479b099a7671a75b8833c0612bc7be3a05190d53302ba454102fbc8bd3a8e266

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
Size 1.2MB
Sample260706-pxewlsft4w
SHA256 479b099a7671a75b8833c0612bc7be3a05190d53302ba454102fbc8bd3a8e266
MD5 4e18eed3b9d299ac47cf3c7590622ec0
SHA1 bb91a6a65e6b0e7475c61e512bada1cd34e1c8f8
SHA512 1f012ae297952789d02d965869e01bf2ca39d6e69458c3e432f17aae682096be0cbe90ffd722303315100492266a4dbd2881cf3a88b43b137653fd6e306f8d6d
SSDEEP 12288:A2gXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:A2gsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D24523BF965C50DAEB7609B5C3E9F11EAC133E56982008536A637CFDE6B5458CB38023
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6076	elevation_service.exe
1344	elevation_service.exe
1692	maintenanceservice.exe
2032	OSE.EXE
2804	PerceptionSimulationService.exe
1696	perfhost.exe
1608	ReFsDedupSvc.exe
5816	SensorDataService.exe
1048	ssh-agent.exe
5784	AgentService.exe
4872	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1081757558f5f28e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109015\javaw.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079f8b6ea440ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d4744e8440ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000068908ea440ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
6076	elevation_service.exe
6076	elevation_service.exe
6076	elevation_service.exe
6076	elevation_service.exe
6076	elevation_service.exe
6076	elevation_service.exe
6076	elevation_service.exe
1344	elevation_service.exe
1344	elevation_service.exe
1344	elevation_service.exe
1344	elevation_service.exe
1344	elevation_service.exe
1344	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	756	2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
Token: SeBackupPrivilege	1608	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1608	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1608	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1608	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1608	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1608	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1608	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1608	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1608	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1608	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5784	AgentService.exe
Token: 33	4872	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4872	SearchIndexer.exe
Token: SeDebugPrivilege	6076	elevation_service.exe
Token: SeDebugPrivilege	1344	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 2076	4872	SearchIndexer.exe	99
PID 4872 wrote to memory of 2764	4872	SearchIndexer.exe	100
PID 4872 wrote to memory of 2588	4872	SearchIndexer.exe	101
PID 4872 wrote to memory of 4548	4872	SearchIndexer.exe	102
PID 4872 wrote to memory of 2856	4872	SearchIndexer.exe	106
PID 4872 wrote to memory of 628	4872	SearchIndexer.exe	107
PID 4872 wrote to memory of 1760	4872	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_4e18eed3b9d299ac47cf3c7590622ec0_amadey_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:756

