bada583ed774ed2151201f524c2b428a0f270c1ff529794c44c8d3c7467b2665

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/05/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
Size 10.0MB
Sample260524-2datrsgw4p
SHA256 bada583ed774ed2151201f524c2b428a0f270c1ff529794c44c8d3c7467b2665
MD5 944b696d863529eba4ed2acaa94a5e69
SHA1 3e0f7869eb30d2a48e2fbc6a423e7c39acaf04d4
SHA512 d919bd6126bac54c05642a1585e6a274081c6b7fdfd2426def77222e1f41f878a58a3af9da63b0ef738d2d366ac3ca59bd12ec63080f92e686e67f2c0f5a114c
SSDEEP 24576:enc6gbcN62xOSriPhHYsdt8jgfPqnGsgjj5B9xenRcJyjZP:N6OcNiphHTMMl3jZxenRNjp
TLSH
T1C3B6CE553DFCC73BE3E285308E6D7BA4B0F9B9680E3688572385195C1A35D81D31BA2E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4948	alg.exe
3296	DiagnosticsHub.StandardCollector.Service.exe
5088	fxssvc.exe
3352	elevation_service.exe
3424	elevation_service.exe
5776	maintenanceservice.exe
3440	msdtc.exe
572	OSE.EXE
1316	PerceptionSimulationService.exe
5612	perfhost.exe
1992	locator.exe
4676	SensorDataService.exe
4700	snmptrap.exe
1832	spectrum.exe
2488	ssh-agent.exe
5800	TieringEngineService.exe
5720	AgentService.exe
2372	vds.exe
5636	vssvc.exe
1204	wbengine.exe
5956	WmiApSrv.exe
3564	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a0f58061ccebd5c8.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c325a88ccebdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
3296	DiagnosticsHub.StandardCollector.Service.exe
3296	DiagnosticsHub.StandardCollector.Service.exe
3296	DiagnosticsHub.StandardCollector.Service.exe
3296	DiagnosticsHub.StandardCollector.Service.exe
3296	DiagnosticsHub.StandardCollector.Service.exe
3296	DiagnosticsHub.StandardCollector.Service.exe
3296	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
Token: SeRestorePrivilege	5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
Token: 35	5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
Token: SeAuditPrivilege	5088	fxssvc.exe
Token: SeRestorePrivilege	5800	TieringEngineService.exe
Token: SeManageVolumePrivilege	5800	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5720	AgentService.exe
Token: SeBackupPrivilege	5636	vssvc.exe
Token: SeRestorePrivilege	5636	vssvc.exe
Token: SeAuditPrivilege	5636	vssvc.exe
Token: SeBackupPrivilege	1204	wbengine.exe
Token: SeRestorePrivilege	1204	wbengine.exe
Token: SeSecurityPrivilege	1204	wbengine.exe
Token: 33	3564	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3564	SearchIndexer.exe
Token: SeDebugPrivilege	5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
Token: SeDebugPrivilege	5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
Token: SeDebugPrivilege	5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
Token: SeDebugPrivilege	5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
Token: SeDebugPrivilege	5828	2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
Token: SeDebugPrivilege	3296	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 5676	3564	SearchIndexer.exe	104
PID 3564 wrote to memory of 4560	3564	SearchIndexer.exe	105
PID 3564 wrote to memory of 708	3564	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-24_944b696d863529eba4ed2acaa94a5e69_amadey_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5828

