wannacry | b20c5cf9ed559fe6b575c7f267b3c835dba51f07dfb09eb93853bc2b4fe07558

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 10:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
Size 4.1MB
Sample260709-mabvbsht3w
SHA256 b20c5cf9ed559fe6b575c7f267b3c835dba51f07dfb09eb93853bc2b4fe07558
MD5 c1b3b97e5d85cba79927a1997213152d
SHA1 a4a8d5449f92ac174cbf13849b682743625934d0
SHA512 4e2c1901df0d9bdeaedac01dd5ae5bd432446752a59f15aa240279485b98974f01ddbae21c2edd92cc119b05970c9e38a38be02cbf825da250ad337a2d8190fd
SSDEEP 98304:qDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HtD527BWG:qDqPe1Cxcxk3ZAEUadzR8yc4HtVQBWG
TLSH
T1001633A8A12CA1FCF0550DF440A3C91EB6733C69ABB94D1F9BC089BB1D53F5A9F94502
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware spyware stealer worm

Malware Config

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2611) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 12 IoCs

pid	Process
3992	elevation_service.exe
5856	elevation_service.exe
716	maintenanceservice.exe
2628	OSE.EXE
5492	PerceptionSimulationService.exe
2644	perfhost.exe
3964	ReFsDedupSvc.exe
1468	SensorDataService.exe
412	ssh-agent.exe
4260	AgentService.exe
2360	SearchIndexer.exe
2908	tasksche.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a9c98246b9871ed5.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_121500\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_121500\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_121500\javaws.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File created	C:\WINDOWS\tasksche.exe	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd9e15e68b0fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002222f0e68b0fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000001cca1ce68b0fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000140183e68b0fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed9a61e58b0fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3992	elevation_service.exe
3992	elevation_service.exe
3992	elevation_service.exe
3992	elevation_service.exe
3992	elevation_service.exe
3992	elevation_service.exe
3992	elevation_service.exe
6020	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
6020	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
6020	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
6020	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
6020	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
6020	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
6020	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2132	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
Token: SeBackupPrivilege	3964	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3964	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3964	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3964	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3964	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3964	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3964	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3964	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3964	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3964	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4260	AgentService.exe
Token: 33	2360	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2360	SearchIndexer.exe
Token: SeDebugPrivilege	3992	elevation_service.exe
Token: SeDebugPrivilege	6020	2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 4576	2360	SearchIndexer.exe	101
PID 2360 wrote to memory of 2816	2360	SearchIndexer.exe	102
PID 2360 wrote to memory of 3556	2360	SearchIndexer.exe	103
PID 2360 wrote to memory of 2868	2360	SearchIndexer.exe	104
PID 2360 wrote to memory of 580	2360	SearchIndexer.exe	109
PID 2360 wrote to memory of 2220	2360	SearchIndexer.exe	110
PID 2360 wrote to memory of 2500	2360	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2132
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:2908

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3992

C:\Users\Admin\AppData\Local\Temp\2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2026-07-09_c1b3b97e5d85cba79927a1997213152d_coinminer_elex_wannacry.exe -m security
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6020