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1344

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1692

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2032

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2804

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1696

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1608

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5816

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1048

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5784

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2076
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1797646245-3139070211-3019596475-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1797646245-3139070211-3019596475-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2764
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2936 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2588
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2956 2952 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4548
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2856
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2956 2952 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:628
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2936 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3a8832b7f60e1b81e688640c16868763ab430e0b984a920a2d1c7c5f3b16fbc3
MD5 901be8d5e72c19434700886bc6377c0f
SHA1 4ccbe93c80dd6e504f48612d63722ab1ae04fa25
SHA512 70358851fcbbe83e5e6bf8ced56898fce6853e523d78c376afd15f0ef694d3975c817791cf24025e4045d4444649bff29b6b37396dff8ab4d3e61b41b947b93f
SSDEEP 49152:Tb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnZDmg27RnWGj:x3q6sjB+D527BWG
TLSH
T12BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 89ce3f974c38c4d2cfa72b1a5c1eeca3b18f6f5cba0864d69b1e6cdfa75fa0bf
MD5 051cec52267a1bd1907bf8cefcf6a5de
SHA1 37a6187e4245df7f21a78503fc0b9c4b997b1562
SHA512 d70c70a6c46b5bd099bb5b3c4cbc9ff82062ddb40e62c56e643ad520220f480e0d74593955f17a7a189fb6b1ab4a3d0175c2f2a71fb28ae8356d0966a7c14d39
SSDEEP 24576:7XYfDtczA+sqjnhMgeiCl7G0nehbGZpbD:etcHDmg27RnWGj
TLSH
T17265F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 c518940089f836b0888e41f14dd197324a359d0f052ad4564cfd7aee9e98da88
MD5 c6308a5e96e9727a0c3d17573abb229e
SHA1 0045282a8bc330590a13ae53b6f08a8ef8c7e14f
SHA512 3ed99935802bbd5e1e1ae2b75da6c2fc7c76eac811fd98ab6e1bb7f24b17122510ac626b1d468c0acffb930c7feefe39d7f100c30aaa29d840716ad983337220
SSDEEP 24576:E0Le5ji0hmxxrMdsqjnhMgeiCl7G0nehbGZpbD:EPji0AjUDmg27RnWGj
TLSH
T165859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 cf4ace87fd0be90f0e126ab7561810255c6218d2d52501102522a6d65c2e7831
MD5 1e573ccbcf9d9e02dae7664f9366a3ef
SHA1 a94a1830b12a379ebc121db99690f592aac23638
SHA512 e3175d302866b6847523722a9a34e9c178b8a2894f740323ce84982c7c89f4fea734a738277bef9e591e9473dc37b8778082186730f7dd5edb815b16bd6e1bc5
SSDEEP 24576:Ka7/ezSC6vUyD/aqgrvWn6q8wyuzsqjnhMgeiCl7G0nehbGZpbD:9/ezSC6vUzPveHjyYDmg27RnWGj
TLSH
T19E755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b91dbc9fd3660243cc11848105326fed7b344897b25a18712a489eb93c4ec421
MD5 4cce43895bf55e26a1fddd6299b991a1
SHA1 2a2f3ce0063cc9e7e5660b1a46f4e6b693c5ab8e
SHA512 c4dfa00b5716c03014a5785b7e4df6487b6136f81287acccbbdddda950ed83bb7144c5b273d2a73caea390a4919ad73340a3e4afe9d052352884201e4033f65c
SSDEEP 24576:mVbqPb88hv/l+YasqjnhMgeiCl7G0nehbGZpbD:mVO88hXl+PDmg27RnWGj
TLSH
T128559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 5289b3a55dbd29974a817ece5d96f3d8d55c61faf763f58adc537baab1bcb566
MD5 d4a76d80ed4d8df4a6697142509d9ed4
SHA1 d141648254e85129caae92bb2a36764be24e359b
SHA512 8275c9f8915df17e2c0b68d9fb7a06661359b4a2c016022cb295f597000b6f1df8a816134249dad76f72d39103b58679573260f04d7fc094e3cfc3dfbc1dbdbf
SSDEEP 12288:YL5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YL5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D24523BF864C50DAEB7608B5C3E9F51EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 75568edbf2b9ace4ea36adfa07e60b3f9b6a34102dc0ba286827e1d46408d7f5
MD5 ecc1a9ab3b1e6b79b3a188649764213f
SHA1 3d37d16865325d828b836f4c0d13b15cce998cf1
SHA512 950d43c6a5f527bf8f5d41ba275056715c9b1d7102af80249c174392e3b8c1f58c64af771f260a4076f3ed35ad41751cceaa2c09fb8f9fce0be95a5ebb2b2edf
SSDEEP 12288:PeBNUbTVO86UyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:PJIUysqjnhMgeiCl7G0nehbGZpbD
TLSH
T17065CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 235865ca4fe613cadf46f85894fc1a82fbb38b6dbb33280ec86c3107f1b25f90
MD5 8923398183be02d08c671a3a6da7b2af
SHA1 32ac5f98fa8ec2c3f71e28e9313dfe4f7529d4e3
SHA512 8219fbe0ba85ffb3b8b13a383807a60c8f10b83a8fb4138efdaddc863ba39a1682ea0b8e64ff658aba12ce8a6e4f2057acd27426db805ca59ffa55ca5b8e8119