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4948

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3296

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1820

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5088

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3352

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3424

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5776

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3440

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:572

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1316

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5612

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1992

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4676

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4700

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1832

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2488

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2420

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5720

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2372

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5636

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1204

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5956

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5676
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2864 2860 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4560
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2932 2912 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 682f5b867f50bca934a71dbcc2d7ea0ee1432baf5c0cdfc291bfb49b53f96abd
MD5 438b1a96f3454fff12bf1ae9f19178c8
SHA1 76528dd15b66f15cf7a03d133279ee14daec8753
SHA512 ce7dbcd15e290c548108277d627658b4a6122df073c17b2eab0fde6226cb4499d20b76195606f19e5edfd5b9df55d15c1a6b697fa33e752148e5e0593619ce8a
SSDEEP 49152:pb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnmMl3jZxenRNjp:/3q6tjBT03jHenRNjp
TLSH
T12FD58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 1605d9c56ef065aa21c5e2eefa6c9c3ad743d29fd6abf55ec6e8fd96baa378f8
MD5 d4bbbb0e771fe8294e5d2759bddffab6
SHA1 4a5b0e9e716c1a40b792e0def848652bb6a6f3e8
SHA512 205a5f9ec196eaa44419dbee7ad4f184fdd0b1decc7601b92867e43212b5ec33e0706b1c173377551e5bef9bb5c1ba1a93afe968ee7bab7120da8fbbbd8b9fc5
SSDEEP 24576:gXYfDtczADjgfPqnGsgjj5B9xenRcJyjZP:XtcwMl3jZxenRNjp
TLSH
T15B05F128A3E404F9EC67827DC9A2C511EA333C954760E7CB03E49A655F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 1e1a5c49b14e46f79080194c70da07384d48f5d336e24bdee91ec5ad815305da
MD5 9d3142d4f603c89d96b14bd5aa8da858
SHA1 89930c3293ea721faa0a254a703accaf9410a0f6
SHA512 ba2fcc625000254ffea399c4391a952bbcf600a1e03cac008db43690a71a9cdc86355d4bb9fdaa3b5247304032d09a5d8871ec16b207aceb2bdf6f2d8db09e1a
SSDEEP 24576:x0Le5ji0hmxnrMGjgfPqnGsgjj5B9xenRcJyjZP:xPji0AxNMl3jZxenRNjp
TLSH
T11135AE55F6788371D073C0B9C5D2A69AED7130861B308ACB4286D77C7F27AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f918a830c9f1cb3937b785178f1a15f11288fae250c55f17e2ed6c51f140963d
MD5 d46ef1982060ba67126d0848e6c6d667
SHA1 d08f4f12f6d4894a76109821f0f00a2ac3c52648
SHA512 d06cee47cc932d907c7c35cc27f9495040c9e25059ba65404d53019bd19fc7629b35e8dcfa85670cf6c4b16cc613a1b3a3d5a9ee6b019f24eb12db1845f4d2be
SSDEEP 24576:Na7/ezSC6vUyDZaqgrvWx6q8wyuIjgfPqnGsgjj5B9xenRcJyjZP:E/ezSC6vURPvMHjyRMl3jZxenRNjp
TLSH
T13A756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5ac02119606ea3fe3b90b7dc22b2de6e3053f1881c82c1efeef43debf25af406
MD5 82e746e5b2deac430e7b873e0974c66f
SHA1 31d696c998059e9a3bd00b878141ab88f0d207e1
SHA512 2c82c91cfd28fe0b9a6f31d6618c8295b1b99ea29057493eefa296b679b2b056e27e945d91b4490c132e8a43a26e87310adc2d34042334c03dfcf09cf5995f5b
SSDEEP 24576:CVbqPb88hv/lV7HjgfPqnGsgjj5B9xenRcJyjZP:CVO88hXlVPMl3jZxenRNjp
TLSH
T167559E65F5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 aafda01c3385ebb6da29fef14e5d013cb86e73cc38f03381600ec94bb1954578
MD5 2d8457552a492ed9ce45bea3d37c348d
SHA1 ddd35c8e8858c14bcd6a8404007b70668d8a874b
SHA512 926aa85cf1ff8211bdc8eb73d72e5306fd81f7ce7a28f13ebde60b5b6e4f359e9c292c15b5e122fbd853733fa977bafe636709d7aac52aeb9287e1f222ac86ce
SSDEEP 12288:jGzmjd0nfPD4LfnaYCsYq0msjcEB9DIkiEx8U8tvCA+/mqyxlZvn:jGKjgfPqnGsgjj5B9xenRcJyjZP
TLSH
T135C423C8C65850F6F6BA0B773BEA82E2A5291CDC5E06CF4606D93E81C13C99D94B7713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 198f5de800576c987a4264ba994640e54fa0d8b33b3bca316d971624ee477949
MD5 5c1ee1cb863b1f0a982670f40eabba43
SHA1 79be4bab2ff04848aad35f677abab5f34047c269
SHA512 a236f7b1d7a88eb553b12d9137575732a9428a8fae7b035b8249153553af7017e3145318b87cce33f645c33ccf3c067d96fec2df7d39b1189e4afaf222426b61
SSDEEP 12288:aeBNUbTVO86UMmjd0nfPD4LfnaYCsYq0msjcEB9DIkiEx8U8tvCA+/mqyxlZvn:aJIUfjgfPqnGsgjj5B9xenRcJyjZP
TLSH
T16105CF7BEE28FCE2C27A4DB95B918240E77238704F1293CBD165820EDE235E45D7AD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2b5736e99d6d65af4fbac056fd0975ae36a3cc5abfea47ccaf141171aceed78b
MD5 7aa9ebc86a98c41a712fe8b36ccddf27
SHA1 cf3376ddb30da17abfa0228408ccd93a32f12a5d
SHA512 99d11d05f00327a21bf5bdffab5fe9ffafb1ee224cf52c114ace14e5137e7bbf58ba03ce7dfa2868bcd024cc412c457491a114caf4d04d77cea4a9b3999d9c00
SSDEEP 49152:9QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THt:9QvGAdlCEL8c/pRNw5CQ03jHenRNjp
TLSH
T142266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 e40008da94f8ecd78f8b783c8ced0089b06d604ad2a7d227cd3921266ebe8572
