e52c35ba8398fb7a518d0f8c62cd8fa1b4c062d9547f80554ab44f9da975cafb1f283808af96e3d176bda67d846b5250694ed9b357be69
SSDEEP 12288:gR5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:g7ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T166552343BFD5C2CAEE4A2B3C909657FD96C6DED5285045C3C257203278BB6DA4A3BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 3aeea0a7c50ff51cbe540045621215d8d2fe4cdbafac1134eac2859d460724a2
MD5 d74b52f0619e5eb91cefb4da0e105b26
SHA1 dfaf6838ec0aa12c9aa19176e08d7a312f6d33ea
SHA512 2d74c0a667a77021e36934754d8c3b7ebe9da917ffad4f87278ee05e1ddc4aa67de7eb192838d235198e11ecf89a34db5a997d0e6ed3928d0a065e7a4724a1ed
SSDEEP 12288:Xl5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:XnixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T176552303BFD5C2CAEE4A2B3C909667FD96C6DED5281145C3C257203274BB6DA593BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 078951b537462bd3a9f3318f0e3fc71e5efd56068b97335fec57da3fb0582ebe
MD5 3371cc47bd92e3a4b66b81f09bf5065d
SHA1 0f73b3f6cf8e17754d994c9a5c548a30b9a70bdc
SHA512 e479e5bbbc11a908fe46b9daea71139575c199734a6f2dae39d8ce5f1d492db9dcdf75845988b92ce801b313950a62e3d1e7bac9aaf871d0f2017019603b5f84
SSDEEP 12288:SyPz5L8g5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:PzywixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1CE65020777E120E9D5675238C4A21B56F7B2B8720B208ADF53A106762E376D19E3FF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 437aac9bc585ccd6da0c10b9735182308060c81ef8af7efe1093a641fe1a97be
MD5 05da6becbcb80c9d8ff590bf23f70aee
SHA1 39924ba858fcf49a767a2b0cf7913a4abc53cc66
SHA512 20cafa2bd371e9c9855aeb48e5df2fe936d6585cf1d0e1339ec1ef4cbd6468b7594013452bb1ed7f491476aa515cced0e60d4a6bbce63946a28c5b15d99e71ba
SSDEEP 12288:fR5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:f7ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1F3552303BFD5C2CAEE4B2B3C909657FD96C6DED5285045C3C257203268BB6DA4A3BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 5832a83a7a05bf7f63bd303ccc3f9bb027e4a41edd9962009a40e3c8926c1655
MD5 d6115b1fd2156c432a983f88b1e538b8
SHA1 910c6d1069941137bd6a94d0dc03eb93fa3fb47f
SHA512 40b40913161445511e45e7428c15e521da9d7eea4f4032c587ef8488bc2d679c774ebd74828cb60d72969016b6fb25fac682282dd7bf96f83570bed35a3a1a91
SSDEEP 12288:LR5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:L7ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T185552343BFD5C2CAEE4A2B3C909657FD96C6DED5285405C3C257203268BB6DA4A3BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 9a17d86d82d39b2d843ee3dd3c897a1f9ae355d6004d347eef4d32f53bfca554
MD5 0d4127c41d9f01acea8daaced82a9204
SHA1 23094c7295f08a8b7b0c4d556406fe93e4a8233e
SHA512 92591c8724ddf58a0ec0e23ecb22c5e7f5ce51d9d1f098a0eb27640147d2e1df14405c4e9efa1d73d7bc8e3dcf16cd0963f02b930df3fe1e06ee931e4d18d621
SSDEEP 24576:OCUkpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvA+ixOFthHE8MEX1XsdIAhb0Vq:OCUMPTY+8Wg2lIL8lrIUJLWwVixO3hH4
TLSH
T12165BE1EA3DC089AD4BB813589518A16EB72782E1B32D6CF1160C33D6F27ED55E39F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 0e041d15511565b03ec87b29e9ea6466c52f932b0cf7c68025b63cbad609cf18
MD5 fbb16bd235cd6acf5e7407ee5aa0539b
SHA1 0a6743af0722fc478c37fd236d144ef72207bc12
SHA512 e16c3f0a65e196c858059232fe3185e6b0dc02063c8422af1f29d3b7ba6af407a30332c091a953389919068285c148270b162e1dd74c96b82267f254f04cd571
SSDEEP 12288:nXsfh5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:OLixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T15365F10AE39842D8C46E6239C3564B85B3A37C6547E1D3CB92C1F53E1F766D09DEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 31a5de8603cbcfc234f1caa5c5f8e1e97eb9b3603d2f39ae472f3441c48965a4
MD5 1b2f19d221e40f1850e49e05cf30bce8
SHA1 e23ee2a06685bec2bc2f5a6dfb5bf03a3cc0a0be
SHA512 1d2742d4f25bc8627c0b069b37addf542806abb7816312569d73846a8bd1a9dca73a6b5b464c38940fa401f72e45ca622b80bf4006484a496906464f395f574e