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5856

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:716

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2628

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5492

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2644

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3964

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1468

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:412

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4260

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4576
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1590476978-4004838454-3790292847-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1590476978-4004838454-3790292847-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2816
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 2764 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3556
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2868
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:580
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 2764 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2220
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 34b96544925415d6e3daea8c551905ccdd746c6ec2c34b378ca0662f8df0fdf1
MD5 a9d363a8ea3c5ed0661ce725f22121b9
SHA1 d97d0f550e20820c7e7267c0a6c3495c1b3a04c0
SHA512 e002356f24eddbd67ef93ff652538e74324f98ce065ae15b061f1af0d0541ac994401aeb70ba19f67b1ead8bb8111d401519d3bb6e07d202ecf6e8de7596d0cc
SSDEEP 49152:+b+632BuPkFKRrdE6ohQstBhuXjfS4LWxn1Dmg27RnWGj:A3q6tjB6D527BWG
TLSH
T108D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 78d326c50a52403da677882da83ed4b38b10631b0358d1c177495c257d990d23
MD5 488bd760393af8f2e84dfcb1ea56a24a
SHA1 f285dbba3b77c91475c73b6d26d98a4ab9cc87ac
SHA512 c5a223c663374d6a68f3aff39dc81e3d54e2a1ec18d72797a7882b226ec4571ee5ac928d17e89c465cb72b786570e94db6db736b0e5f7ecb17e5ede307d4d4a5
SSDEEP 24576:LXYfDtczASsqjnhMgeiCl7G0nehbGZpbD:OtcPDmg27RnWGj
TLSH
T11D85F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 9261282b052d05cdd3ff794c5d5f0b0e3068f55510dad85265fa10652f451d97
MD5 4f1b55486f26723c77ddda6fbce89c7f
SHA1 1636000152d4c27306baea708531d31024ba544e
SHA512 56a500cbdc0379a037385f4ea2b0967be158c5c348238526a5cadc48e93366804a5d689319e39f8f15d826ae8a00677adeef014e093b71915bf64ded683006b0
SSDEEP 24576:x0Le5ji0hmxcrMpsqjnhMgeiCl7G0nehbGZpbD:xPji0AWcDmg27RnWGj
TLSH
T1ABA59E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9002c68f9540a85292142003815b97788a8bff016e7965b322e05d790fb6cbac
MD5 3cf1727e33cb9ff602d5418984fab433
SHA1 1e12b0461efff597886a80cdb6827f9e2628b8c9
SHA512 6384739dc3fa1093afcb52390806917b1d646e5a6143921ee8c5150cfdc294beffdbe048b78cdabfae2ddc2278de266a57ea36aec6a7c3ab13ef12646e80cabb
SSDEEP 24576:sa7/ezSC6vUyDZaqgrvWx6q8wyuLsqjnhMgeiCl7G0nehbGZpbD:L/ezSC6vURPvMHjyYDmg27RnWGj
TLSH
T1BE755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 08fa7f1098dff85b83161fcef2f9985f1c61a7cdbebf451ccb8721d436cdc296
MD5 20a841705e297184300b10ed7bf30ea8
SHA1 aed29e6f618f3b2e3257628265e369e587607d54
SHA512 8786ea056f7b3883bcc06291459031e6b0c86c8088e0109938b57c7daf8864a41e7358cb0f153fe4f24d52588025d8692aed96e6a259ca5f343640f19bde0c53
SSDEEP 24576:LVbqPb88hv/lV7msqjnhMgeiCl7G0nehbGZpbD:LVO88hXlVeDmg27RnWGj
TLSH
T118559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 7e76b3d2fbd5e16e228e39631f40de99ff88bee1d9a0653ff84715c6d3b54584
MD5 05547bf5cfeb0e98e049ca69d2b1421a
SHA1 a35446e188dbdfa3b9bb134f1d721c9b65184e7d
SHA512 532b9f3c696760889711f6df0e51ce2e11928ba83f27aaac60a1f0a276e5d412953ddb76f89e6308f1c7fc77d4a41b49552df5bc439bbd3fac3a2595d7a96851
SSDEEP 12288:4kWIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4ktsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13F6523BF865C50CAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 608e66e4ea006d2a83fda2035b89d08083291c09961b3d6bf0aad83a7bf77570
MD5 5d6cb0ed3c4d3d099b6f50dbc6ae117c
SHA1 66ce7edba6208b75278efdba0bb5cab8a40ad15f
SHA512 fb419fb00cdc44404869c49d6848a184915165b014b24d9fafa60214fb76cd236ade454995dfd792132f7b5c01466e4a848a129e697c1e393e68920ab62c08fb
SSDEEP 12288:beBNUbTVO86UtIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:bJIUOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D285CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7762b37c520e6b3552bbad90d61f0073e8a59895adfc61c1bd188bf80850aae0
MD5 d7e5d8429bf70783e599c3f92f3fba72
SHA1 1a1c6b6d60d3704fc13bb8c80ddcd69dd459a139
SHA512 2abd55942064c808f978082afab932d2d3174fc5dd87747e7cfe7c49ebb587db4f0fcff5935a0f70df8beb764f018e86a3662358d24e605e0bbd97ae6a771bd2
SSDEEP 49152:PQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THZ:PQvGAdlCEL8c/pRNw5CvD527BWG
TLSH
T146266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 bb55172506d6960df08a691495110bea36c9bb9f6c3af0e3fc242b99f8ab26e4
MD5 3f16b952b9a98c16b4163d908bc452ab
SHA1 41bd1c8d804d6bab694baa3be2738d99e3dcd17b