MD5 5817f268640bdc8f29e90a1410ffb316
SHA1 c46cac39b091efc25e044ebd0a489f98dc4788c1
SHA512 498d4a97e9556b5cf2e4636a6f26179121b3e1ab011685142225489a7146e9c83a1dd8d469b024e6b1e21c6ac3f0330b7150fabb3d29a754cd837c7603e4e2c6
SSDEEP 24576:QwewsAjpjgfPqnGsgjj5B9xenRcJyjZP:plj9Ml3jZxenRNjp
TLSH
T12215E030FA74E036D6BB0DB61B26C716643D79604F521AC3E3E84E9E99342D22376B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7712d811fc23b03539c61fe7ad7c805ede67bec115131719ef7f0386c2706a3e
MD5 ca8cd10363d3af662df52d32910fc18b
SHA1 32e0936f371844963d65a173fc6b90d2cfb794ed
SHA512 c3c9eccfa74b254926c32aa5eb484d64aa6df9c89b069a4cf74212296213a1321a5920a6711c226b0cb02a11bea75ad60b81e6aa666aa59800e526974add29c5
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHFGAj:dUEtQevvqc2W1cpV29I32FGu
TLSH
T187474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f0ee97c729db3731843ff0763c11a6b40aa3bb468eb6cb2fa4866b37262c0e22
MD5 7ed189754930bdf7f2df4510a017850e
SHA1 73ce0cd457a38bb635b79c786ff60b177cc6475d
SHA512 c0902fbd15753b3925e2cb06c2daa17b6a3d0681d927abd0f5dcb6ad055428ca8ae2b2331325cf4ce0abed5fb71bf944406e0f04854ca5e984b2aa5818db4900
SSDEEP 49152:JCbRquA/m2yL5zQfFiV+XenmE3/zdMl3jZxenRNjp:GoqtVjnm003jHenRNjp
TLSH
T154D58D0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9e2d9a1444429a155528de0b15169456502c0ee8eebf3488342556f536701445
MD5 9390648ee2ab0595f82ebac1da9a2860
SHA1 f83cb3b6af352d5e48db0ab0a5254e376abb4518
SHA512 326923a5603bab71ca227c9b46f35e214d4954c3581f77294ba30724c201caf98e0917a7d360f609394f5b54cf633698a613151df457672df8cea68472a91629
SSDEEP 24576:eAhGLmIFoiwtA5l7S53kjgfPqnGsgjj5B9xenRcJyjZP:eAM1Foiq5kMl3jZxenRNjp
TLSH
T108359D80E7F955D4F5B3AAB899B68171EA76BCA95E31C20F2150D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 efdf113fe2cd69b9a1271175cec860ecc6259e78958bf32984636022a2ae8604
MD5 d970944e84c50ccdfe7eacb2f7927bcd
SHA1 8a1019de30cca50276a50f817885c92b3daa1168
SHA512 5553c07c597b607786267638e68b3c411dd144125d53f89cd507d6b38da3df3d6702006341c911be4fe7ae7f550d97c13d7164b2d5a12e8a344ef2e65f5214cf
SSDEEP 12288:Kmw5HEjsChNOBFgl0WDm+Chmjd0nfPD4LfnaYCsYq0msjcEB9DIkiEx8U8tvCA+C:DwuXOW1jgfPqnGsgjj5B9xenRcJyjZP
TLSH
T1A705F18973A818F9E96742398697C136F7B27C452A21CB1F07A0C7575F37261AD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 436a079ed77830be1d828c3908470bb12694ba08707d3c4151c3bbd913868ee1
MD5 df84f8f9de969f7ef8e7cb9d4f3c6ccd
SHA1 9392d007a956dfc7e566852901f217ee3fb769ee
SHA512 c16b37291017d6849736fe53afdb9eef540ce0faac98a3ea388bc5db9a3610bd0e0582ce0e695cc8a9001080b78301777ffecec958b0fca4c0f54f0c13babd7f
SSDEEP 12288:NbZ1Iy2mjd0nfPD4LfnaYCsYq0msjcEB9DIkiEx8U8tvCA+/mqyxlZvn:JZuejgfPqnGsgjj5B9xenRcJyjZP
TLSH
T1FDE4128963E820FAF1A7037D9AE58385E73138992B3283CF069407955F36ED55D3A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3cff63a50fd4d850235ab6b3eac8e40371d667b61bbeb81548220525b113a8a7
MD5 7e8b6129bd90ac6aa35ae0d49e076872
SHA1 4364bd385aa9e1fa27700973ca525f94c11b3de4
SHA512 4435ded0fa34fa115c9eeed1b621cb79fde2f3e5d4ec4fcbabf8cbd148637d7407d8553de0aadcce19b3129d0a772788f38bb8034f481a4437b097023258010a
SSDEEP 98304:+QRQyi36YOcPuLvw2gAf+PN3f03jHenRNjp:lQyiKakX+PNvGAj
TLSH
T196667C43F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b12a125c3143041d0edaba445378db0e55e8f6a6b9f46889f5cc8fe983ddfdc2
MD5 161e5e2780b7697961f517f9f7b02e6d
SHA1 62ae9240b7ec71aa64902b28a5a92417174a5322
SHA512 e0d112876ded8d4240dcffa68f440674c8658dc92564831af5519cefa44ba0929a251b0d4b089b16c51a4bb4b867506a57f80e9688bb861dfa5f6a7be3fd559d
SSDEEP 98304:fQRQyi36YOcPuLvw2gAf+PN3f03jHenRNjp:uQyiKakX+PNvGAj
TLSH
T16C667C43F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ab6ce9422a06ee65454d0e1d1764500e9b1e512f6e2443777cc27c6c6c3bbe8c
MD5 79bb3cb6bbfb2ec33cb6d9254b0ddfbd
SHA1 7e5fd044fc48c2e2235a9c9737c601681f095bc6
SHA512 743d7bbc00228bc4c861cb0dde31399d57401e3dca7a4e67e64878390166f570e51e70988abc66cc31e1a8ac568b1a17274db977d280e53427248047e8f9017b
SSDEEP 49152:d68Qg55nhxeWu7PNU3/NMl3jZxenRNjp:bthGRc/N03jHenRNjp
TLSH
T11EB55933B2F600A9C44DE1769F4A873196D27C758FE1E3DB854172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7f1eae099d9051a61c8b6e32253dd8d1768bdbf347a2ba328eb16f8612b5fb4b
MD5 9014f6f5318141ea7691fc4bb715145e
SHA1 ec2d8eb4375de2d3b67262d064948b46d11c44df
SHA512 22cbd3ba221f30e307b06aadb092baa717892e726eea38be0760e45e13d92be67e621be8eb71af0517c8326c1e6f7badb74ca0863f95f18cda958bd5764b7aed
SSDEEP 98304:Yy5112gYy5azzVvD69nLKnhZK03jHenRNjp:xLIH+WhcGAj
TLSH
T166167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 44caeedd0a73139ea20bd083c4af50674838b87dd75cbe8e734eeb408e864fb3
MD5 9bd4c1d0917a4494ee26356009cc4fcf
SHA1 61e5c397004bef69b91be991a25c88b120d18c88
SHA512 9f44d78cb973238ce9acaa97b170189b09bf59e727772f2872940a21445ce8cd4200019134e56f3511a62c5dc0032d2ab46f830062e406aa94f05d9a09cbcd2d
SSDEEP 49152:bB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl3Ml3jZxenRNjp:Nu6JmQxd2d303jHenRNjp
TLSH
T1ECD59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4722622ade4b4ec02791d4c63d69d8d9e56aa7ad16b88a9609828ecda1c6c41f
MD5 ef0f7ac6a64f8601210432b29a746fd7
SHA1 5a5fb47b68bda8ac614b46dba0ed94e48ce86a08
SHA512 84297ee1d21b3e848e88466721d86e9eafc14a2cefa44da20abc45fed1ea40072e894ae7695c1020d8458bf22b0b09528b0412785d34f45ad401b8bd95c3427b
SSDEEP 49152:41hpsNoJpF1A6yU44CwH7R4xbMl3jZxenRNjp:4mifPVR003jHenRNjp
TLSH