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THV:ZQvGAdlCEL8c/DRNw5CnD527BWG
TLSH
T169266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 78757ce5e4fdd4f025c878c25a91e8465c895c0016a479d166d2dc081434668e
MD5 75b7a12c0df05c8e3776a89c792fead1
SHA1 0e61fc529a584cc6e4c7d17800deeb0b061844d6
SHA512 de50dbde3c70ff38669fa244a38eda5225b0d9cf628f248a27e3c6a0400d2f48ad676faa7c0e023036dc4d4fd1195727e8afaab04320cf6d09838f287f5ae5c7
SSDEEP 12288:JAwSfxL/2Dc3RDLLmt0LDQewsAjYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:60ewsAjYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17375E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e981e26c23dc8eea1e493ec4d5e8415a84a32a8e194051aa8ffbbe59b559398b
MD5 da493f5d28ebbfaa98e107f17f8b0afe
SHA1 504685a798c4b192b18439077598eb75fc0985ca
SHA512 c1f751acfc0921aa7fc7903b1507629fe09dc5d2343086f9b9a206e13768694cab5c391c352fd54fd222250d728f6e3b60a9896a61fdd56bb62c4fe57269d2f4
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH8VQBWG:/UEtQevvqc2W1cpV2tI32DB
TLSH
T11C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 402620c77e8f39ac26d9f8f6318c5c395ab6ccd1d69ed8a396115d0bc834151d
MD5 39b2fb5e5972e38ae3c5ab55ab0f4747
SHA1 2b6c85b81e9251b35114979251ed26dfe6c3937e
SHA512 d3e6510e0e57b66c1f3378d7d48d3f8246574b0b763901968b9a300ed57ee8861cd6e4d9b37cefe1f26e6c795c6ba807fc1f82fad20eeeb14b6131f4afe14085
SSDEEP 49152:iCbRquA/m2yL5zTfFiV+XenmE3/zkDmg27RnWGj:noquVjnmbD527BWG
TLSH
T18BD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 327f8ac3a589b4e836ca515d12110c9e599c02128a773f23364ba3511b6c328c
MD5 e04b5239f4d40a73a7308190d130e7b8
SHA1 4f25c7eb3c526611a6ea5d93c26aa987a9047432
SHA512 09e9a5063c9c50cb9ddbd6f18d25ee5dc0eb2c2e9399bf5bc7b042344ace0c3f4f9bae648b46e3cf5edc30f11fddf6a945baca440acf7f11e79b909fe4efd057
SSDEEP 24576:EAhGL3IFoiwtA5l7S53nsqjnhMgeiCl7G0nehbGZpbD:EAMUFoiq5LDmg27RnWGj
TLSH
T10C359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 138f3ed5d039aeb79b6af79154f564636d1a169850db62533c5dedff1b270592
MD5 89a02c1fb6736035c6780ba9c557e401
SHA1 6387af6e417590d9dcafa0170eacca957372c08e
SHA512 93f81853d27ce631b17dcd717ba83f665b98dceab0d26ca14c8184c0866fa35a6fb3a587dc3d2fd21b90f62b3940e0e01b37df6651e8109365457402987ca12b
SSDEEP 12288:Tmw5HEjsChNVBFgl0WDm+CTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:ywu4OWMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12065F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 518fd436add251ff83de9a3a72c35498f4996535fe9ef41ea87a078318aa28d6
MD5 8f040b6b7abf66d0d02e07f7fd86bac9
SHA1 0d3603a0eafdb81585f5615d6d00351182c2fdc0
SHA512 8c1ac82ed921dea477bcff2d272dad9adcf2088f06b113e5b7a5652d9734ebd1535dd5365f37713edfbfd687d96ddbb3d02a7b6ffc38a8acf96327893a0894f3
SSDEEP 12288:UeZ1IyIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tZuVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1105512AE239820FAE163417CC5E5D609E7337C62673043CF16625AAA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 62b6949f39c90964a9cb989cea6c071175db10abe4312e8a9e930513196a45f3
MD5 e791b70daaad68ddcff3b7bbedfa9349
SHA1 16fb1927539a84226652aab01eabe5805266c9a3
SHA512 1b188f44c45c913fd6119bfedc9cf68a216e6c880c29b03b294be34bc13f8a500380f2333f1baa1f114290b9d0d71846bd1f50bfe3b5aeb8e7837540fa955db1
SSDEEP 98304:KQRQyi36YOcPbLvw2gAf+PN3aD527BWG:hQyiKa/X+PNqVQBWG
TLSH
T1FF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3bbdd6b36b541cb68a4832ecb83028dfc6e1bd4338faa72d44e4a50f8965230b
MD5 d26db659d5ee6acf38db70b5ec5c1d0d
SHA1 be67040f68fba5fc50ec0b97eb456b0cde4bf07f
SHA512 30611c1842ec435953f00f6f8b27afb9cc52363566dee0ab3bd913ee617baf32e9c2b3fd63210f1f30972868a091f9b4c2a769c4acdcc607e6e25b0dff71c7c9
SSDEEP 98304:dQRQyi36YOcPbLvw2gAf+PN3aD527BWG:UQyiKa/X+PNqVQBWG
TLSH
T1EA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fe260237823dcd116a8f260fba5dd7263ac7052a8a5fb6561feae3f5bc9d2ef7
MD5 619c7e31a29907d61c37d69d79999d4d
SHA1 8fc625e997bddf26ca2576661321a776edd14c43
SHA512 6d46403190cc41ef1de054da612718f7b7b2c2158b362b024aa2ad3aad85dea4d3a98e0456a5b8b854b0f1b930aecd796be9b9d6e662db19661882935603d95b
SSDEEP 24576:qwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0lsqjnhMgeiCl7Ge:E68Qg55nhceWu7PNU3/UDmg27RnWGj
TLSH
T157B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f8394672c61a2d6cc5f2c01426e905bd45651fb8b63b2e56fe7ad417c9990593
MD5 9bdb9a32149e1b5b31ee19f8394e7799
SHA1 8bf96573907129137ccc36ab197e1ca50c48c309
SHA512 0cbd9268959817337344cc63b97e29e55387874ecc75b7208034d122c16a8054e167c502cdeaca835d40f340285ecc9593069f51b0f44ee01e2b4ac90023bd48
SSDEEP 98304:vy5112gYy5azzVvt69nLKnhZ9D527BWG:iLIHEWhzVQBWG
TLSH
T166167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9678f531643b64b90efa15277ad19243a04c0c60d5231158914e2a659aa95334