SHA512 379cb260b59b51b644c281803725a4f052c197671beb07d3a67b77f58822b18503576b8ec92c1abc8f8778a63806dbb022e2afb847dae1b41ec3761873f65e99
SSDEEP 12288:jAwSfxL/2Dc3qDLLmt0LDQewsAj/IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQK:c7ewsAjQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FF95E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 09c3e6b0615e8e5abb6dffe84ab8f5f25aeee16a528c9914e8cb6443148861a4
MD5 565eecea203c004a9e20b578adc44859
SHA1 025dd94aa5f038e557b36d617af0bba2b1a466f2
SHA512 7052442635ffba1b9bf4c2fbed8d965d2a479dde533dbc3ec3b26943d9ff17211a362d1e3387ebdb42f16181f4871415675d6fe40180c26c95baf1ae36e0b7f2
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHUVQBWG:CUEtQevvqc2W1cpV29I32bB
TLSH
T192474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b6e47d5da977982ba3fef9e1429704170610738b566e0a72d1ce77474cb8bef4
MD5 39b301d513abf8ba331a89697cfd5654
SHA1 606a1da9903a3fb2d82a400591aaf7b3817d724d
SHA512 3edcfda540db69d9c78c1056dc09722119cc0219364e02ed819c76cdbec84d287fdecd5de129a77f1cb6a251f75d6741e3bfe1ef17bcf3398d52a77e222caa29
SSDEEP 49152:tCbRquA/m2yL5zLfFiV+XenmE3/zsDmg27RnWGj:Koq2Vjnm7D527BWG
TLSH
T1C3D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a765653f0e371b730635888e9363ce84f749b0d4600c8f2c507c5422a15c3b76
MD5 27fad2d99784765faf1d93da33f6354c
SHA1 0b89bb975c411baeef57149a56d45f078f25892a
SHA512 ffa824bfec181c29c454f0e163d709c32ddf0c4cb706767fe9d25c53d9a11fbace59638e85ba85dd15c50c44121907ee01ae7e5d4ffff3e5de9f44cd714cf4a1
SSDEEP 24576:OAhGLmIFoiwtA5l7S53HsqjnhMgeiCl7G0nehbGZpbD:OAM1Foiq5rDmg27RnWGj
TLSH
T146359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 7072f083858e3851ad6ce18a7097a2dd39a8042d527ba00a24a69fe6ccb1f171
MD5 67eef438533ea4b22f009cbe8068335b
SHA1 073866a56fc6550051cb667775ba525197c478b5
SHA512 8e5fed60e9f19fd1364781bc0fac46aef7f2230c9a55a4eff2eb2d805de0081f2daae64c4eaf32c39317bf0e93cf2348c231f5fdf89df40d1c0bacbfad490f7a
SSDEEP 12288:7mw5HEjsChNQBFgl0WDm+CEIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83i:awulOWMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CE85F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 55da7c1410a48a43515f71dfc3a4accc5edb151723b436f5f65d18462e777145
MD5 b242df47785c57ea1e1c0571db914393
SHA1 19cbbeedb65e6ebb52d6415c945c025a41ddc135
SHA512 fa8f8f14e424e22e8be1da922d6cd1a7d07104b50af1afc1e0843ebee29df8fb6f78c9da9af01ef12af37d323128d44bb907d307b796ace7ed23a57ca907e8ec
SSDEEP 12288:KtZ1IyPIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MZuRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A27512AE239820FAE1634178C5E5D609E7337C62673003CF16665AAA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 85d1580e96668bde3e98a99449006d8dbb96ecc6e743d320f7b4acb4b53872a1
MD5 34e87deb4523874b8abf40f662676738
SHA1 17ed4e2e33bdb4341a0424f6a6bf7f8841bf2d49
SHA512 d7b96a853bde0ac094912dade87f2f10ce3359ce6ab28b7a3702388979efea6d2bb58457ac6c47d2d1ce693a3e094c8ef0fda9abfe84f446abd9ce7def23da9b
SSDEEP 98304:wQRQyi36YOcPuLvw2gAf+PN3uD527BWG:nQyiKakX+PN+VQBWG
TLSH
T171667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 71108c4c8391a26b1a5fb797c4c7c22facfc774205e737f54f3e97a2599ae3ac
MD5 e84bdfe358540fbf40fe098e49a0f63e
SHA1 14864d589f4c14ae4c872461ef9c55ddb3c3943f
SHA512 7f097b06d8f2dd736e665417987fbc21e022b7f04aeb51c54f06ed371864abaa5ac8924dbcf454f7b57b6e213a799fe104869a39db1e9d8b1f7e7e5dc5772a7e
SSDEEP 98304:aQRQyi36YOcPuLvw2gAf+PN3uD527BWG:RQyiKakX+PN+VQBWG
TLSH
T105667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4ead5142c761b75781b97f5738cfabe7be322bd3c12443bb4300b1a1e05b2c17
MD5 4b13ea6373836f99e2b6a15c22295af1
SHA1 4badc6def99be5a4384860b1b9979f95c0a43290
SHA512 d45ce9b04674784c9b6ab6be3fdef20097bc692eadbec56d3e670b10bd036e783a7d38f9c335864aee15984809fbd21b529776847fbd840ecd8e60dfa13f885e
SSDEEP 24576:ZwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0hsqjnhMgeiCl7Ge:F68Qg55nhxeWu7PNU3/cDmg27RnWGj
TLSH
T1ACB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5c13b172042413b4d506c9f549ad4e13921dc29e2c13ab1a46c475b56151a804
MD5 3960a8f7fc035fa38236a7b461847517
SHA1 dbb1e47b957e240fa09de6d4f6847584b1e9c9dc
SHA512 0a8774d9a042a8215e860b9f0596645cddb7de88326cbb84d0e623a6cbc20c10bd9b2a978b81443edf34de4358845cd0d91f85eead54078446a53491d8278deb
SSDEEP 98304:3y5112gYy5azzVvD69nLKnhZRD527BWG:KLIH+WhDVQBWG
TLSH
T1BF167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2708d940b1ae9fa286e23be4589b94be4a5ff45fb8a55b73b38dc538efb47ac6
MD5 d5c944411d528d450c87214aa4263fc5
SHA1 bbeec6c100159a8f4cf9835b7b1c4b062f035052
SHA512 f6b8dd2dad3e60fbb51da563973fe050a4bcf6a67086bb6cff005737b1f44f5cfd6d067a8512a25f417caccc577580aa1b82734d383cd24763f720c3c8db54df
SSDEEP 49152:EB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glmDmg27RnWGj:eu6JmQxd2dmD527BWG
TLSH
T198D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 633cb5097df1bf2e9d5e899046dce9b794c0b72758969309703248bfbf29e764