T1B1B5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A9077961F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e04523be0507c2c399312f82dacad5394e3200102bc5fe643c2299500fea84fb
MD5 50fca2862a057517be7a223ce9f9c557
SHA1 387006ede9e9d1cedffedc8c946ba9960c92f2ed
SHA512 a82ff80b4386fa751e2232b5f1d51e2961d6fefa5b2c381e96aa3f8a17a12b505d78efd29353edabdf3681851ca52cc24c611b1f7aa56e21471c0735adaa4664
SSDEEP 49152:1SuZQIY0Be2KIRVtOnks6NMHqWMl3jZxenRNjp:b5dKOi61W03jHenRNjp
TLSH
T133C5BE03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 93f4c8788506b841bc5d8d2efc0bfe4ab6ba7d1546997b41478414414b7dd193
MD5 c2d8ae219adc627f62d084e75eb7fac0
SHA1 fb54bb723d48d91606f94c73714b5808952f878d
SHA512 a9bb09f9ab79032958af2e1410ada74458cd8b219a6f646ba49fc15ac41b7eb233cb244ce8cb4acdc4e63938e380427f4256402f1d288cd3325661b3d76d6458
SSDEEP 49152:whtSn8EApI0figGgiDn0AP5wnMl3jZxenRNjp:hX2i/ph403jHenRNjp
TLSH
T18895BE13F2D900E8D06ED179C7468632EA62BC150B35AAEF0A9077561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 4e0feaa3bb6e47fb8c3491e28e4fc462b9a45f23cab192797c6658f8ce69e893
MD5 6b48bf987c2d5cab0ea2c2d6439c60c5
SHA1 bd7e818b21e7204232c5c87efaced837f8e037bd
SHA512 80b6a2b6e868b9c9d8044eca744d88c78617c4835959822a0a7dc5ff792ef712ed872c2a3b3a4f997b00e697f3cd7855e9e3e284a70d0e80640023682c5f6bc7
SSDEEP 12288:4Lmjd0nfPD4LfnaYCsYq0msjcEB9DIkiEx8U8tvCA+/mqyxlZvn:4CjgfPqnGsgjj5B9xenRcJyjZP
TLSH
T100C423C8D65850F7F56607B72BAA83E1E52C2CDC6F07868A17CD1A41C23C99D14BBB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 6ec7f88840c509bf14759a8f2cdfb287e6ec58556529eef6b1f00707158b5921
MD5 9957928c783d32a88f4cb4e998371ce9
SHA1 f87bd3bf8cf38fb3f37530f045cf173ef445e716
SHA512 7b0a4383624105eea72f2a833141578b8d97a9fa149b615ae05b0ee8adc6bcff576132accc3344934f4c8798d5a5fa26b1032474735884c23f6d8bf42171fbfa
SSDEEP 12288:Yymjd0nfPD4LfnaYCsYq0msjcEB9DIkiEx8U8tvCA+/mqyxlZvn:Y9jgfPqnGsgjj5B9xenRcJyjZP
TLSH
T160C423C8D65850F7F56607B72BAA83E1E52C2CDD6F03878A17CD1A41C23C9AD14BBB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 222705e5323ff058dac87e10fe85b03d391f8194f0f4665f6b02d2be333ce8e5
MD5 2d99499bb046a1d09a25f725fdd02ed7
SHA1 6fdf0b0f8680dbc4e2f401138331d51272742526
SHA512 421439ebc63c52967fb17f1bb07e25859ee286a2716e6b742fb5ec4f3cd059730da30f50a6f1ff49dc176a911afc1d5373bd4557051a0386e5a83720e2007172
SSDEEP 12288:1kmjd0nfPD4LfnaYCsYq0msjcEB9DIkiEx8U8tvCA+/mqyxlZvn:13jgfPqnGsgjj5B9xenRcJyjZP
TLSH
T137C423C8D65C50F7F56607B72BAA83E1E92C1CDD6F03868A17CD1A41C23C9AD14BBB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 8ab276f17dff41f2ed2aef450b134a73ca4ed98f2b1df876e80cf1f2597b2d49
MD5 7db4bbb0166320a9ad53c2a66ab9e06b
SHA1 b3e6fb8c9a5709fc507cd38de68ca02168fd4631
SHA512 405bab55cba310f71ac2351eba4bc2608b2ba7923b372fc11b3d2e3a77fdcaf9bcf9a199a0bd62ab866842e6a3c59254411b5a0a50631d9dda3f7afc9fbd4aa4
SSDEEP 12288:wVFmjd0nfPD4LfnaYCsYq0msjcEB9DIkiEx8U8tvCA+/mqyxlZvn:fjgfPqnGsgjj5B9xenRcJyjZP
TLSH
T183D42388979C40E6F47647769BA682E1F6393CDCAF23C78F07840E418A34AD85877F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 bbcfcd1038bb6cc248b83dfb419e006327641c0ca385045e77d7e7874514d978
MD5 ce8180e1ecc8aae3d6e237bdf94e8092
SHA1 3fbee2ca5a486b5f04441576191ff180c08bf797
SHA512 6f9043da336b618e12e8057d3ccb6117d06e2b41708adf2565150ea083f3225772c0efad2cce62efe79518f66851e296693dd9fd2cea2031c396f84b75edba7e
SSDEEP 12288:MNmjd0nfPD4LfnaYCsYq0msjcEB9DIkiEx8U8tvCA+/mqyxlZvn:MMjgfPqnGsgjj5B9xenRcJyjZP
TLSH
T133C423C8D55C50F7F56607B72BAA83E1E92C2CDD6F03868A17CD1A41C23C9AD14BBB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 2f4e6267e298614d102c3c14397c9ea94bec471a9b752aa63c7f8712941debea
MD5 6ebc65dae7498ff7e64f472807eb83f5
SHA1 ac690b6bcd95d48eef098dfa3c4c4899686c0ec8
SHA512 9fbd9acc9fbb55161fa13b0a2a675a028b75e43c6e16b63f77df5c1138dc3ac26174bf12e32a4fa2d4fa108c84a20f1c65ec36cfb31dde9ecfc01d146e26e2d4
SSDEEP 12288:T+mjd0nfPD4LfnaYCsYq0msjcEB9DIkiEx8U8tvCA+/mqyxlZvn:ThjgfPqnGsgjj5B9xenRcJyjZP
TLSH
T193C423C8D65C50F7F56607B72BAA83E1E52C2CDD6F03868A17CD1A41C2389AD14BBB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 a409b1f7b5df21258ea9b111c4d76284b669aae6ead1f4dee2b4c55ee61539fa
MD5 9786174ca336c78d60db60e5deadfd3d
SHA1 d989e7b107317919940ece7f0be7c2d035463800
SHA512 56280f569be94f68ee944c76f2bd7d1626eda55fa44566778edf2f7e4fe51df52d9b27e83591f6e92f66c32ba02431d1522b769e5eea27c7fd34ebc4dc5a845b
SSDEEP 12288:1amjd0nfPD4LfnaYCsYq0msjcEB9DIkiEx8U8tvCA+/mqyxlZvn:1ljgfPqnGsgjj5B9xenRcJyjZP
TLSH
T1EAC423C8D65850F7F56607B72BAA83E1E52C2CDC6F06878B17CD1A41C23C9AD14BBB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 2e6f4575b71c81c8af12e079e068459ff5040a2dd2c7467a41834b5f15b0a9e2
MD5 9092d567b099344371ca4b9ddcfc004b
SHA1 855cf07a1269c8ea751d0d155477831d90e776b5
SHA512 333ec3631197031e962ff01475a8d71d907ecd664c10e4005a16d049508d60e038aac22ce4da020217db8d7100dee607b14a82ed70c17438294553e39ab61ddb
SSDEEP 24576:lZMJzFVSOdjgfPqnGsgjj5B9xenRcJyjZP:lZMJzflMl3jZxenRNjp
TLSH
T196050194B39018F9EC67823EC9658956D6B23C590B60C64F03E836675F373A11C3EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 f6176f3ac98dd63fc3871f5aa9d24c7ccd6df52be89ad21c264bb360f203e52c
MD5 02641a997d4a2b5e84cd6dcf006b35f6
SHA1 b66dcf8698d72b3dd9abf5f922d221f0a8c19614
SHA512 6180ba8182693aca8272826def67320912e1217a530cbc9cc1eb068ba2d46e40b887fa47c7c70d4c8f6812fbaa88be9a6f9cfd61df8417a46f14d1d19bb0f3cd
SSDEEP 12288:Yvmjd0nfPD4LfnaYCsYq0msjcEB9DIkiEx8U8tvCA+/mqyxlZvn:YujgfPqnGsgjj5B9xenRcJyjZP