SSDEEP 12288:ia5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:iKixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1AB552303BBD8C1CAEDAF3B3C506A93B862DAFAE41F1084C3D103216674766D69D3AD51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 89924d2a0b31754cf5b075db44e13017e4e45e8c16973da2aec5d0abc086a167
MD5 51dd456952073ee049e7338583eafaf3
SHA1 101de3d5e4ff04bc007c393d5f867a9ae38a2a67
SHA512 fdadfd096e7ec15fb0185e4f882c03b78f18066c849efe33817a1bf71f4d1000991ce75ce1aa3e28e0933c82cad39dbef1d6544389265b778442f912d2b1c35a
SSDEEP 49152:2RZwQCyiHiQEaaPnMTixO3hHE8MEXWI4bMQN:s9xvPfo3tzfG9btN
TLSH
T12185AF1E63DC42A5E4BAD278CDA74407E6B27816173197CF0291C27D1E37EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 5a03c62cdd7acfe4c6c3acd8eb73acb1ac7fb54c0f2029716ef3145ce8c7df71
MD5 632ace3f49c179309ce8d2ba28adffca
SHA1 43997ba68b9659a559ca84b792eb843e5e93c15b
SHA512 2834ace51759e14bcccc16a20e773b2a15ae3ad28eb89445cab32858195c4be3279fe71b070588d798a0a38ea470f3a5f21cc9a5fda78f03a7b8aa18d5c87ac6
SSDEEP 24576:1bxA1UG6ixOFthHE8MEX1XsdIAhb0VECwN:1bxA1UvixO3hHE8MEXWI4bMQN
TLSH
T1AE55121E67EC10D5E57AA63D84D28309D3B2BC66172097DF5092823A1F3BFE59C36E81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 38be41385815bfbe13486f2ba86896a1cc67eb78c8a9082629a612204c90b1af
MD5 3e654987ed4bf18629a98a8374521501
SHA1 4f9fd902f3385bc31b107549ac77554fd739fbb2
SHA512 89902bb94bd9866127b697a76594db3d6b5cfea7a821c8f89a84d836f946ce483647b915f69f2509c51c2bf90271ea2acfcdec1a91498344ca3af8f25bf1d4bd
SSDEEP 24576:AjsmP0yHaqrVqHra44KDzMsrndixOFthHE8MEX1XsdIAhb0VECwN:AjRP0yHfVqzlAsrndixO3hHE8MEXWI4H
TLSH
T14C45BF2EF2B910F9D8AAD136454107B5BB71B82D1F209AC70170C235AF1AEE89F35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 0603ed17835947a4563154d7e21270d7043df1dd16abc10a11bc05047a66f2fc
MD5 791df7670aee731d3d312c864450accf
SHA1 e413b0f6e1d1c63a108e29d622a136bfe6c443b6
SHA512 324683ee3bb7f64ae5a9fb212536b110985fa265a57880973929d929ecb3b0218b8643471a6a4141e63a9c9f785a435e388771f3c84f77289d1aa70a9e2a4a30
SSDEEP 12288:XI5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:XYixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T16F552346BBC5C2CAED4B3B3C509997F962C2EE901B2545C3D157213264BB6EB8D3BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 0412e85ec2c1e8425cde6e1cd88dcb60b6b5a7d869f07e700bc7a98b91b0eb74
MD5 3f98dae6110662b8b555de8be30f5dd2
SHA1 f753677ae6f3f132de1af90ee2d2bc532247be9a
SHA512 cbd70d2a30f703bada0757bc4c68e01f4e29cc910e9cfc0ca4e18f988b50b6309e73851f42396d718ccdf2f8cf8118e5a29362cf2f0d8912d1c69d98bb37f278
SSDEEP 24576:jKLBUT2ixOFthHE8MEX1XsdIAhb0VECwN:jKLBUyixO3hHE8MEXWI4bMQN
TLSH
T131750145F7D400F9ED6B913CC4A68616E2B2B89D0764E7DB03A94A651F337E24E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 f85e9e1f60aae627bc8d20188b1c4da4fe12007d32d44c19cd36f11a2efa4e37
MD5 c5ed074ea0f45b72e8c7cd839de2e9d5
SHA1 236af2b2a93983d30d9398354afe25db80e838f7
SHA512 92b69e9a3dee5243dc3a8c93da6edefad63e479894df6fe0b5f5182fd3d73ff9e1e45a0bb34157f95b0660a73e3921fbacb5d2a8cb4ab15c06bc252ffbbae3dc
SSDEEP 24576:0FYNHZixOFthHE8MEX1XsdIAhb0VECwN:0FYtZixO3hHE8MEXWI4bMQN
TLSH
T1FC65F11F67AD08D5D57BA13D89C38259F2B3B866171192CF01B0827A1E27EE97C3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ab784f9dc8c9f703333af64c39305dcb44bcab018cd98325eb8148c814921322
MD5 08f8c1f95a012be247e62f7958f83dee
SHA1 6cf2738aeba77edc6c9ce9ad1f0c6902a0afcdcf
SHA512 d01377fba2f762ca18d0f8fd1505771426d36265be403703af57312c81da05e300d133b33b73efd92398050e7b2ab1127289dc5c065a35d3a491b255b029d26a
SSDEEP 24576:snXoJjNYH84VVSNAApoEOS66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKb:snXoJJYH84VVS6AmEvJas+cHBjSSKHPr
TLSH
T12A65AE5EA2BC04D8D5BBD17DC5C24506F5B278621331CACF026182BA7F27AF59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ded0c45790eb760a131e8e2dae46746059f23520e561be2827b81a3432eb53ee
MD5 f1a91a96fd4a2bfabf76d381ae8aa159
SHA1 44ec2caf98a940d2d93ad96b0d09552e4fb00145
