Overview

overview

9

Static

static

3

2026-07-04...ry.exe

windows10-2004-x64

9

2026-07-04...ry.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    60s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/07/2026, 22:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-04_470714d7ad7d59cfe642aefede3924a1_elex_wannacry.exe
  • Size 1.5MB
  • Sample260704-1wvffsew21
  • SHA256 5dd3b9e1682561a05420d22c70700961de9746bb0d91eb0d66366cdcce6cb63d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwarecredential_accessdiscoverypersistencespywarestealer

Malware Config

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Executes dropped EXE 14 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 51 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 35 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 49 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Connections Discovery 1 TTPs 1 IoCs

    Attempt to get a listing of network connections.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Discovers systems in the same network 1 TTPs 1 IoCs
    discovery
  • Gathers network information 2 TTPs 3 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 39 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-04_470714d7ad7d59cfe642aefede3924a1_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-04_470714d7ad7d59cfe642aefede3924a1_elex_wannacry.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5984
    • C:\Users\Admin\AppData\Local\Temp\2026-07-04_470714d7ad7d59cfe642aefede3924a1_elex_wannacry.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-04_470714d7ad7d59cfe642aefede3924a1_elex_wannacry.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2176
      • C:\ProgramData\Application Data\wmimgmt.exe
        "C:\ProgramData\Application Data\wmimgmt.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1324
        • C:\ProgramData\Application Data\wmimgmt.exe
          "C:\ProgramData\Application Data\wmimgmt.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5964
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /v:on /c "C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\ghi.bat"
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1604
            • C:\Windows\SysWOW64\findstr.exe
              findstr /s "YM.CGP_" "C:\Users\Admin"\..\*.txt
              6⤵
              • System Location Discovery: System Language Discovery
              PID:6084
            • C:\Windows\SysWOW64\chcp.com
              chcp
              6⤵
              • System Location Discovery: System Language Discovery
              PID:5328
            • C:\Windows\SysWOW64\net.exe
              net user
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5536
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 user
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5672
            • C:\Windows\SysWOW64\net.exe
              net localgroup administrators
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4312
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 localgroup administrators
                7⤵
                • System Location Discovery: System Language Discovery
                PID:6092
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist
              6⤵
              • Enumerates processes with tasklist
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:3060
            • C:\Windows\SysWOW64\systeminfo.exe
              systeminfo
              6⤵
              • System Location Discovery: System Language Discovery
              • Gathers system information
              PID:3404
            • C:\Windows\SysWOW64\reg.exe
              reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:5676
            • C:\Windows\SysWOW64\find.exe
              find "REG_"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:6136
            • C:\Windows\SysWOW64\reg.exe
              reg query HKEY_CURRENT_USER\Software\Microsoft\Office
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2292
            • C:\Windows\SysWOW64\reg.exe
              reg query HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Common\UserInfo
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3676
            • C:\Windows\SysWOW64\reg.exe
              reg query HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Common\UserInfo
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2932
            • C:\Windows\SysWOW64\reg.exe
              reg query HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Common\UserInfo
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2508
            • C:\Windows\SysWOW64\reg.exe
              reg query HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Common\UserInfo
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3016
            • C:\Windows\SysWOW64\reg.exe
              reg query HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\UserInfo
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3256
            • C:\Windows\SysWOW64\reg.exe
              reg query HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Common\UserInfo
              6⤵
              • System Location Discovery: System Language Discovery
              PID:552
            • C:\Windows\SysWOW64\ipconfig.exe
              ipconfig /all
              6⤵
              • System Location Discovery: System Language Discovery
              • Gathers network information
              PID:5748
            • C:\Windows\SysWOW64\NETSTAT.EXE
              netstat -ano
              6⤵
              • System Location Discovery: System Language Discovery
              • System Network Connections Discovery
              • Gathers network information
              • Suspicious use of AdjustPrivilegeToken
              PID:4684
            • C:\Windows\SysWOW64\ARP.EXE
              arp -a
              6⤵
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:2320
            • C:\Windows\SysWOW64\NETSTAT.EXE
              netstat -r
              6⤵
              • System Location Discovery: System Language Discovery
              • Gathers network information
              • Suspicious use of WriteProcessMemory
              PID:2592
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5008
                • C:\Windows\SysWOW64\ROUTE.EXE
                  C:\Windows\system32\route.exe print
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:3388
            • C:\Windows\SysWOW64\net.exe
              net start
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2756
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 start
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5124
            • C:\Windows\SysWOW64\net.exe
              net use
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4272
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo n"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4764
            • C:\Windows\SysWOW64\net.exe
              net share
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5600
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 share
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2208
            • C:\Windows\SysWOW64\net.exe
              net view /domain
              6⤵
              • System Location Discovery: System Language Discovery
              • Discovers systems in the same network
              PID:1344
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\s.log "
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1120
            • C:\Windows\SysWOW64\find.exe
              find /i /v "------"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2240
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\t.log "
              6⤵
              • System Location Discovery: System Language Discovery
              PID:5496
            • C:\Windows\SysWOW64\find.exe
              find /i /v "domain"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:6040
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\s.log "
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4484
            • C:\Windows\SysWOW64\find.exe
              find /i /v "¬A╛╣"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3000
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\t.log "
              6⤵
              • System Location Discovery: System Language Discovery
              PID:752
            • C:\Windows\SysWOW64\find.exe
              find /i /v "░⌡ªµª¿"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4708
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\s.log "
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4076
            • C:\Windows\SysWOW64\find.exe
              find /i /v "├ⁿ┴ε"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3296
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\t.log "
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2456
            • C:\Windows\SysWOW64\find.exe
              find /i /v "completed successfully"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2064
  • C:\ProgramData\Application Data\wmimgmt.exe
    "C:\ProgramData\Application Data\wmimgmt.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5788
    • C:\ProgramData\Application Data\wmimgmt.exe
      "C:\ProgramData\Application Data\wmimgmt.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1504
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1100
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    PID:3728
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:108
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    PID:5916
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:4572
  • C:\Windows\System32\ReFsDedupSvc.exe
    C:\Windows\System32\ReFsDedupSvc.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:3524
  • C:\Windows\System32\SensorDataService.exe
    C:\Windows\System32\SensorDataService.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Checks SCSI registry key(s)
    PID:3092
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:5136
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4944
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1284
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
      2⤵
      • Modifies data under HKEY_USERS
      PID:1920
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3704578903-1610922810-1098216751-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3704578903-1610922810-1098216751-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
      2⤵
        PID:5756
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
          PID:5844
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
          2⤵
            PID:4308
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2044
          • C:\Windows\explorer.exe
            explorer.exe /LOADSAVEDWINDOWS
            2⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:3456
        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:1040
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:5444