TLSH
T1E4C423C8D65850F7F56607B72BAA83E1E92C2CDD6F03868A17CD1A41C23C99D14BBB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 0cd4005a0f12060feb0ca3ec02eba1b339423a60f9559e47b41c48de67eeef02
MD5 c8875da7e24b301a9f839036b8db1ba9
SHA1 546fcce0f1431f13c97af41e7ead366b9f4c7e53
SHA512 aa9c335b1f14dcf2af0793bdaeabdf93e308426e27cdc6a42e61ba272e1ac4d9ae851bba65267f84684507868fbd1fcd4bd09e66350c656e6b96dcc6443841e4
SSDEEP 12288:jDmjd0nfPD4LfnaYCsYq0msjcEB9DIkiEx8U8tvCA+/mqyxlZvn:jajgfPqnGsgjj5B9xenRcJyjZP
TLSH
T14AC423C8D65850F7F56607B72BAA83E1E92C2CDC6F03878617CD1A41C23C9AD14BBB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 79f899d63f4e782279a855c620f332aec940d638a50863631691d90d6a119ed0
MD5 06aa0ea78de682e4a6158f3a09badf87
SHA1 338ff8f1f14743fcb5465f265fc03bad8bac0052
SHA512 1c39de4ae9195041ebc7e3660917388780af54b2270c55fd0732830f3b946e861f1d76efe71e77d99702eda0bab7b2125264e175de6b55d23f9cd37ba2b1feeb
SSDEEP 12288:/yPz5L82mjd0nfPD4LfnaYCsYq0msjcEB9DIkiEx8U8tvCA+/mqyxlZvn:yzy5jgfPqnGsgjj5B9xenRcJyjZP
TLSH
T1B0F4024BB3A530F9E176423989A24A52F73538790B218B9F13A40B725F376E45D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 6afc669172f1620c6577406173ac84a9fe2a046e9d9d3a359affc9ac8bd65ad6
MD5 b213225f06554395b259c5757d430852
SHA1 14c5c386ead1e2271d21451a5b1c0f7a3f145555
SHA512 efe9b90f9f2e166dc739709cb9a81fe941bcc5d22217b69ce6668556ee2e6c1ea010af7a631e9f28054fdfe8eb03771579fb594122d4edce8ca6d43df5ac3f38
SSDEEP 12288:Svmjd0nfPD4LfnaYCsYq0msjcEB9DIkiEx8U8tvCA+/mqyxlZvn:SujgfPqnGsgjj5B9xenRcJyjZP
TLSH
T148C423C8D65850F7F56607B72BAA83E1E92C2CDD6F03878A17CD1A41C23C99D14BBB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 be18a339541a63a9827f12bcc0d9271ba2354282984fc69d9c8fccdeaa0faed2
MD5 09f76456c5d4e21f518689170077c17e
SHA1 5793ba763a57528a38458705b0bd17961df2f414
SHA512 2693faa5a8c309a91e2880daa08a0ff5c6dbfb1193e483f4419a4d2f0609746cee290e11049b16a97ab77b3666ea1df45a5abbfef045cb39a965b8ff1f08cb60
SSDEEP 12288:hvmjd0nfPD4LfnaYCsYq0msjcEB9DIkiEx8U8tvCA+/mqyxlZvn:hujgfPqnGsgjj5B9xenRcJyjZP
TLSH
T171C423C8D65850F7F56607B72B9A83E1E92C2CDD6F03878A17CD1A41C23C9AD14BBB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 6d22a502501dd0e8e2553fd5dbe0a8c1c05eb23fef566137d8a6b012a39c8e65
MD5 464b046021e25c587fed5fdd2fdce020
SHA1 e45bfd34119c3b8426990ff841bcd19b04c0b924
SHA512 051592795081eff49ddc2b45133cd78d3c961fa5117876c22b14a812cce257c2721d13d147a43932e3c818abbf35e638c8b8dbb2caa5b2f8894d1c1c8686682c
SSDEEP 24576:1CUkpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvArjgfPqnGsgjj5B9xenRcJyjp:1CUMPTY+8Wg2lIL8lrIUJLWw8Ml3jZx+
TLSH
T1FC65AE1DA3DC0896D4BB81358A518A16FB32382E1B22D6CF1160C77D6F27ED95E39F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 8c88839bce3d1a4ce0f661131ad3c2b29d92fe886478024538aa3ad8afcb5759
MD5 749f1fc14fa0f2ee820a1a921ca7a778
SHA1 eb56dfd8c634e98dea060e1e28139f81043cd3e5
SHA512 d49fdd018d3076731a0a2c2b080f732c7c8bbfbf2b2556cade764f5413bb45dea89fc661ae58ffb86d7b554e294d50c52315ca2e19f7c8d658f87e9debed0ddd
SSDEEP 12288:Fksffmjd0nfPD4LfnaYCsYq0msjcEB9DIkiEx8U8tvCA+/mqyxlZvn:VejgfPqnGsgjj5B9xenRcJyjZP
TLSH
T1A7E4F049D29801E9D06E5276CB968681F3373C6997E2D3CB16C0F93E0F396945DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 f69b44551b543b09bf5bc57339dc673b989b1e3ffe0f477a6b1bcf8694c54b45
MD5 76251e7f9c840efcdc8bfec7e0489597
SHA1 1b6af9bd7ec889eebf9685e1cfce5372bb1cc782
SHA512 1e97311cdbb5d18bf446d5c75875fe48d92b553ba93eadbbaf21252520ace569533d02525caea40f58ef8c9996fabc21f55ee053cad9ee8471dd11103b497901
SSDEEP 12288:6Emjd0nfPD4LfnaYCsYq0msjcEB9DIkiEx8U8tvCA+/mqyxlZvn:6XjgfPqnGsgjj5B9xenRcJyjZP
TLSH
T1C6D42384C35C90E6F5BA077227AEC2B1B52D3CEC5F02CAC766891A8191389D95CB7B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 2e5dd9ee2f38eb634dbf666c04ab832562547f731b8b904bc6dce342d2d216c7
MD5 4897d24854cb7f4e3d390c60eb617336
SHA1 273a2ba1d78f3f1143ecf80d3a0338b57f9651a3
SHA512 40e9512c8195aadbe4e192091cf201e0e95f5872e23353d48d2e2573676fee4ff90ecd4d09cd0e286b654518f6592ca1c4218c6be1ba0414e45608cc527df5fe
SSDEEP 24576:Z8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCJjgfPqnGsgjj5B9xenRcJyjZP:GRZwQCyiHiQEaaPnM+Ml3jZxenRNjp
TLSH
T19F85AF1E62DC42A5E0BAD278CDA74407E6B23816573197CF1291C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 8414e83a31940d27523923727f5fb8e6371121ae2ed17905eaa5f70514e289fe
MD5 a9b918bc37fbaa48b6e51f5b924ed367
SHA1 ea15766957b7c14241d513f3c0b6691ffd8ac316
SHA512 af5f909f6d9939dcf14d184453c43b889ec2ee0d55b3807b2c9c3dc5990eb6ef2674eeb9b3c889a16f1518c8967828d26b7dd7cfa566e2e4f189ff2c10547162
SSDEEP 12288:LbxA1U7KUmjd0nfPD4LfnaYCsYq0msjcEB9DIkiEx8U8tvCA+/mqyxlZvn:LbxA1UGnjgfPqnGsgjj5B9xenRcJyjZP
TLSH
T14DE4126D92AC20F5F176963E9AD68246D3313C692B21C7CF11C5427A4F3AEE85C36F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 b3bda39ac6bc35ad7357f73ff1ea777d98a007eec7db4665df554ce9d399dbc6
MD5 a26ed02bef7fecd4137d5bf2921c5998
SHA1 38f1f42b0823f5e417a596f1a42d93152e2d0fe0
SHA512 936db101d07ca2dcf78c1445e7cd7b0d5804243ec63832bb034890b73cb5956af4f535d66b8baa21a58cdc6d27bfe295ca6ce5c7277f1b96e89d07192dcb6c38
SSDEEP 24576:MjsmP0yHaqrVqHra44KDzMsrnUjgfPqnGsgjj5B9xenRcJyjZP:MjRP0yHfVqzlAsrnkMl3jZxenRNjp
TLSH
T1A545AF2EF2B910F9D4AAD236454107B5FB71782D1F219AC70170C634AF0AEE89E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 d01d51febed20f04109112e902b6feb7279d6c04b79feb6d6e51e58b9651f214
MD5 0d905c6fb2e1231d3560bb4775c3e968