MD5 11c6d7267778537157acd6a37648c3c5
SHA1 e4709e0851d63670c6fb45db12194ea826454a09
SHA512 fcab4664d9f101f49c54a49a69bf8b782bb5fd1a02051d65dd238dba066d7fdcebf8f9699a30bb9aef3160f7bfcd769fec4bf01c391c1eb03dfc0bbe13d9f578
SSDEEP 49152:u1hpsNoJpF1A6yU44CwH7R4xCDmg27RnWGj:umifPVR7D527BWG
TLSH
T18BB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d4e16d4211bcda95fcc319c3243c4ad559d511de893558a2e5281b1861778af8
MD5 9ac08ca633377e3a75f5c3e69ea690f8
SHA1 089774225da22af823b4e2d74a8724139b5f8280
SHA512 94efac695a3716e1b55074b8dfd82cad15c0c4dfce53a838456c583a4eb843a75a1afaf33bd988ee07788e9e8ee16274aedf9a4abb4abd64aab416c81b9d938e
SSDEEP 49152:NSuZQIY0Be2KIRVtOnks6NMHqlDmg27RnWGj:D5dKOi61lD527BWG
TLSH
T138C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5ba233e2b946490c8a0ab3d37e2df019353818daedddad16e0dc2561feb83986
MD5 174a23855c8edc1c5c7949c877c7418b
SHA1 786ecef7c4e7963b19fd47b9c27f695d79af863d
SHA512 1042181e4490e47e14908e1f024ce747bf088d71c3db4bbcf1f48d8991c047357f09deba375376098a6c707f31c1239a862a69027377d81ac40ae89e60f1a942
SSDEEP 49152:ohtSn8EApI0figGgiDn0AP5wWDmg27RnWGj:5X2i/ph3D527BWG
TLSH
T1D795BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 682f33e66c7e877ec54dfd57798f10a40461b9c58d48aecf134518ba8499a3a9
MD5 fa1a22b39d0414a12b8b99e680192dbd
SHA1 f6e32b0a14503543e7ad4402f81c4f451a0aa0b4
SHA512 b2d0e89a1251f55ee5abda7b956d4f8065b79b204ff4166112efeab431c226726a2377b02b6d37715a9522ac740d26765fb277eb9bab8678a7f584e9c4158e4a
SSDEEP 12288:IOIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18F6523BF965C41CAE52249B5C3E5F10DAC073E5BE92004937A977CBAFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 c01c65100c66905f33fccf0c1873a43ce84a14028375fa7dc539efe696352fd9
MD5 b6ce0ba1d54727010e29ed3c6933648e
SHA1 b1cd9255791a81a9cf2467bdc711422afef29967
SHA512 ec9a5184a98bbb881f08641f5c7a91becc9c8d6945b6f37afbf2a74df7b93ef295bf207d5449ff6504b100f2f87ea5de5342159dda51200aeba392a71512f4c5
SSDEEP 12288:9bIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9EsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15C6523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 f2dfb3941452ebf51fb3d28555ff64ced275157205ef27d45a262c5e5aeb49d0
MD5 cfe0f4d273f2d34c4cdb80221fa5cd7a
SHA1 37fc806d73e7fcc0974213773d9983144d981262
SHA512 39bc92c1da5721e134d97b8fba4b57679eb5f8e2355744c5e9c2c1c8be4661469a1aaf21130da4e226df3b5fcff839068cf9791b3876ee8be21faa94b44ef8b3
SSDEEP 12288:UlIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:U2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1846523BE965C41CAE52548B5C3E5F14DAC073E5BE92004837A9B7CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 19b5cac75c3281e15f52e7f58eff175acfb2ab76219cc4ad8325d45e3bf5d0ae
MD5 c8db24e2390d85a37aabe5da720a2c8d
SHA1 9e2f7b73b042e0ba3ca5c8684a0c9943bbce5dbd
SHA512 772c78d97a94833dbdef98b675399bc001c332fd708489a36d910180f16b020129688c9eb024157baf7aa667fd6f3a2c6ac854613b320d7d811a0782dc840399
SSDEEP 12288:2V4IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14475236F675C00C6D83285B5C2F5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 ebf798c00cc9756397623777082c5ef4a1c7cde1ad23bba491ff443e2a95f273
MD5 2bef3330447e73e3e213024e80302ad0
SHA1 a39c613f30cbbfe847b73c1e9dc6b87384f1ba4f
SHA512 6f81892def4e7d82f06cfc1dc6b3fe50f897521a6e0335a8d2ef52c84565e1b6b7e04a872c7a8de9e1702e5499677274615501523a6a2a330bfc8a60bf6e2e15
SSDEEP 12288:YgIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Y/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1066523BF965C41CAE52608B5C3E5F14DAC073E5BE92004937A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 52571fca68d222b9c6c5449d9b88dc9bef2883ccc1d62fae18b94c107248ba5e
MD5 d610b4f3268aa848eb7f184a57cd018e
SHA1 c4667ddd49af42624dc31d1495284f69b4e43ba8
SHA512 0589565df8e4b4daaaf484f269d3b3466f1397a671acf5999d99bf4d3aa42ed7932694e11519328f31537b1e623f2c8f163189f1a8676383b11731b806af02a7
SSDEEP 12288:WXIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C96523BE965C41CBE52648B5C3E5F10DAC073E5BE92004837A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 60e75a3b8b8b694a95e058153f52b49f7b24e668a427db6dcac51e99b20a1951
MD5 23456ceb7005ce605f709b29d869bbc0
SHA1 2f0cd64e62921a42552019b611b6a0abd835632d
SHA512 2c94a5348f710c75b6d09537232819766cbddfc9958dc56f28293c5c6e92c7c9922beb1fdd4a914b1028542957363aa125771a76f3f2cf08a67cc3f57336a8c4
SSDEEP 12288:pjIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E96523BE965C41CAE52644B5C3E5F11DAC073E5BE92004937B5B7CBAFBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 31e9210b9c227ba2f68c0b07b0a3571fd205e6c0cc01c321ae479405ef919a59
MD5 4a40453c55a93f14064591b26acc3a4b
SHA1 fd6ccc0b032fd558af1cb4d56220e2bfd7bada2d
SHA512 61820e8bd915700138b5148495f827fbfac5a71ce3dd9e55ec77c43bb540e9ca70d38bc09f4ce5bf516efd0d66e9534005e471b0edc3f25d241aac66cac6ec4b
SSDEEP 24576:RZMmzFVSOksqjnhMgeiCl7G0nehbGZpbD:RZMmzf0Dmg27RnWGj
TLSH