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              Persistence

              Account Manipulation

              1
              T1098

              Boot or Logon Autostart Execution

              2
              T1547

              Active Setup

              1
              T1547.014

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Privilege Escalation

              Account Manipulation

              1
              T1098

              Boot or Logon Autostart Execution

              2
              T1547

              Active Setup

              1
              T1547.014

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Defense Evasion

              Modify Registry

              3
              T1112

              Credential Access

              Credentials from Password Stores

              2
              T1555

              Credentials from Web Browsers

              1
              T1555.003

              Windows Credential Manager

              1
              T1555.004

              Unsecured Credentials

              1
              T1552

              Credentials In Files

              1
              T1552.001

              Discovery

              Browser Information Discovery

              1
              T1217

              Network Service Discovery

              1
              T1046

              Network Share Discovery

              1
              T1135

              Peripheral Device Discovery

              2
              T1120

              Permission Groups Discovery

              1
              T1069

              Local Groups

              1
              T1069.001

              Process Discovery

              1
              T1057

              Query Registry

              3
              T1012

              Remote System Discovery

              1
              T1018

              System Information Discovery

              5
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              System Network Connections Discovery

              1
              T1049

              Lateral Movement

              Collection

              Data from Local System

              1
              T1005

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              elevation_service.exe
              • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
              • Size 2.7MB
              • SHA256 db1ed930698c914081d2b6d8acccd2fe9eb70f46724b0b62ccfac5d6bd034117
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              maintenanceservice.exe
              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
              • Size 1.4MB
              • SHA256 924640bee136035998c758b6150923661b9029e3ccccf34a3f1569d5ce19dbee
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7z.exe
              • Path C:\Program Files\7-Zip\7z.exe
              • Size 1.7MB
              • SHA256 d34cfbeeb82f4bd6b4265f9b96bce4fbbcb4a79d73b7b7ef352c40fd35f76877
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zFM.exe
              • Path C:\Program Files\7-Zip\7zFM.exe
              • Size 1.5MB
              • SHA256 b9e026bfd7e5982f00a5525465862c6f18552def5a2b8a7533d2b63ed5819a73
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zG.exe
              • Path C:\Program Files\7-Zip\7zG.exe
              • Size 1.2MB
              • SHA256 3acd37dad71f55118862a22d7ecb60da5ec8ab192f93b2f5f52d594577a6129b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Uninstall.exe
              • Path C:\Program Files\7-Zip\Uninstall.exe
              • Size 1.2MB
              • SHA256 60250c0f269fd1c7bfbb7f851678ac6d17f4281c2be92bd21556457eea6c5925
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVShNotify.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
              • Size 1.4MB
              • SHA256 9179d9acedac1c2d1009eeb4030c022082afe8269f3796fe288f39c189183a0e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IntegratedOffice.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
              • Size 4.6MB
              • SHA256 503d07dc526c6a80e040579f79707baae5bee4c9eb9ea6804700dac1b6ba01e6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MavInject32.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
              • Size 1.5MB
              • SHA256 849468367b691be28f3fbe9cedefc348af19a57ffe17886644eb28b2f14c79d5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OfficeC2RClient.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
              • Size 24.0MB
              • SHA256 84ada1eb7bcd849ee609e4771545b97e704f9a087f47981dc53e2b6473ba9850
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appvcleaner.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
              • Size 2.7MB
              • SHA256 afe9cb1927906408541f36340b437fee2b1288dc6c76483b353b74fd862a0f2e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              LICLUA.EXE
              • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
              • Size 1.1MB
              • SHA256 02886e20b8bfddb31cd58b9b4aa6ed276025d3679248f2f87e8ee564249e5be1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OSE.EXE
              • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
              • Size 1.4MB