SHA1 38fa8cc4b2747e0ffc8d226479345ef8649477e7
SHA512 6ae1d06392f09ca83e1247f95c05ca5e6ea6bd98a0f5353d41b729eeafa3fc23ead5b6e631c71896b7a9759cd6149ec294de89accf9e4cbda60a22f2b66739a0
SSDEEP 12288:jemjd0nfPD4LfnaYCsYq0msjcEB9DIkiEx8U8tvCA+/mqyxlZvn:jBjgfPqnGsgjj5B9xenRcJyjZP
TLSH
T1B9D423C8D24C50E6F5760BB72B9A83E1B5282DDC5F138BC716C92A41C23C9ED54B7B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 e2d0f9253f5722cd1fb3c3727015232e1391da52fca8d0bc8eedb4bbae621961
MD5 593b14c6158a11138d5075f500a08f18
SHA1 35e38e3b0a21df172a773a3614eb259e724ff53a
SHA512 aeb0d21c2645c5c23595a27249723356992aeb8285a5ded4f81428c5251e6eb90ed16781cf9b7fd49ebb5fe0285fd3c5426b7fdf9bb477cdd0e8c5ba2cc371ed
SSDEEP 12288:LObZA4LWO+vAYFTImjd0nfPD4LfnaYCsYq0msjcEB9DIkiEx8U8tvCA+/mqyxlZP:UtLBUTDjgfPqnGsgjj5B9xenRcJyjZP
TLSH
T1E9250154E7A400F9E97B823DC9A68612E272789D0724E7DF03A84F651F237E54E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 e9f48a8a6925aae01073e7e8467e5becd3e5ae80d320aea1f13b08ef24e43670
MD5 8744a98a8d922ff3f14bda46305c9acb
SHA1 61a5a89f14b56eaba0325dc537cd73c8ee2e711e
SHA512 7b34cec89d29c50cc4746d060d78b3c2833b5fa7c803e434b4d41a71282f676f37d105f34b444e541f84507caaed19ac21bc76e9edb537b30d28196b9d9b1482
SSDEEP 12288:470Vm6IYNvUyBp7mjd0nfPD4LfnaYCsYq0msjcEB9DIkiEx8U8tvCA+/mqyxlZvn:1WYNHwjgfPqnGsgjj5B9xenRcJyjZP
TLSH
T13205F21E92AD18E5E57B917E8AC38255F27278A6171193CF05F0827A0F27EE87C3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d42f58dc998c075ab05ee73b14a029c02a023e70ce9ab8ddbfbf57af33220e86
MD5 74bc0a8504f21035dc615a73c0ce11a2
SHA1 2f951698e5633f86d37c1f3ca64ad73d6a212b6a
SHA512 c5d862edd46ef21f3da9c950f30364981e8f88bd38be51c2a6f78fe9a9a6632e3308f382b4dbd8e8eba93e5452942cb9a13b836f2ce1f49f913765bca06e7eb6
SSDEEP 24576:ZnXoJjNYH84VVSNAApoEOS66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKL:ZnXoJJYH84VVS6AmEvJas+cHBjSSKHPb
TLSH
T1C165BFADA2BC04E8D5BBD17DC5C24506F5B138661331CACF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 26324f756eac0d54d89373a9046fbbb4f3a2fbc506692cc7347822051f5039e7
MD5 cbc662c7b9ad5d9c3e6265883f3e2d93
SHA1 6456a0c5c836e1347c0370bde70040c1b0e0f858
SHA512 716082e3801ef8b765bea1247c17b0eb2b141eb6b54f3b67059ba42aa6dee02cf3d50b91d83b3d8e365a9d9de8e88e412a0896d924daa0747aa0a3d425afcca2
SSDEEP 24576:hv7Xbxd9Tuycf8M/TYlSuxwr2PCqjgfPqnGsgjj5B9xenRcJyjZP:hDLL9TuJ0M/TYW2P1Ml3jZxenRNjp
TLSH
T10E858D5EA3EC42D8E07BD6BD85B79146FAB2B855173081CF0291856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 a10173c037c8bb2c292cc34dbdad161025ada3b69777580a0940ea45361b1cb5
MD5 2b301abedff9ff35d065a83e2fb9a11f
SHA1 2d8c3de1eb60a6c72c56db35dfa1c39c66660cda
SHA512 6909839cf40d58bfd65834393d9bd0be8e3140894efaffa6f0b0ac5698b72d5137f4f6e588342409d5e754a1986a72ad77feba78787d9e6e604bd5ff1741fc78
SSDEEP 24576:BegJgpwJOmPOHWAKJ8ZguIGyPsxr5Vin10wDjgfPqnGsgjj5B9xenRcJyjZP:BngOJOmPOHEnMl3jZxenRNjp
TLSH
T1E055C03FA7BC15D5E03EC17D8A978916F6B1382613255ACF0550827E5F2BEE42E3AB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 bf833ff22ccbed9700730aea42acb9c075f10d4036ba587b9f60cac1c41741b7
MD5 aaf8f072c11e2edddd06be872d762252
SHA1 1cf7d9255a9f57162abc4710e5cc5f7c165a92c7
SHA512 63bbb61247f1ae34af773e4322b581f1b0187551f14f3c259d71f7fccf25aa2c75484c7f79ad8c39c0314cb33870b6bb6199f2836c290bef499639c9118ea08e
SSDEEP 24576:wLJnJiTk3R3waE4JrOhjgfPqnGsgjj5B9xenRcJyjZP:wLJnJK8R304l0Ml3jZxenRNjp
TLSH
T1A315D06CD2A810E8E4B7C2B4825A5796FF31346C2F2169CB19B4D5313F12FE0A979F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 ecfc8db7d53b35021ca2963e7001edb3c22bbe921e126e22c991ff4e969c3ae5
MD5 d71d8c02a2ad3ce2f8dab0ae1a451d4b
SHA1 f8075c176a4676d19be532d4ae151a2e5f306174
SHA512 79b8a1d08395ae95d40bab8e891891ffe9e643907d808e2771f32ad658344acaf3e48672f2141cf2f53deb3275b1242e926a8b72156b7ce227f493d13c7dea5a
SSDEEP 49152:u9GqCzDScAZmlvTcFg8Ph6BMl3jZxenRNjp:gI03jHenRNjp
TLSH
T195955C05F7EB5298E8B3CAF1C96694159B327C409B34F7DF0A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 1253d3affdd1e10e952a99d4fa7f6e48f49c07b9e88a1a0abab852ef9972e48b
MD5 e6ce0b3b7b826ea886640eef91f63e00
SHA1 3cced4a438f7e70ecda7773659a1f4021f922be3
SHA512 d5f86661fa6ddd13392b75d98e2d6a3ae329e116e7687e65f47c870b0ca03e02c2c633c01bfa4b5f63a57a255307630c3753e8f0d9b40bfc3a092e49c9acc760
SSDEEP 12288:/lYJeXm5nkEUuEYmjd0nfPD4LfnaYCsYq0msjcEB9DIkiEx8U8tvCA+/mqyxlZvn:/lYJeXm5jUuETjgfPqnGsgjj5B9xenRf
TLSH
T1EBE4129C669C30F5F13E417A96E68694E33174B8170297EF02E086768F3ADE91D3AF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 3a5f12403c9b22760d2ee2295234eb65f39b024bfd7d395db0dc838fd127add0
MD5 7ceb68b1de57b6ecc3e588137a80293a
SHA1 196682f9b8455f146d34c6db7769ad840d609ccd
SHA512 6f6bb534efa591cebbcdabe2e7ba2509aeef308b4ff99665e9546c720cb711cb684dccb5d9608645eaf213b789562a7727b9695b1de989c994ee5b027c4ad387
SSDEEP 12288:cwu6ky1mjd0nfPD4LfnaYCsYq0msjcEB9DIkiEx8U8tvCA+/mqyxlZvn:cVty0jgfPqnGsgjj5B9xenRcJyjZP
TLSH
T1B4F41244A39860E5F5BA07799BA382E0EE383C645F1187CF11D0AB3F5A35BD46876F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 c80e2cd8a0c5c6b6e437acc255bd4bbf1b0ed111319722abb4b5919b5261a4f9
MD5 352507d54c08abdd2159ab327f70069f
SHA1 81a8569e72b613e887fb92b736b3cfe99ecad4cc
SHA512 eb49427b38653926eb1f8ab599d6b6b97c18bf388c5c1b9f7e83ac239cee0aceea414a9f6cc867ca7e9ce81b8c753d268701f7ba2193d84ce393c93285ad42da
SSDEEP 12288:QPImjd0nfPD4LfnaYCsYq0msjcEB9DIkiEx8U8tvCA+/mqyxlZvn:QDjgfPqnGsgjj5B9xenRcJyjZP
TLSH