T1058501A9B35018F8EC63813EC965D90AD5B27C5A0B70C61F13A5366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 7879a731cfabdb4ebba9d191554eb4b810ee71bb859d00eabef8b9b6bb3ac127
MD5 363aa5f17604d2d07a932a53bcd9d4a1
SHA1 94a96ccf183d9ba0f1b57fbd138aca5cca4d8f75
SHA512 7a6f4921bdb92ffa00837c07162a9315c18943dcba336bee654cb38685998b26acda1dbf890aaf76eb6c5ce579603c0699d1a862d496b84c93e19407e431019e
SSDEEP 12288:OSIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB6523BF965C41CAE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 cd7cf4fccb492d6cdbfe770128c366fbcd1df5d609f238d0829de896c68da576
MD5 970f4f6c07f69a6ca656ab66632d6eea
SHA1 2bbcff2b12c72397c59469a31d9dd7ee29c39286
SHA512 4a3d5bc4e7b7cee28d642691ca6e58e2285104f46124790198d4dcfc74cbbdd36e4dcc5e06bab658411c0f4bd17fee4793e18853904336093dce0dfb2855bf02
SSDEEP 12288:JmIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EE6523BF965C41CAE92608B5C3E5F14DAC073E5BE92004937A5B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 668ffaf89791540ca99181f3ffa3cbe4815449919794c6317245f580ef2692e9
MD5 57153e0535353ae863bfa981c2acd841
SHA1 489163bce194cc7f53cf76cf4c6a6c4b5f4d19f4
SHA512 064774e6a4e26ef0cfd1f8aab7ce68b48a2aadefd832492be850175511d91a252c9b1724e75d1d965c7f370b56ff8e9c5da3ec3fed7af4b96fdad027b7f3186f
SSDEEP 12288:GyPz5L8PIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7zyAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B75125B73A530F9D1368178C5A29A06F7337C3647204AAF17A506BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 fe2b5b1978ec47b590db5d556ec54b538d1bc38491b4cd15386706e61048f179
MD5 f262ed3d608cd1216fd9bcc0a41b6798
SHA1 985f4fb08e8d5027ad02d0b3d7f161a3084c46af
SHA512 10a9f5709e53914d549cceab292b1b0144679bad467da89782cc89b014af71be64b241a43119998fdc5a95f3bf6a463fad1525fc14ef68b441152401b923d77a
SSDEEP 12288:XSIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E96523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 80dc3d40f2e0d682c3b04181d774424d2d69c741929659426523bc89e2237fb5
MD5 84993b819f7261b0aae1e733c51b92d0
SHA1 c29e371956b6ffc454570c0411113be9b1227e77
SHA512 d15298a92b74aca2ea9a1cabaf764148553060f73c6c9551ec718da8d3bd920b3209b8d0a78a74753d3aeba6b704591bb6b5e4f024611fc8756a4f2037b7f95d
SSDEEP 12288:ESIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1956523BF955C51CAE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 354011d9e2fd767042bbc6760c2b1ba82436f22d359afd1d96fc66ca9e3782c6
MD5 33c6c9d90531255fd5d653fe3dc46e7c
SHA1 76e729648791e0df93f77a605a605ecee619ab53
SHA512 e4109f3abfecb1c25d034bb6d7e306246098ad3c03c0fe9732acc92f6d93e0c97c1020c02d23cbe0e6e2d6399fb48718d028021b7fef4b082747f2afe3e59f40
SSDEEP 12288:XyPz5L8PIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:azyAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15A75125B73A530F9D1368178C5A29A06F7337C3647204AAF17A416BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 d37225a48e315dc5a6ab716b8f53b32938e26c5a4fe983c0cbdcef3c59cd90e9
MD5 41e0f64e8f2ad06774af8cf42da31e57
SHA1 55a11d851f1b138d85d40ad6cd69b986ebaad7de
SHA512 023aaaacb294e80011999476427cd08c46f3587ae1c16913f61b3dd37726ee1302336d96762c34db6a1d0976a685cebdb8ef1f613da5236d29a509e1ec69bf67
SSDEEP 24576:wTDaLl3z0zDGsqjnhMgeiCl7G0nehbGZpbD:wTuLlj/Dmg27RnWGj
TLSH
T1178501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 f0b7aa0f194b8f53f5368ec6ff9382123a1bb2a5e44c1f8b5a0cb4fd55eb2717
MD5 0ee2654bf7ea3e2cabf694dc0724ca62
SHA1 79676ea63d58acd67f690b5e175f28e94c741419
SHA512 2c6797755c14d687244144ec49c67442778783ea6843b44b0f5eac36905a51ddf468284326b8e8d4c526453a655752776e5beb8dc86a2517b7f3379adedebf4e
SSDEEP 24576:q3/d9CHKy7GZ6sqjnhMgeiCl7G0nehbGZpbD:M/d9CHKya0Dmg27RnWGj
TLSH
T15695CF90F3E810E8F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 1a85f58cf1f7f4bf1265688b2e3a0881c2823048e505c176f1320f5ed2a6b79f
MD5 721ae322dec9fd51a606333362e1068b
SHA1 27a09627dd65f141618a4f86d6e8f3b92a161406
SHA512 bb84ea3e9ea606c4ba8d195cae23d2654d21ae0c71b3d26e0de6ca18c315a1a9211bb5abdff3bc8caa8aac6b487834f7d5eebce503393ef05ef5efbd11df05f1
SSDEEP 12288:eFIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1186523BE965C41CAE52608B5C3E5F14DAC073E5BE92004937A9B7CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 b57436acec7c211aad84e00b6bdbaa9d36e6b9e2fc5e279cffe7627389ea7e11
MD5 d47b856e606a020f99bad9e7e2c6577f
SHA1 dd6f683e479b0c52ead1c8790edd5856c5af7a48
SHA512 f531e1b2606ef96b7f489bf13cc718a50b25a8655e960d5b926be65cafe06092033d1ea47991d96323ace83b5702a83bded8bed7c7e36a9e08e8f4f6671933b8
SSDEEP 12288:1vIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1gsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EB6523BE965C41CAE52648F5C3E9F10DAC073E5BE92004937B977CBAEBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 cdc60b8cb19720a5d5b00a651643cf298e52a95f91edc2ba1fe1fcb27bdd4b9f
MD5 dbc266e39c9d3cf6d4e426f46e9d29ed
SHA1 6952d03d1d6020302d77fee9c3edea5fae496dad