              • SHA256 07e7a86b26c487d608eb2b128687976a0622435c01b0b5b4702346fc9860b6cf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSTOInstaller.exe
              • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
              • Size 1.3MB
              • SHA256 f0f64fc8c5d7751573e1ee7d18b5a23efcd3a5fec2d5b4d02742619dd642c14b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrmstp.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
              • Size 6.6MB
              • SHA256 d11cd6d0a71c542e2d0d4649843265313a3a90afd118ef09ca8cc0dbd7ee3a98
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              setup.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
              • Size 6.6MB
              • SHA256 a87a6586ea260ab0a03d3ba71c08f76db67cbb3a59166101135acf4c1bd4baee
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_pwa_launcher.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
              • Size 2.3MB
              • SHA256 c3907dd6ea4c35314452e3c252e69a32756579da92ebca862ba43b9c22671edf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevated_tracing_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
              • Size 4.0MB
              • SHA256 b13334199e6e1bce34e4312a493456ec05531f79b588bc90ff830a597ea03c8b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              • Size 2.8MB
              • SHA256 b7695bf7cbc4afda86f153799eae3af8fa99938b2b07d773b9c8b7ff8fd35389
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              notification_helper.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
              • Size 2.2MB
              • SHA256 0e12a958988dbd879b3fecb271c02237d21ab74d9ef45b37e106cc4ddfe6c91e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              os_update_handler.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
              • Size 2.4MB
              • SHA256 a7471c7fe33fde239a58767e62c70fa31d75e920ff393a233345c40ffeff1e0f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_proxy.exe
              • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
              • Size 2.0MB
              • SHA256 23c22f4752325abe3e828d34c50f8427465a7ba385e54604b031f6048a6721a2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appletviewer.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
              • Size 1.2MB
              • SHA256 566facff544b9740f684639b10ba66a1ac594166ba82913900e06d736b990cec
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              extcheck.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
              • Size 1.2MB
              • SHA256 4e4deaca8f31a5c40d6fe6baad951ceb3e211a819d96ebf50a17b07d90ff5af7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              idlj.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
              • Size 1.2MB
              • SHA256 688688617bb183092acf9456ca59e6b2251273bc56fcb3afc9825c124b28a969
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jabswitch.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
              • Size 1.2MB
              • SHA256 535ff8901be48879a4337a003a868a0aec1d9ac1edb9ffb3b1c0fa02443560cb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jar.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
              • Size 1.2MB
              • SHA256 11ddef02b0d365bb0cf3c7647be990b3cc57a4d55b653d34b5d4a87724f7f9dc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jarsigner.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
              • Size 1.2MB
              • SHA256 e3c5414ce378c426620c9cae942c13a4fe69f24a668cc03fc505a97e84bef6cb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              java-rmi.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
              • Size 1.2MB
              • SHA256 77b5ebdde0999a3e27a71e25b6c6c9408e7cb3fff7f15e248316d3cecbc6ca7b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              java.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
              • Size 1.4MB
              • SHA256 e2baffb1c4b7548d011b0b36642a69fd250ba544278358baf205c736d014b6c6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dotnet.exe
              • Path C:\Program Files\dotnet\dotnet.exe
              • Size 1.3MB
              • SHA256 0d8c61726a3bae5301616b2aef2968d377da1204502d89359f28ff67b8ec4c94
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wmimgmt.exe
              • Path C:\ProgramData\wmimgmt.exe
              • Size 1.5MB
              • SHA256 5dd3b9e1682561a05420d22c70700961de9746bb0d91eb0d66366cdcce6cb63d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              INFO.TXT
              • Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\INFO.TXT
              • Size 34.2MB
              • SHA256 c298da8eba68650163680867f9d444f06d194580f13ab5e99a6ead4318803d36
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              INFO.TXT
              • Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\INFO.TXT
              • Size 12KB
              • SHA256 bd4ab2305a2987481314b0a0e4bb68d3c781b1e72cc6a820dad9b6e7adb448c9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              drivers.p
              • Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\drivers.p
              • Size 15B
              • SHA256 d8a21e76d208e48198b4afa4a54157044255e074acd5c25f99d9894ad70fbde2
              • MD5 SHA1 SHA512
              Submit Download