T1E4D423CC825860F6F966077627AA83E1A5383CFC6F128ACF16D81A71C63C9D95477F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 0e7b5a99645745206f57efea8e8caa783c4826b69c29020e5838ec1ca8d4135b
MD5 a35a56c7afb4f44d91eea3e6b8a055b4
SHA1 6da59150d071082ff18d87415d2f318fafc9876d
SHA512 bcda696bf696e00e3ff2aa2fd4787ad2289be6ef592911aba255ce7702788d6bf5433119c12fe0fab3a8e751f57e0b6de5efb62e259e6be3f0fb02266dedc4d1
SSDEEP 24576:6C+TyQIu93VAumZr7jm+jgfPqnGsgjj5B9xenRcJyjZP:6/TfIq+Y2Ml3jZxenRNjp
TLSH
T1C7558D1DA7E919CAE276C675C9A34493EA337872137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 d8481b27f0a80cbfcc8ce8c05e6c8aca9d9670ca40f51ae74cfbcd225bb7a07a
MD5 70f1ad3d7e6452e37e400687c84ee5e2
SHA1 1ea69659961919228c2b4034aa74a83e356391b6
SHA512 4c920b5843f55a78f3923b05b0f45b0a3425e1b02069a9e530e895e78e023313fb0839b96b0c3254619d9f0da5677dcc4cbd04715e2ebd90bf866daf5001f175
SSDEEP 12288:3cyrWOstaa3kcs8mjd0nfPD4LfnaYCsYq0msjcEB9DIkiEx8U8tvCA+/mqyxlZvn:OLQikZPjgfPqnGsgjj5B9xenRcJyjZP
TLSH
T144F4F14EB3AE10E6E0A7823C89868252F67334745712A7DF02D0C7794B7B5E97D39B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 ece1f4d51ade8a38a6a1c631d9166a31b85907b4e3801637bdb8d4133a9e9d55
MD5 2296e5a66a11f624afb66492b609e6bd
SHA1 563ada9c3ca75dd60701988a46c1b98145a8a95c
SHA512 e7100c4b22ba45ba0b9051ee0ad7ec484157d5824ef107e77339e6ef53c87b2008ab1f8119a18d68261993cea851d119b9f680e77f98482dd306b6f595fb14d9
SSDEEP 49152:BpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPEMl3jZxend:SpC7b4+80GTkJ03jHenRNjp
TLSH
T17FA57C3DE2B810ADD8AAC375C5461665EE71382E3F2055DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 18d02d9f9ad808210c7d775b99a392186c6f7d3ee666a74216ab0755cf71a653
MD5 fc0059cc27342fd72d731e764f4c5209
SHA1 a5af17e5a864088cf2a29a9c2e62384ba8b24a4f
SHA512 784970a06854a6543dfc3ad1599afe9356c1c73494dc84a83e3493db3f1859ad4e0b3a0263a934992e086606cd8445b3d8fe27194f315e7d7a2bda8de530def3
SSDEEP 24576:/SAwJPE1IDAo+4Kt+l4413kUQsjgfPqnGsgjj5B9xenRcJyjZP:/qPCIo4Kol4WQcMl3jZxenRNjp
TLSH
T1FF55B019A7F956F5E17ACBB4D663C611FB723822133163CF4290813E0E269E85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 956KB
SHA256 a7190809f9bf6504499cbd183f380f51c7dc78600f51200a43dc0d6cc2097ab8
MD5 884abdfbda74ff60ce3b55f9f76fe747
SHA1 32b9d4c6c12cafe123991c70cd60ed6a00980111
SHA512 1383a936a527f2d1a4f505313f95dee0c8704cd29070a7c5f14a683bd313e118c6b47cf362d80c01ba269c9087a9353e8e9727c19fddce787806e3322f17e7e4
SSDEEP 24576:fyLXPLcq94t8jgfPqnGsgjj5B9xenRcJyjZP:fy7PodtMMl3jZxenRNjp
TLSH
T10325E03ED66C04F5E47AC27DD6A38506F67238AD0331A6CB09E495751F2BEE4693AF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 744KB
SHA256 4585b6ce4b09a0b1418dc636cb752d65eba7f00cb7c447bcce80aec53e1db5e5
MD5 5a193ea67c8acfaa7a80366612967c6b
SHA1 e9eed1aa76162672d40c076674b5d339add0db17
SHA512 2cb747552c9542084d002ede89ebfbf5d604ee6edb8c6697b2e02a5e47870c38f196f6a0effb3ac0b28edfeb1e9a4b8d295334f6e2168b978138393c90392e85
SSDEEP 12288:I9lyvj3IkxjbBzsmjd0nfPD4LfnaYCsYq0msjcEB9DIkiEx8U8tvCA+/mqyxlZvn:IWv8qjp/jgfPqnGsgjj5B9xenRcJyjZP
TLSH
T14FF4138D92D820E9F07A0374E676C2A5D0753CB91B259AEF31C899778738AD4943FF12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/572-90-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/572-73-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/572-79-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1204-517-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1204-165-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1316-160-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/1316-94-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/1316-84-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1316-91-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1832-127-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1832-130-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1832-121-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1832-312-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1992-111-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2372-157-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2372-369-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2488-145-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2488-135-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/2488-142-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/3296-104-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3296-21-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3296-15-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3296-24-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3352-37-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3352-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3352-129-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3352-31-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3424-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3424-49-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3424-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3424-43-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3440-69-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/3440-150-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/3564-171-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3564-177-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3564-180-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3564-205-0x0000000001F60000-0x0000000001F70000-memory.dmp