MD5 4a63609fda5fec6268865dc0d10dc6bb
SHA1 1c458976d94254113f933fbc308615f6dc5c7628
SHA512 6f7b79c19abaac9e7b6019f687092cc6b863d81dfaecfee8f4ee7fdc870f01a2904dd10a00976f8053d5979866cf2b14f0f18f6749755be6534ab9a79dce587b
SSDEEP 49152:rB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gliDmg27RnWGj:9u6Jmdxd2diD527BWG
TLSH
T1ECD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a111be0a446ea3ab7b63f94b4a7691d92995d9aa273bfdca0f70fca1f570482a
MD5 a0553de946391bb9f6d475ab3e7de849
SHA1 bc911b28952db2b5872433b9a0f756dddae98a67
SHA512 89606daf7177bb3cf83e0b040030ac2277ca1148cffce266efc2a0eb225f89847a9405c37f325c87cb4e3caf129c30bc449593c56f8e196e86798eea567b3c49
SSDEEP 49152:M1hpsNoJpF1A63U44CwH7R4xWDmg27RnWGj:MmifPWRbD527BWG
TLSH
T1C1B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 07fedf29afd4caaefe305f08a34ece8063338f338bd08434c6c8fd7450738990
MD5 441b04be813408fd08d32caa42c022f5
SHA1 fc2e2cad9ce7de5b5dc6b2f5c04d95cd6c5b82ce
SHA512 a015c832ec9b349a38f213e94b5cfe02c1710449b653fd2fbe8d7f3ea91051cd67a9a8e4bde6946632a6c2cb02607705a6c343800c22f5e88ca4c94611f70c73
SSDEEP 49152:mSuZQIY0Be2KcRVtOnks6NMHqJDmg27RnWGj:o5dKii61JD527BWG
TLSH
T1D7C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 eac2549e2cc831b347e933a4656b86715b6104a15553bea999538a6dc382a18f
MD5 6d2e6ddfd8c62ab21a342a641d8660a0
SHA1 a62f0286daccf43ed4b96f5dc28b8b0843e9c15b
SHA512 2372ef47004965f0aca61ee258e1d6c7d0c2139f2e81bb4cccde01c7211ea492d226bef58c82f1eedf4da40585e7c943ca477e60a130491fe5ba4a8c48c2e1c4
SSDEEP 49152:PhtSn8EApI0fig3giDn0AP5wSDmg27RnWGj:eX2imph/D527BWG
TLSH
T1D295BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 d360623ac8a443c720c429a6cd18f47b135e043de933c4edda6b20e8386aa5bb
MD5 e9e3c5406a3d88067d550834301c8418
SHA1 d6e79a9dc2b1209f6dd8565e3185170754e91b30
SHA512 3bfaa0762f787f6e7ce4d4dab6141025707e6487acba618ca775635c5048258053bb6edb763963f2bcbbf34f185a4318e7f8ab8fc6ee857b243ebaac8b4f62de
SSDEEP 12288:TRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1324523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937A977CBAFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6178b79e4de7de11e00b7a756a2ce13f6df3c723cf21434984cf322901443565
MD5 60736d218157253a1d3e071b9f4d87eb
SHA1 8ec15818daa9ec3dd2e1d0623a6064533b4ede74
SHA512 987cecf083db99a552beb1364e78789767a1f12dadbd4241f2e5eb8fd2e6d9a4caa6b366f95d664eddd1c5193e28bfc372d9c07d3573e0e3b2aa0690b114c1a0
SSDEEP 12288:TUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DA4523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937A977CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 60dfd2138b1c991e851ceff29bc7fedb5753f61e37c99e5317a687e471d695e0
MD5 7a1462d5565fdd38649ff1a4b6937620
SHA1 b5aa13be3d6cda275b7d2820e8a830557aecbcf0
SHA512 3208e77f5c5eab6a7bebcbb36436a99a24e451068fe84df2c49fb3bbf75b16b62b204c707d49a75ddd5df51bf04308d105e36763acaf2e46db039ffd79e7e2d6
SSDEEP 12288:OqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CB4523BE965C41CAE52648B5C3E6F10DAC073E5BE9200493BA977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 ba0786a22f2de1e3b580b702fe359a18827f2303f7818c69917f13d9a6726c24
MD5 a32212003558d5edf42d15e809c37c6e
SHA1 13f92a6b3dd9b25fc198ffce9ac536ca25a30051
SHA512 6afd9891cc48ed6d5ebb6dd4ce74abd953a2f0a7e58b75085f67cb002b1717e795843d6f69eadc9a875d1833a9337575ec4ec42289fcd7137e5e64f382ac4d26
SSDEEP 12288:5VHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12845236F675C01C6D83285B4C2F5E11DE8237D56EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f54a418d658dc05085f944b0c45c64d516a16389b1fef6ac07d60b0fd5a69196
MD5 7b5f2105b772913c85b6dbc29e6d73bc
SHA1 46f1937ab54b57d2b244c61c64686c5d7684082d
SHA512 c1217e7612d27428a2355da4f273347498c39c2555972e33e87e6bbe84beb24529c02c52ca6b96f1e88bf0ef1973e2887776309bf2c43c5f307a7d67139829c5
SSDEEP 12288:uvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1014523BF965C41CAE52648B5C3E6F14DAC073E5BE92004937A977CBDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 cb9038cab95ed8ba7019d5cdbfa2d25e0c1fcc304a09e936d2772df4398ea8ec
MD5 9b6dd0ebbc874b244b64e4c2637ccc5d
SHA1 9086fa16dad5d5e83c7a75ecd2ee1c9d8a4a1f7e
SHA512 d6c14090afcc03739d63a1ad16aa832e54062271f07846d27e90fb001091869845af4f911739823cda78ad3f6d9e3df16e6a3d06c0ef72e7bd80a082e79f55a4
SSDEEP 12288:7wXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7wsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16C4523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1a90fa507e07c3f498cb9f275af8d06602fd941746442d05820352885ad337bb
MD5 09b1087e2a0e3c85d8d560f3748083be
SHA1 e48bed8f128b610ee547072bc807f58c09f775a3
SHA512 14e67053e21ae4132825538a423b47a0d1f96975feb6e35a7cd265e01eb01e0431251d3a5fb76fdd4183108c3c6a52b665ea374c5a071d52a7b491ee7e4c58ce
