Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/07/2026, 00:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
- Size 4.3MB
- Sample260715-aev3jsfx4k
- SHA256 af717e5f42e917ee8c140380699218e8526fcb4bfe516e0d0c7c1891fd7376b6
- MD5 e6614f86a2fcb78d80839877b5aaeab8
- SHA1 0039828056ce9143d287ace869ff8734d569cd9e
- SHA512 7447150c816bc1a6bb961cc99ffe219cdc5a35fd14eecfde4bff071b6a3644061b150136237da147f2733d59520a0689e1548058944f881bf98c5d4fbe76c885
- SSDEEP 49152:KUq+q7o7pkkWnqwTqctWYEolBOuF4183lKJEL36jdQ/lFTjN4:Vq+iEkFqwTqGlZzz62Lm
- TLSH T1D6269E01B69740F5EB4F3930186E67398631EA894725EBF3A364ED1AC9325835D3B32D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 3724 alg.exe 1388 DiagnosticsHub.StandardCollector.Service.exe 1360 fxssvc.exe 4660 elevation_service.exe 900 elevation_service.exe 2060 maintenanceservice.exe 2148 msdtc.exe 2020 OSE.EXE 4516 PerceptionSimulationService.exe 4492 perfhost.exe 212 locator.exe 2816 SensorDataService.exe 3888 snmptrap.exe 1584 spectrum.exe 2000 ssh-agent.exe 4908 TieringEngineService.exe 3792 AgentService.exe 4508 vds.exe 1724 vssvc.exe 2716 wbengine.exe 3164 WmiApSrv.exe 4436 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\System32\msdtc.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\a0a4adfa3a3ba122.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002b52590aee13dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000d1b010aee13dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1c84f0aee13dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000847ee409ee13dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\command 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\ddeexec 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\command 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\2 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\0\ = "&Edit,0,2" 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Insertable 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\LocalServer32 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DefaultIcon\ 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\3\ = "Foxit Reader" 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\InprocHandler32\ = "ole32.dll" 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-0~1.EXE,1" 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultExtension\ = ".pdf, PDF Files(*.pdf)" 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\BrowseInPlace = "1" 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\MIME\Database\Content Type\application/pdf\CLSID = "{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}" 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\ = "PDF Document" 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\ddeexec\ = "[print(\"%1\")]" 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-0~1.EXE" 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultIcon 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\MIME\Database\Content Type\application/pdf 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\ddeexec 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\MiscStatus 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\CLSID\ = "{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}" 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\ddeexec\ = "[open(\"%1\")]" 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\ddeexec 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Insertable\ 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\ddeexec 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-0~1.EXE /dde" 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\command 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\command 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-0~1.EXE\" \"%1\"" 