Download

memory/3564-189-0x0000000001CB0000-0x0000000001CC0000-memory.dmp

Download

memory/3564-221-0x000000000A5A0000-0x000000000A5A8000-memory.dmp

Download

memory/3564-386-0x000000000BE10000-0x000000000BE18000-memory.dmp

Download

memory/3564-520-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4560-388-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-393-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-372-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-370-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-382-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-392-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-403-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-402-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-381-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-401-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-400-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-399-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-407-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-410-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-409-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-408-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-406-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-405-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-398-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-397-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-396-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-395-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-394-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-383-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-391-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-390-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-389-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-374-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-380-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-384-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-379-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-375-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-371-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-373-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-385-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-378-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-377-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4560-376-0x000001FEEE5B0000-0x000001FEEE5C0000-memory.dmp

Download

memory/4676-115-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4676-518-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4676-179-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4700-118-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/4700-231-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/4948-93-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4948-11-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5088-29-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5088-42-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5612-102-0x0000000000830000-0x0000000000897000-memory.dmp

Download

memory/5612-97-0x0000000000830000-0x0000000000897000-memory.dmp

Download

memory/5612-164-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5612-106-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5636-404-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5636-161-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5720-153-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5720-152-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5776-67-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5776-65-0x0000000001640000-0x00000000016A0000-memory.dmp

Download

memory/5776-63-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5776-54-0x0000000001640000-0x00000000016A0000-memory.dmp

Download

memory/5776-60-0x0000000001640000-0x00000000016A0000-memory.dmp

Download

memory/5800-147-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/5800-368-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/5828-83-0x0000000000400000-0x0000000000E02000-memory.dmp

Download

memory/5828-0-0x00000000014E0000-0x0000000001547000-memory.dmp

Download

memory/5828-8-0x0000000000400000-0x0000000000E02000-memory.dmp

Download

memory/5828-5-0x00000000014E0000-0x0000000001547000-memory.dmp

Download

memory/5956-519-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/5956-168-0x0000000140000000-0x00000001400C2000-memory.dmp

Download