SSDEEP 12288:rcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BC4523BF965C41CAE52644B5C3E5F11DAC073E6BE92004937A677CBAFBB14684B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 a70374f128a9c443bd657fa6c0bc74a3f1bd9b09c999cd3c3bd172e790637ebb
MD5 fceaf1eab35dfffb04dcf21d75896d35
SHA1 c5fa3e31d01c4d0a0f4ba5d0126bea3b6a44ab56
SHA512 ff63ba3f6ee6039dd3cb30cc051d4290b5f9c88149df904f8e314588ab8f461b2b5a988eaf62eb7ab9626ab4b241f6d0ef14309156298276d3c758d694e93b64
SSDEEP 24576:/ZMRzFVSO0sqjnhMgeiCl7G0nehbGZpbD:/ZMRzfcDmg27RnWGj
TLSH
T1166501A9B35018F8EC63813EC965D90AD5B27C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 a9198f84d83618f35b23b83b0081cabc3c2377f9030150a1f0c3e9f7d6d6be2c
MD5 9e2e319eac61724382f86112348b2512
SHA1 68853448237713327d99eee1dd3834bcc16b4840
SHA512 2381fcb496c5240ef7ee95b5841f55e48f18c3f2cf7aa4d6d83ca0d586bb13758b39cbadd6c1cb693e46fbd7de1da6082d2d034f04502ceb903046b3e5f44083
SSDEEP 12288:2FXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2FsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13C4523BF965C41CAE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f8cccb81d70d12f669a1edb33429271de18f2129b55da55745fa691d90494d3a
MD5 a2e85fa64e75824ea146039e5807876b
SHA1 bd6af56e685dabc187664becb6ebd3ad232bd35c
SHA512 97df4815b4a95052595e7e591fc33bbfc6d8e0ce846782cec88a54d1edc0ef0488e0fbefe403c86121eea8655d59074e0a4e8e7eb385e11fc1cc9355563f3d23
SSDEEP 12288:TpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D54523BF965C41CAE52644B5C3E5F10DAC073E5BE92004937A5B7CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 485055792e8e58b4c01932b74074895b937efbb6a2dae3f6d609e6f2febd6578
MD5 959f04b83d461b778d4749f3bede235a
SHA1 fcdf695871c8519ffecc08549758e77a0e14e2a4
SHA512 7a84ca335a7ddcb35bd367e1ea95f13b1fa39869dbbe776d4859e9e0304c6a71e49fe75e85e9058b355e54e63b13dc6c921999fdf1f230f9989ec38e85c3ddad
SSDEEP 12288:kyPz5L8IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9zyIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B55125B73A530F9D1378178C5A29A06F7337C3647204AAF17A116BA6F736904E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c2f4a445961271c19454d8908bfddf9f052452577bce0b537c14071a53b89a16
MD5 ad2fcc975b8720a8b626661dbddc3844
SHA1 7a8566a0c1393d462ae400d175556f2655a104a3
SHA512 c99d58e7e2d34afdd803972a89c085cc5395ccd9b061042294e5157347393ac42a86f3f261378efe8b0432f88aedba0d49c32460eb4d815dd32e5bf6c20f9fd7
SSDEEP 12288:JFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1854523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 33007c3ae90ffca59b02085d92f3649f5165c0a501b19c435f58aaf1c46bb1f1
MD5 40bfed5148e6a63c33d66eecc6b13150
SHA1 8264d52515dfcabb38ac8bb7aa97a7660ce25061
SHA512 0b58e3d36a05d235bd5e68b83cd18bbe251c6fb4ffa1a61d1bd61df6b8139b6f03271b7d60fb0a068976450e5790bd2c5d5d2c32079425b39098256e3e1055ac
SSDEEP 12288:UFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10C4523BF965C41CAE52608B5C3E5F14DAC073E6BE92004937A5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 efa480725e573505b3ea19b5293fdc6f36710cfad61f51f07e45e3526f000c1b
MD5 24a6f9e0f538676de51aecc675618b8d
SHA1 c1449c9d5dfc1ef84f9b5a07e63558d419d0dd92
SHA512 2b94a45d4f91eae46493f4815a6095583e6959b6f5fd93063aae8c274a7afae1c433ed2194db21e8d556bb4a9c9c3c9059000ff5220cf5a0fe5521ca508d914d
SSDEEP 12288:CyPz5L8IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fzyIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FC55125B73A530F9D1378178C5A29A06F7337C3647204AAF17A116BA6F736904E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 a33410fef03afdb27461ff68f5d69cc7346bc4a3c275348a1a25a0acd4271894
MD5 7084aca3d25375bac0aaee61fc747258
SHA1 5c661e340b1dc582354b37b87a189957c07e54a9
SHA512 8f7daf415f8f5b492d0b56efcde93d48c3b33e7ba0a48d327d265f784e0461411aeca6cf5e00f6d173e0337345e054eee1513e5f65441452866704358cb5c9a7
SSDEEP 24576:wTDaLl3z0zD6sqjnhMgeiCl7G0nehbGZpbD:wTuLlj3Dmg27RnWGj
TLSH
T1C16501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 c7c66086e196fffab4b0cbc1fe8fb0503d1d96f8dc956da4505879baede72d66
MD5 1307dc2224e7c632249b8c52f3791bce
SHA1 c90f868bc284a3f96edfb09266b0c6cc582e7d93
SHA512 aba6f4948717e6be8fca4397538dfe086c766168ed4fe48d71b7a335512251ea0b491c78bd10e036aa5f379a5f4ec2807946ecc6984c7fe1832140213dd79f4b
SSDEEP 24576:B3vd9CHKy7GZ2sqjnhMgeiCl7G0nehbGZpbD:xvd9CHKyacDmg27RnWGj
TLSH
T17475CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 6e8b2e38c6765de2fd22a368f87895918f10629d749cbd4899d98f9a543c26b2
MD5 f7b1f263667d406f95f849b5c5b65416
SHA1 c5ba024b3eb226e8d52a91a3c340a2818975b288
SHA512 db868ea7697384cb768232a8b3c6391a984170838ea856249a61d7af74db646ded37be4fca1bc2595fb201147c8b927a0962d6abfe5af2ffe030ca50ff0b4e74