SHA512 9eacb086b85d1776664aa339870586e64fbbac90b24767b8a38742d044970bcfb18e3853dfe2490be514cbaca2d4992176aee97070a8c7b913d72a46a4327ac0
SSDEEP 49152:oDLL9TuJ0M/TYW2P4ixO3hHE8MEXWI4bMQN:roo3tzfG9btN
TLSH
T1BC858D1EA3EC42D8E47BDABD85A79146FAB2B855173081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 f3fb60ad12b371e22c576f4b1e9f76ff61dde19c50a3aa8dc673d037be37998c
MD5 ddbc56e92f938a2be9e40a5c89d48592
SHA1 681ebeb76667746931b14046c5c40849a8cea93d
SHA512 2b721afb00055c6c11b7f34c5553e11f820d0f46260df7d08cc838b562c2b0846136de933881ecb543ec776565bb9c7428dbf73e1d13b50ad7064523984af7d0
SSDEEP 24576:0egJgpwJOmPOHWAKJ8ZguIGyPsxr5Vin10w2ixOFthHE8MEX1XsdIAhb0VECwN:0ngOJOmPOHE2ixO3hHE8MEXWI4bMQN
TLSH
T1F855CF2FB7BC15D5E03ED17D89968916F6B1782603255ACF0160827E5F2BEE46E3AF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 e34963e886c6da22503d7db1d67b8352796d0ca9f55293ef0e5df05632ae8e71
MD5 b8390bb68a647ad9e21953ea0cf99e50
SHA1 d4b573e3b9865f9ed9482e1595e45640ee4f4a56
SHA512 63d500bb38ae32f0a255ea4b4696a7a6b0d928923fc532e66a819d2875dca156a2c5a2dd3f900d15aca71591d656407c09b90e9820862a9f818a90b068a66d5f
SSDEEP 24576:BLJnJiTk3R3waE4JrO4ixOFthHE8MEX1XsdIAhb0VECwN:BLJnJK8R304ltixO3hHE8MEXWI4bMQN
TLSH
T1CA75D02DD2E810E8D4B7D2B4815A1B96FF72346C2B2169CB55B4D5313F22FE0AA39F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 e465771d9251b42838150fcd7c2574dcfe7b58c2da5b950ec7b1cb013c14ad1f
MD5 46e33aa071757dc75451122f80f792f1
SHA1 63c6b2323fd2127c2cd7e33ac00a4a399a64dd2c
SHA512 f602bc596fcc74af5553d512255d62a9f1c1fcc807588e91c8d2bf9e3f21533e94e756718b0ecc82ef9864b51ea3e8a9158a949e7423b2779829e9dad583d8b7
SSDEEP 49152:G9GqCzDScAZmlvTcFg8Ph68ixO3hHE8MEXWI4bMQN:4wo3tzfG9btN
TLSH
T12B955C05F7EB5288E8B3CAF1C96295159B327C409B34F7DF4A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 fe97c0438d29c923d3b40edb8fcfa77fc8401c8a56d766cdd72677195bc85618
MD5 2d41545afd2a2dd2c74191d94e1e28e7
SHA1 f64195521aff71bbe13a19560c43c2c2ff92fdc2
SHA512 fb59f36a42262baecd0a0ad907472b8d8830a3d9e7129885148c89138fe7b0af37338a383de46aa1ae84b86dc77035d5365c7911eead6728953bf8065ffec9a7
SSDEEP 24576:LlYJeXm5jUuEmixOFthHE8MEX1XsdIAhb0VECwN:LlYJeXmRUuEmixO3hHE8MEXWI4bMQN
TLSH
T11F55124E7BDC60D5E52E613D80924798E3B2F4A1171157EF81E0C17A4E77AE61E39E80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 3a9c728a2e5b33babe4e3b8a367bc8eb041a5d2d78ece9a3a0397857dfef6015
MD5 fc293f45d5a7f18ac9685d7bdacc5a29
SHA1 70f0eba04783787469f54d1dbad619a9b707e826
SHA512 c365d65d71047e2ae48e02e9af197f5fb8d1b2b6c5a673512eab99e5e828b052b103dd788a1bdc2fc4486a1d355afd1e0ac716daae84a0c6e35e40cf6d792db5
SSDEEP 12288:XFu6kyT5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:XUty9ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T17765120577D491C8EAAA1A3C95A383A49BB5FC601F2047CF8192A23F2E377D5AD35F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 6fd9208796330cd397b4550b84197432f23e79e3183274d47687fbeda3696967
MD5 48926f897c3cfd66503a7363d79201d2
SHA1 a9fbb873fd402c86b74a444241e664421ca144fa
SHA512 be32bcd66217721273c85931da8494a058e9ca0817e2148d0ee356ce55625846b9578c5ab8d80a8c58c8180d5e400186946bf16c41cefb7ccbba407eaa845d7a
SSDEEP 12288:5PO5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:92ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T19F55230B7BD591C9ED4B3B3C506657F962D2FAB02B2018D38193A132A9BB6D79D37C40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 0d6e5720e047e813592939dbd0dc08fc829c4527050cb4cfe10c8ce7a1ba1844
MD5 0f621c7bc486330f233f6c6d0f9b5f2b
SHA1 64a793294ed1476acbae67a8f89c54929283b789
SHA512 1776430178b34b5d896943e38c7616bcc16569130c5ae4ed7db2b9860172de2c451b8bf5e8d2d8352864ca3093383d90c3855622f1986daf7a762448bc96cd02
SSDEEP 24576:SC+TyQIu93VAumZr7jmrixOFthHE8MEX1XsdIAhb0VECwN:S/TfIq+YrixO3hHE8MEXWI4bMQN
TLSH
T1D8558D1DA7F919CAE276C675C8A34493E633B872137186CF2044C07D499EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 272ad3d6fb23e8231658396d6006318ce1a5caccd8d9620d78f52b4ab8742b03