SHA512 db475c93893858540814f8a514f62f4a5ed2c2551b78c1a27fdc6e67ca6c1b15cb16741e6a98083303bb6be2602f7f03c8ee29f78462e1c9f8088d540f27bc88
SSDEEP 12288:VMIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1296523BE965C41CAE92548B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 6192483c539c4e5bc73b299eb0542de6a692aa69d79317a1c272081d2c21c9fa
MD5 45ad41c23ea49a41478d89cb38fb9ddb
SHA1 68ac66d71b3fa13a2ee12f489c21f17236cc7e36
SHA512 3faed9e90f0d9405bc628f48529f4bcefaad828d4b97021575f4e38a0344051dd27d5c7219d503a9945942f324f31b623f142d9fe0417be9ca2820a71a301977
SSDEEP 12288:/SIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/BsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18D6523BF965C51CAE52608B5C3E5F14DAC073E5BA9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 85bfc67f1c92c380d5417623277fb0176f7f63b1fabb598cf99feadc3b591f9a
MD5 1df2467128ba0f63451d7d7d45369ee6
SHA1 8ec5d7f14709b46077b907e864686936560df4f0
SHA512 535e9efa38bd6894ab6fd437ba99bea6307d5becace1e844d06f8e2880d67031e1cdfd0b3f475fbee0937a52732c9aa7f0489ed71e173f5d36e0874b311c9d35
SSDEEP 12288:NFIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A56523BF965C41CAE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 17aa1b7f1c1ae649c97a7df619a142157bfed82e5f14e0992a726d408ddc2736
MD5 60d73bbb74ce3213591058ad0c4e82c4
SHA1 e031485319d0de85ee3349a199629a66acba2d12
SHA512 3b227ac611ca92f1abc2a6b5cf43dc8efd9c22309ff7a37daf146524f63aa018f3ff7fa6a44eecfd78d4d3ddc750337c6a59d99ee637910b19922e25f7cc1dae
SSDEEP 12288:86IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:85sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12D6523BE965C41CAE62648F5C3E5F11DAC073E5BE92004837A977CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 a34904493d4bb97e7956996a49d8037d2b244f0e3898b5f1597796a0b71609fb
MD5 78595b8546e2f9a30cc179849096eba4
SHA1 a7be6e586794ca500f11896443053eb7d4b6e33a
SHA512 81d2a9aabbc7870839d20cb1a675b32c79daa58d4d6786abde55257831c38dcdefb2d11f1ca5d07d30551366985ec76882cb0e2d51d2b2cde34a39bf61926c67
SSDEEP 12288:JgIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:J/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B86523BE965C41CAE52648B5C3E5F14DAC073E5BE92004837A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 92b02be4621c8a58866eb4465f3a80413c63490e8a26bd7db98306155a3ea5fc
MD5 2739bd33a449ffa7a485a7c6824184b7
SHA1 fc8351ce577083d2f756a2aa3d9952f5b2ec3e2f
SHA512 63f5d1acae2bb5118ef3a5cae76df6032354810c89ebaaca9c9878ff107f59003e270cab08ca55f29e9bfefc43ce008a8849dc9e75af7f5c8f210501574b1761
SSDEEP 24576:Yfwvbk9RX6wkyAINsqjnhMgeiCl7G0nehbGZpbD:zMnYIxDmg27RnWGj
TLSH
T1B695D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 183512eb1c976880058abb7dd2d3383bd460dd499216427e551ec250dcfbd1c5
MD5 4656aca05553bd1338e9eb3451a4f957
SHA1 ae96ebec892b71546121af07a6def02b6f4dc683
SHA512 c9bbc9157d535ee6ab45063430dc4b188348d43203bd7382e8304347dbe3759ef862f56c14e24b07cde0af1f14d6260b21d788d8fa6dbd5f202418c2316f5672
SSDEEP 49152:XYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02Dmg27RnWGj:5ySzPOD527BWG
TLSH
T138066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9da1363309ecba8ed42ac3d5d13f30479bcf262ed7904a14b3db024e274ee7b3
MD5 e789b4b4472cd5b086d0d9be2069decf
SHA1 aab1ca043d1435815aac93ae2697e67d0a202172
SHA512 8e0c2b4bd19a0c03fde80a9cc6598f49d763ad507b96f8e869aa2d091a98ff1fde6a864b7fee80316e890b807432582e4227ad528a4fb77ab94516d799180c51
SSDEEP 24576:j47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYUsqjnhMgeiCl7G0nehbGZpbD:j47JUQjairIhCnDHUPfF/mDmg27RnWGj
TLSH
T1E565AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 b0e258b4283bdb60514c9cfbe7b676599681423eb1f0d9d5fd4bcb75923210d0
MD5 9c762eb5622d18dc3e404f686798a7e2
SHA1 98e1b24f7c35a6408139fc1c510d1d4bdff0d431
SHA512 c89b9d692b0800ab70eaa1b7e06affbe4cd62a542216f850482324344138bb764a328979a477e7e13e203923d84fb4d08fc339cdd6ff7f634afec936c318f081
SSDEEP 12288:masfCIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C575015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 f08feeb02622b9d6af188aa13257dde701d87678b205afc6524668dd20895fea
MD5 54d758b3f9ac52806c0c29e4d96b1a73
SHA1 051f7a12df4f42574eba78d572802c60ba36f1b7
SHA512 26a71f318c563ceea596d31d18e135fa078163266c9b90c3d56b9de1e87893b05075722e89fa33d356245fd03c76869c7284a6d0610a5fa7ef1a82124bab9c59
SSDEEP 12288:VClpLlaHvza8NEOmyTiRvweVKIYpm95561aa0lbq7:VcUvxE622eVKvE161aa0C
TLSH
T1224517107666C75FC6AD40725E33D1CCAB707D51EE44AB0772C8873F8576A68BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 158e787adb2f957c13f2c5da6d7fa8624ce7e279dd61af1f121e4077b8a1b499
MD5 17ff600acaa7c1219aedab44c97ffdc5
SHA1 f654378701e259e47b5bd0c435723a20474d6485
SHA512 a0d6d52cf4d37c13738e9dc3457aad840ce7229e4ae3caaece67947ca290f6395c8e2fbe5c7b95c142b899c7dd7a1eeb48682695bb000b5a7d5090e225f6632f
SSDEEP 6144:8L4rRq//lio7NztMxqKUahtMxqK1Z7jDoZGUpe+hnrsh0IQkx6Q7TMT:8L57NxanpxhnrsO7kje
TLSH