SSDEEP 12288:uKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F14523BF965C41CAE52648B5C3E5F10DAC073E6BE92004937A977CBDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9010c4620d71daef7d9291262e60e935c29748d4cc8ba30f86f3625a7fc4974a
MD5 422ce57bc2d42f427630e3f95697ea7c
SHA1 c718360372dbe041381517510a3830f211fb1ab1
SHA512 c587d55f4b5bb81a4a0b9a621bc9a3d9b9bab93da3e53dd1e318f3d253e936303340a154cc34e1cdee5f962599b912ff0d3c3252f91345e99d2cf13cc2e0ca2d
SSDEEP 12288:6oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6osqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D64523BE965C41CAE52644F5C3E9F10DAC073E6BE92004937B977CBAEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 0c15272be9b9e49ba61d37ea0dc5040d1c6530faf4420d0b7458fcc550a2dc06
MD5 2e5b4e8cb9dbea33077eed12a817bcb6
SHA1 c8040a14800336d99477f28066f95f53d6e3736a
SHA512 9bc5586ae50066183438870c29addacbecbcb94533741bb4107f047abacb5698cc8f23a8bc39e5178bac5fcf2647975260bd51688bab8a97782cf9324e445464
SSDEEP 12288:H7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:H7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1214523BF965C41CAE92648B5C3E5F14DAC073E5BE9200483BA977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 e61f380da8a0a1510ec52c3356ea15b73f98d9e27e05b1a4cd947448a508c478
MD5 654a69ca184ae67cee1c2b0d9cd02e1d
SHA1 edeafa172deedbc7ee78b4196f922f1cd9943b67
SHA512 fab3be3a5ab2eef0a5157ee60c4723729c315538f0678dc9561ece9529575ea9caacc01e6c123a9c49d448b10d6d783d1a8d7795d6db54b0c265dc6b7f255ea0
SSDEEP 12288:mFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1394523BF965C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 2de41488bb9a7c399c45520344a7bd0cdefe101dd4d8b37f460526bf17fb2d5f
MD5 43a8bad6c7fc9570df198b5e2ed1887d
SHA1 9978d88f845edcd9c687d240196b26454f02cdbc
SHA512 8e05ee1dc29a812e5eec18c38567a6619a6c8d7b01419add24f45e035f6a3b97df8d02a2e8a1f5004ddd5d9eb99d733ad2a72e7848e6c7e0df0d904bf26ee449
SSDEEP 12288:RKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13A4523BF965C41CAE52608B5C3E5F14DAC073E6BE92004937A977CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 ea702d0ebcfd7f315bd138e97891cfbd377adb533ae9a09dd211ce5d899f3361
MD5 a3b3e628d53f0f3f6ce7d43f800a713d
SHA1 b33ac6d5a5350b0a4a57c5bb6be3e5d18586aa90
SHA512 97ce16f257ce5bf0b1b069ec1a32bfafa965055f7fc8658d4a1a8b08e435c3cf8dc7c5347455456f27ed6d1829e85591d023850ec09275cba04f4b576767b064
SSDEEP 12288:EtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1144523BE965C41CAE52648F5C3E5F11DAC073E6BE9200483BA577CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 d51c6b69d9b168b9ddd701493c84c4b4c563bfa7b7a2f6f42dc0a3ce9989ea64
MD5 c709784d2b8256916bc711bc135494be
SHA1 3e5fc8fe3cd033da2cfbdbd1f6e72377389309f7
SHA512 6cccacf9a00e7d1a8e8424051cd49a40b7f4df6393d4529e3021ec3179aee0434dbbc0f421af41ce1ac53629241d6368314c93da006b35fea689151fa31e8d52
SSDEEP 12288:FvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D44523BF955C41CAE52648B5C3E5F14DAC073E6BE92004937A977CBDFBB14584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 f617edbdbcee9d28bf365b8b54b7dff3aaa8c424f61674dc34e4d072e7fdd446
MD5 a6742a9667475706ded0cd0900fdcdb7
SHA1 459841a9a552f9e9b459ecdd6c518a91a3561ccc
SHA512 a977f63f413996b62469262ebdd908e793aee3047b2cc245e30700ef096f324eda74cef3faa1620b8ffe574b27f1ab22342eb4eeb22ff8f92abaf30365bce7c7
SSDEEP 12288:ziXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zisqjnhMgeiCl7G0nehbGZpbD
TLSH
T16D4523BE965C41CAE52648F5C3E5F10DAC073E6BE9200493BA577CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 11dc12fd78a24d47e18c2bce52bed30604c5820e4239d62d5346df66234f9aa2
MD5 96c85fce3536b3f5ce60442c6d521d27
SHA1 c752306db8f7c94dd26f0800f21ce12327adeeb5
SHA512 a18fd3d36867c2d77cde5428de2b560692a1eeba4e49cef2fd617b905714eb91c4288e6ccf293e684b1786fb44723105de124f9c66e79238677e4caaf13dc7c8
SSDEEP 24576:QfwvUk9RX6wkyAIZsqjnhMgeiCl7G0nehbGZpbD:kMnYIdDmg27RnWGj
TLSH
T1A585D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 363394d9a44965ec8cdda20228af121a2aa0f31d179a2eedb0d62d5c24a646ec
MD5 eac6019996f799443d4d90571df0ddbd
SHA1 eeb6f7f332608e3179212cf87e682471806feba4
SHA512 6b168b1d0b1ccb97791900235c2d066381d93e1c6d17daa1ef2218fe3b055d3480148916c99a18209b1b709d11696547724d16965c6b4ca99594e4496b9e40e3
SSDEEP 49152:LYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0yDmg27RnWGj:OySzP6D527BWG
TLSH
T1B4066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 413ca5c58b88e9ac8c8f590306e0211e4a168c4b10adf82f6e37f757fd3ba8c9
MD5 5d8217ea1ee2828d0272b0bead66acf1
SHA1 8ac7f026a1975e1f4776fc29db2db62a44d5021a
SHA512 65b2b6fb6b5f8a29debbea88240938ecc8d4fa5ddd8ed46482df2efa40ead70049012cf09e72e2feec440ed197acabf1c42ce072b7394186697ad09de456cd11
SSDEEP 24576:q47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYksqjnhMgeiCl7G0nehbGZpbD:q47JUQjTirIhCnDHUPfF/iDmg27RnWGj