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\1\ = "&Open,0,2" 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\server 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]" 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\command 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\verb 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\1 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\InprocHandler32 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\MIME\Database\Content Type\application/pdf\Extension = ".pdf" 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DefaultIcon 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\Insertable 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\Insertable\ 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E} 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\ = "PDF Document" 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\verb\0 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DocObject 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DocObject\ = "0" 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\ProgID 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\.pdf\ = "FoxitReader.Document" 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\.pdf\Content Type = "application/pdf" 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-0~1.EXE,1" 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-0~1.EXE /dde" 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\ddeexec 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DocObject\ = "0" 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 1388 DiagnosticsHub.StandardCollector.Service.exe 1388 DiagnosticsHub.StandardCollector.Service.exe 1388 DiagnosticsHub.StandardCollector.Service.exe 1388 DiagnosticsHub.StandardCollector.Service.exe 1388 DiagnosticsHub.StandardCollector.Service.exe 1388 DiagnosticsHub.StandardCollector.Service.exe 1388 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 676 Process not Found 676 Process not Found - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Token: SeAuditPrivilege 1360 fxssvc.exe Token: SeRestorePrivilege 4908 TieringEngineService.exe Token: SeManageVolumePrivilege 4908 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 3792 AgentService.exe Token: SeBackupPrivilege 1724 vssvc.exe Token: SeRestorePrivilege 1724 vssvc.exe Token: SeAuditPrivilege 1724 vssvc.exe Token: SeBackupPrivilege 2716 wbengine.exe Token: SeRestorePrivilege 2716 wbengine.exe Token: SeSecurityPrivilege 2716 wbengine.exe Token: 33 4436 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4436 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4436 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4436 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4436 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4436 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4436 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4436 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4436 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4436 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4436 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4436 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4436 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4436 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4436 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4436 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4436 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4436 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4436 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4436 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4436 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4436 