MD5 f7bde76c2fedfb5c6b8d841d89749fef
SHA1 be889f1626d6db03988cad6b0a28d4fde02472db
SHA512 d344fba52b99aea70454bad4702a8747095197cbca9a1ad6c1a24f71bbfc928f9a30bb642c4fb6d9d816df8ef7cd96fa878ff6d0db6b8250f079d72c8b627095
SSDEEP 24576:VLQikZCixOFthHE8MEX1XsdIAhb0VECwN:ZQikAixO3hHE8MEXWI4bMQN
TLSH
T1ED65F10FB7AA00D5E4A7823C88854255F6B3B470171267DF42A1C77A4BB76EABD38F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 823ee9d5aef3828fe24a85d5ba9b78baa252397319eebdd5dd2c188e8b263644
MD5 ee4e1a2b6406f9ac2843f82e24847a4e
SHA1 ddf0b9f1e657278a422e13d281039426a3b84ed0
SHA512 c248d9c1afb92bf7e770eefafef330d112d3fdf1fe1a67d7b95a72b88188e88a2f8c3d49cef7a1f185d556bc6750cc0ba699d9c8276f1975f3abfdb24dc77307
SSDEEP 49152:gpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP9ixO3hHE8c:RpC7b4+80GTk/o3tzfG9btN
TLSH
T1A0A57C3DE2F810ADD8AA8775C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c278449b4654850eac95b6d4ce81c6730db78e69ceed65e9a35c84424e2e63d0
MD5 916ef37a5ed4c29eb3845b3fea823f8b
SHA1 bc5a1b694ab77554898fa8629820e297b8ec3d61
SHA512 f0c4cc35790f9f02ccc79bc996dbb3ed5b997d98e0792ad6aaa4bea2daea2b40248e762a65b8ec618f77f4b68bb5ec877c6b03c148fe3cf1308d199d1e980745
SSDEEP 24576:0SAwJPE1IDAo+4Kt+l4413kUQ1ixOFthHE8MEX1XsdIAhb0VECwN:0qPCIo4Kol4WQ1ixO3hHE8MEXWI4bMQN
TLSH
T19455B01AA7F956E5E17ACB74D663C611FB737822133163CF8290813E0E269E85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 b81d93e3b3c871e312e1fffb185c86f1b7de742a4faddd6620f3512e077c8c9b
MD5 c67616f0d5c702aa0ddd27d3fd3f5fc6
SHA1 251d0b74fc05d55f95e4425b2519fcff80ca61b8
SHA512 96d5b4dcd056622d3b14ec711a9b2069e628906525091c5bf3e2c5fb5afc5524d845bf905bd96319032c5d82a9c060185c7d46b87a02353d297540f1aabf5e07
SSDEEP 24576:VyLXPLcv94tlixOFthHE8MEX1XsdIAhb0VECwN:Vy7PoutlixO3hHE8MEXWI4bMQN
TLSH
T1BA75E12EE76D04E5E47AC27CD2A38606F67238AD033166CB15A091791F7BFE46939F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 5b500564a564741b5cab0b95fdda2003022052aefdda3413700612959a91bdc4
MD5 0863b58ba4497a31e607242ef37d32b5
SHA1 c51ce4f2756af69602d4e65b76cb774392f4c997
SHA512 99e28a27469c59dc8095b2e1bfcff12ba82a604712daa2890729a74a224847ca03609f8cf02a8b35723be334f79d3979ceb75586373652afebd29a0dafffc2ad
SSDEEP 24576:fWv8qjpSixOFthHE8MEX1XsdIAhb0VECwN:fWv8NixO3hHE8MEXWI4bMQN
TLSH
T1A065124E67D460C8E87A1738D026836981F2BDB217649AEFB0C5D57B4B36AC1993FF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/684-24-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/684-23-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/684-110-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/684-15-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/768-177-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/768-96-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/768-92-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/768-86-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/952-123-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/952-117-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/952-342-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/952-127-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1736-368-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1736-128-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1748-126-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/1968-43-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1968-49-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1968-50-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1968-153-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2160-219-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/2160-198-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/2160-182-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/2160-169-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2160-372-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2160-432-0x000000000BE20000-0x000000000BE28000-memory.dmp