TLSH
T1A365AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 67059862f14fa53fbfc2c2137cec2815098cc3f3df9c5987a8154100f6c73fe0
MD5 341511dc57e27874a3b5019b5fb6ae3c
SHA1 bd69e7a8c9b2dc121a48080d61de66381ee35a90
SHA512 c56ff737c1ba09d744e7a59471aeb18a91aa9a1f14444c4873109ea92b4e385b70bd12d04488ed04b5a5cc07682425ecdd3220eb4fb1eccbaab9e7e466853e0c
SSDEEP 12288:nbsfVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6VsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10D55015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 7ccdf4ba6a2b37baa6b2119041367f94e6f699f2467ce37a6c59bb79be607635
MD5 364917c8b62ea3b5e596640e60fd2537
SHA1 6ccdf4b44bc2080c02b0e50ffd4ecb3ec1c662dd
SHA512 de716d07a64667955315c699b4c0cb44dcb2f28229ab44a5e37e2190720649c9f1d033516c453eb3d5b64ce40d9889b98c320cfe2ddf990160f7cc09e603a635
SSDEEP 12288:g079Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:N9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15745237BD34C518AE93605B482EAE12D681B7E669F1044C3BA0778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 33d1ac4ccb418d3d227e1b1f63ada6ec0c6f6ed92a4a0a4d08a83d476599ceb9
MD5 d33e3b8cf0c8c4263859efe7a0af4fd6
SHA1 d9fe76c0aa3b417f73420b92097a76bb90bb0b92
SHA512 10755ebd92628281726964086b12da149aae90c64b30518099955be016996710b0c86dee2e322d671e2079b7f6a9cf1fe8e3e672352f4e388a42e45bdb6ccb0f
SSDEEP 24576:hgb6bmBIi49WNNFpg1rSvFv7bYzsqjnhMgeiCl7G0nehbGZpbD:hgb4mBIBhGFADmg27RnWGj
TLSH
T1EF659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 eb5031ac05e9c8a4a3b00a798d0c92d1f244ec7e13997e5f227e9773a7ba7cfb
MD5 70d9fcc90f8da89e85a517b76b70bb94
SHA1 4b68186ea07d2cb64232a05851d4667d4875a5ef
SHA512 e80f7b34c69b33115f256bc8ef9dbc1d28779375a544169f153cf8d91105c46486806d2a545399b431001690ada388bc9326ffd6893f630d2afd5dc8ba3b8656
SSDEEP 24576:PG88u8FpJqH1bzria7/m0sqjnhMgeiCl7G0nehbGZpbD:+7ZFPqVea7/PDmg27RnWGj
TLSH
T11D85016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 2d390a14f963f1fe5b4bfc5a90e4d722880fe2e84f119e9b39701c4a4c1664f4
MD5 3da78a3854494e5523c6ba936678ba55
SHA1 113c0228599e82086611a897b1d577b0fae2d64b
SHA512 339b57091ae13b13b628f5b6c282703c89ebe25f0ecfb4774f908104c6d935d903958ab61fc4af393106078248c3fb8349836839ca2f2a202eedb242e6412237
SSDEEP 12288:9HvUrBFrEjwaQgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:9PUr+NQgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17265F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8533eecaf0362874e92f635d69472d1731098f193c549d6d1fb7e67291974c7a
MD5 a3c027f9b3f441e3af9580c30899e8fe
SHA1 8e0e7f8e1e77be301720075c41ce16f2b616e7ad
SHA512 43370ef948244e38ad441d08d21597a3d32180024efd6f0b577af2598fd79cbfd79f1fd3afb8e29f54c61c177b19788a04dd1a544612b93e9bc01ab555d1fd8e
SSDEEP 49152:RBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjsDmg27RnWGj:yG05lO43bVD527BWG
TLSH
T1E4D5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b62fbc249f21d8d0cdff14cc41cf8ecd6a6f76e387f1dc63ffd7da95dcde671d
MD5 89cc0d9f444132c2aed5f196e5c3a209
SHA1 87632c83b46931f79eb173b681b37abb8295537a
SHA512 74c7698f402ac107c90c5810eddfc4ccaa83012be727f7d17b23ea77e7008a51aa6b2aef236d725a29a90e31c8f0401abe8a4042383d087a391de5bc98fae0cf
SSDEEP 24576:7fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnesqjnhMgeiCl7G0nehbGZpbD:ja5POZ3BJt2pasx2+mUDmg27RnWGj
TLSH
T19765BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d51d2544c45b6da0b04cdce8c49f5fb6a583a73deec70b38331afcca774383f5
MD5 46dd36ea1d3939afffba255a3127e9ea
SHA1 baa97448348f24f4263befe4b2fed4dc2bc865a6
SHA512 936a760356058fb13e4a5a44c35fff075081aeedac01b91a39f71d506655cc4eb659378ec554b76ad9a6a57eba48bc3613715f6a1e53e1150c178451f4fe5a36
SSDEEP 24576:gNcwHdjbyQ4nLC18lb/EOjowL7FkssqjnhMgeiCl7G0nehbGZpbD:gNc/zEOVHFvDmg27RnWGj
TLSH
T14F857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0abed9184a2862ffbd4574d0adaac20203edaa12642347c1ab0a9d115fa75c20
MD5 69b7e5e7fcf585daa385cb865af2490e
SHA1 93df990cedbe6b1baecb987bd54bc64ff492e20b
SHA512 47e3b33a50b01616982389d05278999f11e7eb2a432daebffc63c182ae64ac158ff33a3c1ab118095cf295e94d0c473495b0583299838fd2e551651a3fde348d
SSDEEP 24576:zTkNvNnaFeYhJNtmZBmisqjnhMgeiCl7G0nehbGZpbD:zTMwBtOmmDmg27RnWGj
TLSH
T17955AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 35f7a24d907e883a3d88de2336b0cba43cb0061109c2a81377f2b5a258dd2291
MD5 7b9b8755f62fa21d480ac871b4416380
SHA1 24c4b930b59f644b5de57da98ead4a88960affd3
SHA512 20708dda06d5b130045db299919ba0bf6188f3ea2946bb6f4bdd02b9ff7f052f5d91d72c691b48a3579e01578673b46cd17ff98919b11880ded486f061519406
SSDEEP 24576:oD3FHshBIYQgAxsqjnhMgeiCl7G0nehbGZpbD:oDVHeBIAAFDmg27RnWGj
TLSH
T16175E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/756-6-0x0000000002480000-0x00000000024E7000-memory.dmp