T17D65E8409136A28FD1BB21B1072A6F4C6768EC177749AF26B3CC053AD82B751A1FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 49c7bb095a0ac98aa3ae9f43c58278e9e0f685dd9aad4a589f6d75d96581be49
MD5 ff23893331205e8d60c4836359a45663
SHA1 6d0264342ed6709254ad8ad24f48ae3be9b997d8
SHA512 cd69ed06347de74c9a541343f8b4536b31bda3d03f91c444fb63799149726540783bdf146a35174f3d93a7a202a1e24a6cf657fe969ff480d95761d2e68f879c
SSDEEP 12288:T77qIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14E65237B935C518AF93605B482EAE12D681B7E669F1004C3BA4778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8d767adaa8f0fe5444cb8e59ae81e574dd8e71def2682370f281b7f7d402f4d2
MD5 1081f51c40f7e495a1f29fc609c3dbab
SHA1 47f12d6651e0a70d96ae833d8725507b1be01a25
SHA512 9aa36c18e6ffe4c4022771f7b96ccfaaa4cab39b3274128629f83db800139184ad9436d5da87d97bcbf8979dd1e5bf16afd46b95aabe29f29c50368c62a336fd
SSDEEP 24576:dgb6bmBIi49WNNFpg1rSvFv7bYLsqjnhMgeiCl7G0nehbGZpbD:dgb4mBIBhGFwDmg27RnWGj
TLSH
T104659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 8f99021395380dcbd2444b1d72867b1c9d08a1b186a335c8c7679c4fa880b396
MD5 a715cca2a67fd81fc816ee43b1414b66
SHA1 a7ffda294f32291ce1acb85de35ba5be78f05280
SHA512 6c3ea9765bd13ac87322c787775fc05a3240bc26a958cbc53c8d5b695a691684b1ed13779bda5e6a1b8fea6079867e2fece13096fdab34f9ed35929e3c34792b
SSDEEP 24576:HG88u8FpJqH1izria7/mksqjnhMgeiCl7G0nehbGZpbD:m7ZFPqV9a7/HDmg27RnWGj
TLSH
T1F8A5016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 52ab6bba8c0d96ad624e640215d80ff5e0dba2c07de9821a59794a6c920e25b6
MD5 e30c71f976b03c92db0907b3c85f3271
SHA1 2c62618d84f2f0684a69c606acfcc141dfcc8dd1
SHA512 f49b8a034dc820150b0b03b1971c7af3ccf45b1d697930c1c73d41c452e6f2ccb2f029949fc5a60030e9bc75ddff93c651b8b5047d487351a6163136da752446
SSDEEP 12288:pHvUrBFrEjwaQnIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:pPUr+NQIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C485F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ab3013f63c78f94374f1a61d32270bc5711f5d3b9e8df833ef076d31cb1aa7ee
MD5 fca81b25277b9d8758a2219ce51553ac
SHA1 a600266363144a3122865fa145590323462dd2f8
SHA512 1095232c1054930405c9117dba90ee0b779be49443eb1dafd294f881a82aa8c4ee58af36ac4e44dcfebee87efe05f11242090386ab0497ea98de7b4efaa6dc84
SSDEEP 49152:HBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjEDmg27RnWGj:4G05lO43b5D527BWG
TLSH
T1EFD5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 abd6acae544de2584ddb02704fd2a2a4ff46acd0e1aa14f6af38dca5ba5d52d2
MD5 5f6993269d0406cc083142a580af2886
SHA1 c26c1598433e6e62da3d8b1cfa8cd6fcd16a0523
SHA512 5c50b90751b93c276170d2e891f513c953c94e9b194fcda2d87c73ba085f35a675ad8a65e31a2ee0747430070743e751e774672960ac4113f4547c1d4ab94c4a
SSDEEP 24576:hfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnysqjnhMgeiCl7G0nehbGZpbD:ha5POZ3hJt2pasx2+mcDmg27RnWGj
TLSH
T11A65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 cb0a391f1d1eacf980d7d7ee85da5dde785f0e63b801bcf30e424e9eb65613b2
MD5 82e790076acdbf2812db6eeca824c219
SHA1 bcccee992327e8346e6679b296dc05cd629d0e36
SHA512 7b2853ac1322946cb36f781751f520104f52adff5e0028f312ba5379d09d5586367db23c41ed6ed1597d8b112041cc94e45b5d93aeb5654a7f40e802ac504225
SSDEEP 24576:NNcwHdjbyQ4nLC18lb/EOjowL7FkssqjnhMgeiCl7G0nehbGZpbD:NNc/zEOVHFnDmg27RnWGj
TLSH
T1BB857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 edfd2c5eab95c3d31bfe14e2a6f6769770c6816c8151554497db4005b9250195
MD5 8027a24f3d50dce68aecf6ef0094f443
SHA1 23ca74a6854ac03a32c77cf96855e3a3ff09a7da
SHA512 c3646532ff5056d294e3ccbb0be9dfb7d730f1264bb41dd17d940e91bbf180a2e4f6fa73657bc32e4947af01863f9247e1c840a375a1df85fd546da1a30204ee
SSDEEP 24576:b3kNvNnaFeYhJNtmZBm+sqjnhMgeiCl7G0nehbGZpbD:b3MwBtOmSDmg27RnWGj
TLSH
T19A55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 eb31c074e8c62f0df43bf5e8fb1ddffe088ba2bb2bbbac9357b63fd2ac6d0028
MD5 63f061a4ddded2a6020a01f73d6d1eb1
SHA1 c7bea6b53ba4e90ea873216922cd27333e69c0d2
SHA512 2856fc8832399e9c630713ce023d33568b1e6c121cb1df47ffefa4df951c0d52f7d47affbf7e0c7694d839bfe8e75f861c5031409c48839be66f48303c3d9217
SSDEEP 24576:oD3FHshBIYQgA1sqjnhMgeiCl7G0nehbGZpbD:oDVHeBIAApDmg27RnWGj
TLSH
T1E795E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 2584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd
MD5 7f7ccaa16fb15eb1c7399d422f8363e8
SHA1 bd44d0ab543bf814d93b719c24e90d8dd7111234
SHA512 83e334b80de08903cfa9891a3fa349c1ece7e19f8e62b74a017512fa9a7989a0fd31929bf1fc13847bee04f2da3dacf6bc3f5ee58f0e4b9d495f4b9af12ed2b7
SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2Hj:QqPe1Cxcxk3ZAEUadzR8yc4Hj
TLSH
T124F533E4A131B7ACF2950EF90566C59B368724B5BBEB1F2AD6C041AB1C44E6F8FC0581
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/412-127-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/412-128-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/412-320-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/412-121-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/716-55-0x0000000002390000-0x00000000023F0000-memory.dmp