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4436 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4436 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4436 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4436 SearchIndexer.exe Token: SeDebugPrivilege 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Token: SeDebugPrivilege 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Token: SeDebugPrivilege 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Token: SeDebugPrivilege 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Token: SeDebugPrivilege 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe Token: SeDebugPrivilege 1388 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe 2728 2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4436 wrote to memory of 3476 4436 SearchIndexer.exe 111 PID 4436 wrote to memory of 2732 4436 SearchIndexer.exe 112 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2728
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:3724
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1388
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3316
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1360
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4660
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:900
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2060
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2148
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2020
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4516
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4492
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:212
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2816
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3888
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1584
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2000
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:4568
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4908
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3792
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:4508
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1724
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2716
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:3164
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3476
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:2732
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 0d38c3c941b72b76775f12460d400d1d915778eff5d7cdf019092ab277aa5558
- MD5 bf8e3fe10d5b06da1227feb42f75c0b0
- SHA1 1b15bd5ed9406b94e34f6f141e68e7430f057468
- SHA512 5ef845193cc666f990b4877d5041022fbc7469a987dbc5dfc92f4f03242897093caf0943572436a3abc0dbb66a5908a593370bda6128832db404096cfe7925f0
- SSDEEP 49152:fb+632BuPkFKRrdE6ohmstBhuXjfS4LWxntQ/lFTjN4:d3q6HjBNLm
- TLSH T147D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 02470966902d88467604d8b467737b5df7c72f178c1eed85aa81218db851ce94
- MD5 45c46bf3128c981e4fa10373a73d4a82
- SHA1 b5f84e0b8c70ca7ace756323bd7ce759db1f9095
- SHA512 4b2030eddfda56ce1a808a5bba7e857892db612b92c81cc11718bbe0d944c031bd7db9c455531a0ef94f92846828b849d94bb9424026178babeefd18c32f3ba3
- SSDEEP 12288:G1XLsswWkxy2lRq2czA+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:kXYfDtczA+nQ/tbw/2Mkjy6Fr7g0o5
- TLSH T15805F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 cea174ab9d983eeb4372e6a09885fa1be8aeeaab1d8123d223937782e7df570b
- MD5 04d65479eec1ce5b218870b47d8518dd
- SHA1 8528c7ea6c026e310cd3b97b1329cfec55b4fdf0
- SHA512 8c94f56516db8e844156c93c5e3ed210006d053f009c5551cdb97920c3372e3667210284e1f338a66e2d65c7956da866dcb359e9ff76e088edce413064dd5b18
- SSDEEP 24576:w0Le5ji0hmxirMlnQ/tbw/2Mkjy6Fr7g0ol:wPji0AcAQ/lFTjN4