              ghi.bat
              • Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\ghi.bat
              • Size 3KB
              • SHA256 1ebd7eae014cf21830a64f251bf768e2935fa3de5223dcb86f3e69dc88c384c8
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              INFO.TXT
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\INFO.TXT
              • Size 43B
              • SHA256 a0a507233d6f7fd8aa380b51a3422ddd52adef52b904a6a105f7c8b65b554afe
              • MD5 SHA1 SHA512
              Submit Download

              prep_Activatable Class_Hermes_perf.cache
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
              • Size 595B
              • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              971d06f9118c7e83.bin
              • Path C:\Users\Admin\AppData\Roaming\971d06f9118c7e83.bin
              • Size 12KB
              • SHA256 2bc80575cfa4772d5678a8617342d3451095c89c1c3631442e1a979abfce655d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              15450D2B.db
              • Path C:\Users\Public\Documents\Media\15450D2B.db
              • Size 9.8MB
              • SHA256 f88cfa94b7a04232aa8aa93d878dc1f0d39fe3acea9a9e819dc4c19c4b277afe
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              15450D2B.db
              • Path C:\Users\Public\Documents\Media\15450D2B.db
              • Size 1.6MB
              • SHA256 cf9192ab0c5fdb5e7014401ca86c1783b35e6d0f0b170cd3e2096a14ff02c4df
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              perfhost.exe
              • Path C:\Windows\SysWOW64\perfhost.exe
              • Size 1.2MB
              • SHA256 9764459f2ac972994f96f654121a87fc069d5924e9dbadafde8309eda9a07683
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AgentService.exe
              • Path C:\Windows\System32\AgentService.exe
              • Size 1.4MB
              • SHA256 b366d3069888fb9658e2505d31cfaff9145028d4ed0e1be101e30b1405afbb63
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ssh-agent.exe
              • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
              • Size 1.7MB
              • SHA256 37e59778e5447d645a9ffc2245cb35d39943418e6ebb9f7eabe53260d3368559
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PerceptionSimulationService.exe
              • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
              • Size 1.4MB
              • SHA256 fb78f3e25db20b1cdfe2788230bc389823d43caf0ec849bd0d2a1f7a0c62a5d1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ReFsDedupSvc.exe
              • Path C:\Windows\System32\ReFsDedupSvc.exe
              • Size 2.6MB
              • SHA256 b53af4993792ecb38fc20285fefdf152cf9daaa9ba045d09c39ace46058817b8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SearchIndexer.exe
              • Path C:\Windows\System32\SearchIndexer.exe
              • Size 1.4MB
              • SHA256 807f8807a74b4328eac34d8bd0da341467c8a90a9f738911da1c28442be79262
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SensorDataService.exe
              • Path C:\Windows\System32\SensorDataService.exe
              • Size 1.7MB
              • SHA256 df8dbe4d76102a4f085c2b8ccf99ae84934c0aa26bd0e52423844c461c129219
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wmpnetwk.exe
              • Path C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_10.0.26100.1_none_007a743337203bf3\wmpnetwk.exe
              • Size 1.4MB
              • SHA256 35737d13b4c1705066d4a7577a137f389e76adb0b9fefe25b628987b566249a3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SgrmBroker.exe
              • Path C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.26100.1150_none_f5f28f643cc492d0\SgrmBroker.exe
              • Size 1.6MB
              • SHA256 45880437d96eb1dd81fb37c02a4aa2ae10b983b905215428f7f0b567e7394ae1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NisSrv.exe
              • Path C:\Windows\WinSxS\amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.26100.1_none_1ae648617b7c1208\NisSrv.exe
              • Size 3.5MB
              • SHA256 6a3fb87b80280342c3a15f974fd8af1b5ee6865164aeaf0404bf366006a86820
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MsSense.exe
              • Path C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\MsSense.exe
              • Size 1.6MB
              • SHA256 4d2bc5254b89f024b86da84805ec43be56978060a0e73694db26b0aa10275b10
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVClient.exe
              • Path C:\Windows\system32\AppVClient.exe
              • Size 1.3MB
              • SHA256 82ebdeb879797ee218cb1a577afb13494e1a3d344b96601323118a011c551fc7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/108-347-0x0000000140000000-0x000000014016F000-memory.dmp
              Download