Download

memory/756-1-0x0000000002480000-0x00000000024E7000-memory.dmp

Download

memory/756-77-0x0000000000400000-0x00000000005D5000-memory.dmp

Download

memory/756-314-0x0000000000400000-0x00000000005D5000-memory.dmp

Download

memory/756-8-0x0000000002480000-0x00000000024E7000-memory.dmp

Download

memory/756-0-0x0000000000400000-0x00000000005D5000-memory.dmp

Download

memory/1048-306-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1048-114-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1048-108-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1048-106-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1344-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1344-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1344-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1344-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1608-82-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1608-88-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1608-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1608-375-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1608-377-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1608-290-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1692-39-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/1692-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1692-47-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/1692-58-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/1692-62-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1696-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1696-274-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2032-209-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2032-50-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2032-60-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2032-52-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2804-247-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2804-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2804-73-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/2804-67-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4548-394-0x000001CC47F40000-0x000001CC48188000-memory.dmp

Download

memory/4548-365-0x000001CC47F40000-0x000001CC48188000-memory.dmp

Download

memory/4872-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4872-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4872-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4872-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5784-129-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5784-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5784-127-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5784-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5784-121-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5816-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5816-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5816-101-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5816-308-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5816-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5816-95-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/6076-14-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/6076-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6076-22-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/6076-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download