- TLSH T1BD359E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 25029a7f14e39ec793f7603b3479d13ae0462a355980b8d42e59571b5a002bdd
- MD5 689ae52e75f77b34dacf442468ef6df9
- SHA1 55aeafebfc08b564bcd387ac9d0e4f03e8997c9e
- SHA512 abb76668cec80af940674344d5b9a08a90ccc30ed052b233f340bf83dca67bbba17c6aa7c966c7aebf02213f2b98e2ce0b43695a4266b0ee07ac9021da54b5ac
- SSDEEP 24576:6a7/ezSC6vUyD/aqgrvWE6q8wyubnQ/tbw/2Mkjy6Fr7g0o5:t/ezSC6vUzPvxHjycQ/lFTjN4
- TLSH T15F755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 7f1f59d2ba9a8bc1cab73adac78c7d59c2d0d32b2f8e05e2df3b0ff1ddb1b982
- MD5 8322771fafd53d675a5a665eec26e68a
- SHA1 4323e7691b8680b0835fdad47fd57f97b2e7e742
- SHA512 7e773e4d36fb321a72eda4a7015c759b768a315a10f5123a58f9a49d04850981d8a66b41f05985b932cf022174cd3f694582155937ee793fd28e220f2d71f75b
- SSDEEP 24576:YVbqPb88hv/l+6ynQ/tbw/2Mkjy6Fr7g0oq:YVO88hXl+BQ/lFTjN4
- TLSH T1D8559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 c2d12d1b96c97d53387bb029e94f953c424aef711fd59b704e6946f975a85123
- MD5 0cf15316f5cbdb34295631fdb8ebf25a
- SHA1 2003f98c3f96f203c53e0d01bc62649711b4b9c0
- SHA512 b923b89f171de5e14a029f9f1025e28334374350282da4122d7fba7a05f58690e19e2fe4e90d57e981514af9975c3e87f973c4bbcb4d00f7905a9812be7cb33f
- SSDEEP 12288:tR5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:tRJnQ/tbw/2Mkjy6Fr7g0ok
- TLSH T110C423796A24F897FF2B06B15CC284826B7B0EC1BFD4A74E6B44362D857C39446DB381
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 81e84ac74c560796d0fdfd93c6a07f663a120b5cc8877de8b484631a71234380
- MD5 01ecf6d758309dfa3a987919eeaea468
- SHA1 5834ca20ec9fb0b138a502dac4b2522c0634fb2a
- SHA512 fa9cfe1b6776758489c68fd33e1b04ca690fb69df14283ab95199805037f0654b962242bf658c796ac9440089d87d044fe261dbc35791323b2b199fc4638b09b
- SSDEEP 12288:4eBNUbTVO86UKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:4JIUKnQ/tbw/2Mkjy6Fr7g0oL
- TLSH T1ED05CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 f96137c07a8459edaae7d77283bf6b245c9f85b2b69fdd83fd8bf56f2ba9c3ef
- MD5 597dcfe0addb1311d449aeab77190cd2
- SHA1 5c873fff585da868e8d69fc4e6a611591e38dc4e
- SHA512 c67502a313c83d3195209d94cffea64df86acdabcaf03f2862cc1a3a60457e89c0620edecdc0f00613100a4db8d6dd03a0d24bed1d7da9296f0eb826c37a3ab6
- SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH:eQvGAdlCEL8c/yRNw5CALm
- TLSH T1EF267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 dadaf726052a7658754feea64f6e7ff6a87a2302eb1604d162bb02606a57bcf3
- MD5 0da656d7764cdb23c3b38500402d1b64
- SHA1 e806b41b724df24dfa449749be551160098ad3a2
- SHA512 20046fa4892bbbc39746ab2145e34761491c9a3679bc25fd6a19db6907d70dad3a39e177bc0290f387237f541de9c4aed957a573d2cac3a2cdabbebafafdf138
- SSDEEP 12288:6AwSfxL/2Dc34DLLmt0LDQewsAjQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgf:PdewsAjwnQ/tbw/2Mkjy6Fr7g0oN
- TLSH T18B15E031FE74E436C77F0DB21B22C706583D6A604FA11AC3E3A85A9D99342D22776B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 9d007da7ff5d0ad4cf7d72b224edfee977c87d4e140c6604e8839b1bb137a829
- MD5 8ae71eca79fad8c33f08e7585d75a421
- SHA1 0cdaae7c5aab933bb0e7d1273555d02244d50a18
- SHA512 b5a3ee2b136906534f626e0d833e5de8a981da5360a31d380016f060e77d269ca6821d609ccfe3800fb47ef7521181cb9dc7b4ef6535288dad15b1ba7a86617c
- SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH7L:sUEtQevvqc2W1cpV2EI32
- TLSH T102474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 633b5f64dfae37e52cca96f03dcf940e0b1dd06032e03e0bfc8cc101a1421864
- MD5 ae8bb26d42dd45e3862f108ddc6d09d8
- SHA1 69932e168588e240e5fd20ab8a91d17a99c0c576
- SHA512 ac35130f393cca8684b57ee2a8585dbb68cddcce24dff63d95f5df343fcbe2b5c80580c5e95b29e296163919d5c32aeff71612b4b520fa57fb472a4e5ba4d451
- SSDEEP 49152:ZCbRquA/m2yL5zQfFiV+XenmE3/zQQ/lFTjN4:2oqtVjnmsLm
- TLSH T1E4D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 1d4d6cc3e0fcdb684f5fdac8b37e93bde355b7b8d3a2563b32528c299fb0d260