              memory/108-348-0x0000000000890000-0x00000000008F0000-memory.dmp
              Download

              memory/108-627-0x0000000140000000-0x000000014016F000-memory.dmp
              Download

              memory/108-354-0x0000000000890000-0x00000000008F0000-memory.dmp
              Download

              memory/1040-1047-0x0000020901E40000-0x0000020901F40000-memory.dmp
              Download

              memory/1040-1042-0x00000209001E0000-0x00000209002E0000-memory.dmp
              Download

              memory/1040-1073-0x0000020901E00000-0x0000020901E20000-memory.dmp
              Download

              memory/1040-1087-0x0000020914200000-0x0000020914220000-memory.dmp
              Download

              memory/1040-1046-0x0000020901920000-0x0000020901940000-memory.dmp
              Download

              memory/1100-584-0x0000000140000000-0x00000001402D4000-memory.dmp
              Download

              memory/1100-327-0x00000000006E0000-0x0000000000740000-memory.dmp
              Download

              memory/1100-320-0x0000000140000000-0x00000001402D4000-memory.dmp
              Download

              memory/1100-321-0x00000000006E0000-0x0000000000740000-memory.dmp
              Download

              memory/1284-1001-0x0000000140000000-0x0000000140172000-memory.dmp
              Download

              memory/1284-609-0x00000000006A0000-0x0000000000700000-memory.dmp
              Download

              memory/1284-602-0x0000000140000000-0x0000000140172000-memory.dmp
              Download

              memory/1284-603-0x00000000006A0000-0x0000000000700000-memory.dmp
              Download

              memory/1324-21-0x0000000002370000-0x00000000023D7000-memory.dmp
              Download

              memory/1324-16-0x0000000002370000-0x00000000023D7000-memory.dmp
              Download

              memory/1324-29-0x0000000000400000-0x000000000057C000-memory.dmp
              Download

              memory/1324-23-0x0000000002370000-0x00000000023D7000-memory.dmp
              Download

              memory/2176-15-0x0000000000400000-0x0000000000424000-memory.dmp
              Download

              memory/3092-816-0x0000000140000000-0x00000001401BA000-memory.dmp
              Download

              memory/3092-872-0x0000000000780000-0x00000000007E0000-memory.dmp
              Download

              memory/3092-874-0x0000000140000000-0x00000001401BA000-memory.dmp
              Download

              memory/3092-529-0x0000000000780000-0x00000000007E0000-memory.dmp
              Download

              memory/3092-522-0x0000000140000000-0x00000001401BA000-memory.dmp
              Download

              memory/3092-523-0x0000000000780000-0x00000000007E0000-memory.dmp
              Download

              memory/3456-1219-0x000000000E630000-0x000000000E6C3000-memory.dmp
              Download

              memory/3524-1229-0x0000000140000000-0x00000001402C9000-memory.dmp
              Download

              memory/3524-656-0x0000000140000000-0x00000001402C9000-memory.dmp
              Download