Download

memory/716-45-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/716-52-0x0000000002390000-0x00000000023F0000-memory.dmp

Download

memory/716-46-0x0000000002390000-0x00000000023F0000-memory.dmp

Download

memory/716-57-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/1468-321-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1468-323-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1468-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1468-116-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1468-113-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1468-106-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2132-71-0x0000000000400000-0x0000000000AFA000-memory.dmp

Download

memory/2132-349-0x0000000000400000-0x0000000000AFA000-memory.dmp

Download

memory/2132-7-0x0000000000400000-0x0000000000AFA000-memory.dmp

Download

memory/2132-5-0x00000000010B0000-0x0000000001117000-memory.dmp

Download

memory/2132-0-0x00000000010B0000-0x0000000001117000-memory.dmp

Download

memory/2360-325-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2360-324-0x0000000002FA0000-0x000000000323E000-memory.dmp

Download

memory/2360-151-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2360-157-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2360-150-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2628-228-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/2628-67-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2628-60-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/2628-61-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2644-84-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/2644-85-0x0000000000970000-0x00000000009D7000-memory.dmp

Download

memory/2644-288-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/2644-90-0x0000000000970000-0x00000000009D7000-memory.dmp

Download

memory/3964-101-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3964-95-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3964-394-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3964-392-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3964-112-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3964-289-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3992-21-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3992-12-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3992-94-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3992-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4260-143-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4260-145-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4260-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4260-135-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4260-141-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5492-72-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/5492-74-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5492-80-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5492-260-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/5856-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5856-39-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5856-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5856-133-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6020-24-0x0000000001120000-0x0000000001187000-memory.dmp

Download

memory/6020-40-0x0000000001120000-0x0000000001187000-memory.dmp

Download

memory/6020-29-0x0000000000400000-0x0000000000AFA000-memory.dmp

Download

memory/6020-120-0x0000000000400000-0x0000000000AFA000-memory.dmp

Download