- MD5 d2a87b902f7af8283b06dc70a25b8f71
- SHA1 13865c941eb56b6e1210146f0683bba519524584
- SHA512 57e39edce1ef1adce956e66c0086daf6c29779cdc422b671ba19ab393578de61c80e44f4504f392b81c334ea2b440d171af96edcc4d86aeb701fbd148dde5045
- SSDEEP 24576:kAhGLJIFoiwtA5l7S53nnQ/tbw/2Mkjy6Fr7g0od:kAMyFoiq53Q/lFTjN4
- TLSH T15635AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 cbc682959f09fb57e0573cf32c21e3a3caea8e1f5f67bcd0d5e446149706c354
- MD5 60198606939063391e340625dcdbcdd3
- SHA1 d4d0220b08d28ac636e03d0b9446011a2fadefe0
- SHA512 d39da40350635ba6cefee2e49a98277a11d07afab0b8d671322d79028b6e2ee28b785de5d1573336b66d1531e43357cddec8563a171430a7776ca49a4f5ce703
- SSDEEP 12288:Lmw5HEjsChNVBFgl0WDm+CLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM8:KwuoOW8nQ/tbw/2Mkjy6Fr7g0oD
- TLSH T12205F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 36b3cd3735b4fe71b526aae65b3c1bf4f194e5f41a3853fae2fb32696e760991
- MD5 a27ea027e666e7ebe3707f04febe7329
- SHA1 45b51a4720494cbd1ea19504189dcd519ca4aa0b
- SHA512 bdc5a8ab616d7b25dbcc4b1bb77b06e4d3e6eba82d8f92cca96724fee880556d2df5ddc7f4a7913e9dc69aad03c5964bcd9fe8b0509fd122500684eb0bc67f29
- SSDEEP 12288:zBZ1IyAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:dZudnQ/tbw/2Mkjy6Fr7g0oC
- TLSH T197E4126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 58f2bf0eb1e90e26540a7ab11290b2159ff4697b36d72f25889f4924f3586cde
- MD5 debcb924c18d75a0af5f42f1b8d1088a
- SHA1 504f7f2c9fe5d329997a99914a091bccbc4a5758
- SHA512 c02f304c2b55d3dd9edc517fbf03882ab2f8a7e0ebf3f313ade8e74ffb8cadccaef353458e036d9c3166ec0f28ba8f8587d8e52d9d28ce14932c6898fad53ef5
- SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uc:8QRQyi36YOcPQLvw2gAf+PN3hLm
- TLSH T13D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 d95e7900ee8248852edec2b2fc7224dbff8df92123e681fca14e72563a3910a8
- MD5 6f5853a23a96ba04e7044cd5588aea16
- SHA1 be6c8de633a8734eaa3c2f35c91a6ecb78dafbf6
- SHA512 95e149d5c02a022bda1210c36d7014ad2e0492a45d49a6272a5dcccaa53da73c0da21c34338ae2ccac2239fd0020f5f7efed6e106b9be1eadf09f9433215a9e5
- SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uc:SQRQyi36YOcPQLvw2gAf+PN3hLm
- TLSH T188667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 f350f6d30766ce5253c32c3c617adf871c36b19b77648ef6f395a789ccee1766
- MD5 4cc75152375ed78bed2bcf4785ad8bdb
- SHA1 0cdce8b83a6b9f17075ef8074313f1c018b2332d
- SHA512 0540173e77705af27ec4855a96fb96d1d02132941c82058838ef9285b59d9b911518aa1bc9bcf1bd2ee72edc0bf5465c37f7278fb07c0a2cb1b40b3f6a9aec22
- SSDEEP 24576:+wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0tnQ/tbw/2Mkjy6r:I68Qg55nhheWu7PNU3/AQ/lFTjN4
- TLSH T123B55A33B2F600A9C44DE1769F46872196D27C758FE0E3DB8505721A1FB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 253f4b6d478aa4fc324df91abcdfc07afc89b2c2f5f617d0af422b61878d5885
- MD5 3872ffaff05053393eeb3d704837d04d
- SHA1 b53de91fcc48be0cf7dce0f05a4a36fcaec32a23
- SHA512 786b716b617e94a78d9e42e951a90532ae9c1239c06cd1d044a9dae91c998a23099596518b7cb01a3e4828355ddad4c3b94ba8f55660fb1147a0bad1c630cc6f
- SSDEEP 49152:53aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99W:oy5112gYy5azzVvL69nLKnhZ+Lm
- TLSH T194167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 d735a59c34125c3d690299ac797af32c9f5180b01cabeb12e4558ed4646bbbe8
- MD5 60cabad74f5722809da918636ed830ff
- SHA1 cf3d5d6e7dce44924c322a4262496f54363c0232
- SHA512 4383011e8edd100e2ee3a4ac5cb7ca10e6078aa8d4f5ade89adbd0c9f3dbe5b0e694c8035894532442bdc722e81a23d22a2c811d8fde1e4829d0a00e08fff430
- SSDEEP 49152:5B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glOQ/lFTjN4:vu6JmVxd2dpLm
- TLSH T180D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 7fc1dce66d89643c1d9466980350f27ee7337ca7f92d354f5b6494d4b6a41b7a
- MD5 028479ffe2ad3582cd727c0ec57894b3
- SHA1 61173a605411b4fcc1cafd5a73ad81cf75454a4b