              memory/3524-400-0x0000000000760000-0x00000000007C0000-memory.dmp
              Download

              memory/3524-399-0x0000000140000000-0x00000001402C9000-memory.dmp
              Download

              memory/3524-406-0x0000000000760000-0x00000000007C0000-memory.dmp
              Download

              memory/3524-1228-0x0000000000760000-0x00000000007C0000-memory.dmp
              Download

              memory/3728-333-0x0000000000CE0000-0x0000000000D40000-memory.dmp
              Download

              memory/3728-332-0x0000000140000000-0x0000000140175000-memory.dmp
              Download

              memory/3728-339-0x0000000000CE0000-0x0000000000D40000-memory.dmp
              Download

              memory/3728-343-0x0000000000CE0000-0x0000000000D40000-memory.dmp
              Download

              memory/3728-345-0x0000000140000000-0x0000000140175000-memory.dmp
              Download

              memory/4572-390-0x0000000000990000-0x00000000009F7000-memory.dmp
              Download

              memory/4572-636-0x0000000000400000-0x0000000000537000-memory.dmp
              Download

              memory/4572-389-0x0000000000400000-0x0000000000537000-memory.dmp
              Download

              memory/4572-395-0x0000000000990000-0x00000000009F7000-memory.dmp
              Download

              memory/4944-594-0x0000000000C90000-0x0000000000CF0000-memory.dmp
              Download

              memory/4944-596-0x0000000140000000-0x0000000140168000-memory.dmp
              Download

              memory/4944-586-0x0000000000C90000-0x0000000000CF0000-memory.dmp
              Download

              memory/4944-592-0x0000000000C90000-0x0000000000CF0000-memory.dmp
              Download

              memory/4944-585-0x0000000140000000-0x0000000140168000-memory.dmp
              Download

              memory/5136-580-0x0000000000D00000-0x0000000000D60000-memory.dmp
              Download

              memory/5136-876-0x0000000140000000-0x00000001401DE000-memory.dmp
              Download

              memory/5136-575-0x0000000000D00000-0x0000000000D60000-memory.dmp
              Download

              memory/5136-572-0x0000000140000000-0x00000001401DE000-memory.dmp
              Download

              memory/5788-318-0x0000000000400000-0x000000000057C000-memory.dmp
              Download

              memory/5788-307-0x00000000024A0000-0x0000000002507000-memory.dmp
              Download

              memory/5788-312-0x00000000024A0000-0x0000000002507000-memory.dmp
              Download

              memory/5916-366-0x0000000000C50000-0x0000000000CB0000-memory.dmp
              Download

              memory/5916-629-0x0000000140000000-0x000000014016B000-memory.dmp
              Download

              memory/5916-358-0x0000000140000000-0x000000014016B000-memory.dmp
              Download

              memory/5916-360-0x0000000000C50000-0x0000000000CB0000-memory.dmp
              Download

              memory/5964-1217-0x0000000000400000-0x0000000000424000-memory.dmp
              Download

              memory/5964-1411-0x0000000000400000-0x0000000000424000-memory.dmp
              Download

              memory/5964-1226-0x0000000000400000-0x0000000000424000-memory.dmp
              Download

              memory/5964-132-0x0000000000400000-0x0000000000424000-memory.dmp
              Download

              memory/5964-1427-0x0000000000400000-0x0000000000424000-memory.dmp
              Download

              memory/5964-1000-0x0000000000400000-0x0000000000424000-memory.dmp
              Download

              memory/5964-1405-0x0000000000400000-0x0000000000424000-memory.dmp
              Download

              memory/5964-601-0x0000000000400000-0x0000000000424000-memory.dmp
              Download

              memory/5964-1237-0x0000000000400000-0x0000000000424000-memory.dmp
              Download

              memory/5964-212-0x0000000000400000-0x0000000000424000-memory.dmp
              Download

              memory/5964-136-0x0000000000400000-0x0000000000424000-memory.dmp
              Download

              memory/5984-0-0x0000000000400000-0x000000000057C000-memory.dmp
              Download

              memory/5984-13-0x0000000000400000-0x000000000057C000-memory.dmp
              Download

              memory/5984-7-0x00000000024D0000-0x0000000002537000-memory.dmp
              Download

              memory/5984-6-0x00000000024D0000-0x0000000002537000-memory.dmp
              Download

              memory/5984-1-0x00000000024D0000-0x0000000002537000-memory.dmp
              Download