Download

memory/2160-178-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2160-175-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2828-145-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/2828-367-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/2884-366-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2884-139-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2884-141-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2884-133-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3028-109-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/3028-11-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/3076-377-0x0000000000400000-0x0000000000541000-memory.dmp

Download

memory/3076-94-0x0000000000400000-0x0000000000541000-memory.dmp

Download

memory/3076-0-0x0000000000400000-0x0000000000541000-memory.dmp

Download

memory/3076-1-0x0000000002260000-0x00000000022C6000-memory.dmp

Download

memory/3076-7-0x0000000002260000-0x00000000022C6000-memory.dmp

Download

memory/3612-125-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/3684-41-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3684-28-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3912-370-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/3912-165-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/4152-80-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/4268-425-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-440-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-453-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-454-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-455-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-452-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-451-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-450-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-442-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-443-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-444-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-445-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-446-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-447-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-448-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-449-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-441-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-438-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-439-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-437-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-436-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-435-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-434-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-416-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-417-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-418-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-421-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-419-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-420-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-431-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-430-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-429-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-428-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-427-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-426-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-422-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-424-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4268-423-0x000001B3C59D0000-0x000001B3C59E0000-memory.dmp

Download

memory/4616-103-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/4616-106-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4616-98-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/4616-252-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4668-150-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4668-149-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4776-167-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4776-371-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4856-79-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4856-166-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4856-70-0x00000000004A0000-0x0000000000500000-memory.dmp

Download

memory/4856-76-0x00000000004A0000-0x0000000000500000-memory.dmp

Download

memory/5152-37-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5152-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5152-148-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5152-31-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5684-60-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/5684-64-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/5684-78-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5684-54-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/5684-162-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5976-163-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/6040-369-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/6040-164-0x0000000140000000-0x0000000140216000-memory.dmp

Download