- SHA512 2f92033cd53173548996186b7dce15a57c0e4b6109d4803237aed189a86012bfa26d8633e353ddf9b82834e08ecf34c3ccab196eb9bdb427dff1905a5fd46002
- SSDEEP 49152:o1hpsNoJpF1A6UU44CwH7R4xqQ/lFTjN4:omifPbRsLm
- TLSH T10EB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 0020c49e81d36995fc84a2d07a9580847bdf8e88990699e4dbb97ba1c143443d
- MD5 db76ad37b8fd819eae25e148779cf16a
- SHA1 eb15cc73829bdaecb7c761f62b50ff39f969226f
- SHA512 826ffd9d3f54c30bc28d52052e8d8d533fd73967dfb6942bddbbfc2f45567921543ab3364aac7d1762697dd74e9367f78d34f6875e608f7266633c5758a6ee37
- SSDEEP 49152:PSuZQIY0Be2KRRVtOnks6NMHqdQ/lFTjN4:15dKTi61SLm
- TLSH T177C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 3b1c2872788e0d712c300682a54668f1eb7dcea103c50aa93b15ef47f2a552c3
- MD5 2edcb1ae5979605a998e3af8d6053a5d
- SHA1 1105dd13d23d01d637e5913ff83e6f8f211b6071
- SHA512 85fdec635d9f193be636cfa864224530069612b9f68318224aeaf208999644d418b865f54b8f6f21bcd2de4a4656ea2fa2287a99483987b3518ef39d6f130112
- SSDEEP 49152:ShtSn8EApI0figngiDn0AP5w+Q/lFTjN4:TX2iyph4Lm
- TLSH T1A095BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 ddf6109567af1cd5a35d3dc1334887da67e54d55ce5bc39773724e136d9832a4
- MD5 563e26dd943a44a858589b2f258a580f
- SHA1 4f4cacf691eaaf0d32ef51377f88d030daa8c87c
- SHA512 3d4c1ac9ed457faa071f9179d63bea223bd5869a3370741f60774a92fb421e2d3ba1cc3e170b27429c767f841bef4ede49774dea1874f2bd3a439bbc168ed286
- SSDEEP 12288:PxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:PBnQ/tbw/2Mkjy6Fr7g0om
- TLSH T1D0C423697964F98BFA1706F18C828182A77F0EC6BFD1938F77482129967D39406CB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 325238a769a631fb024e8cade8e59f37b63850df214adea44eff228f5f2490a4
- MD5 7a65df268ac58d46a50f1f8b7c6b5c94
- SHA1 0a6657e3336b41649a74da1cd25746461c820925
- SHA512 356bc775a01c3898d1677474d32195250a1311496e2ae22420954a2530f1e493b35837e7cc71e824e385ce4cd342d84234eb2cd846a2989620503ea410a7499e
- SSDEEP 12288:gEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:gknQ/tbw/2Mkjy6Fr7g0om
- TLSH T141C423797964F98BFA1706F14C828182AB3B0EC6BFD1938F7B481129967D39416CB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 5ddf61ecffaeee75d21d8a9124d6cf23a64c9b91f44c46053d39bf78bdbffffc
- MD5 646980d163d122790baa2c1fe78e5a20
- SHA1 b62fa38a87c86fc8f09925b5f552f7711e20a5f2
- SHA512 640cf264fc434cb52188a64e01b4cf71548f1c12e206e196817445b11052cddd752df5c399cb9c72cb96e4c2be24e586f4f8f676d12e7773d4272aa7b5579515
- SSDEEP 12288:CCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:CCnQ/tbw/2Mkjy6Fr7g0oY
- TLSH T175C423697925F98BFA1706F14C838182AB7B0DC6BFD1938F7B481128967D39406DB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 d4b591063f9dcdcfd635d04cb22c1d4b84c8c1615c7a0132e960880197acb668
- MD5 31062869017fe358169f941e5a20fc97
- SHA1 eeba7bfc563fc447d13238c792c26d3a40efa3f5
- SHA512 2f5b3ffdc007d90d4eab1cccd2db5c06bec8e937073de52975d44f5eddbf30c558282b6a83b0b63b1455a643b8844b1a9140fa3ab6052d3a4b2f695b751fc50b
- SSDEEP 12288:bVnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:dnQ/tbw/2Mkjy6Fr7g0od
- TLSH T116D423693B69F4C7F92742B4CC938142E77B3DC6BBA1938F6B04111D4E793D41AA6B80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 b2812b6c9f7d7c571adba5236a19679b300ad65456b9388d492a6be304ccde31
- MD5 b1b86ce8766ecb69af95f6260b452345
- SHA1 fd2e9c4f277dd78d50387ea3c999acc3af0546e8
- SHA512 df4b1c48d1316502b22714a4d87759929894b796ad365706030b1f3d7a6d2e8d0636c8a183c30f7cb04903e4ff895e8d0902e8591e435cba91409d122ad6e22d
- SSDEEP 12288:kPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:kvnQ/tbw/2Mkjy6Fr7g0o4
- TLSH T10DC423697925F98BFA1706F14C838182AB7B0DC6BFD1938F7B481128967D39406DB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 0f2a0fc29886891c28dc8d4f71f47aabfd8198f47d4e922bce2b9ca25c98d81c
- MD5 399a0726b3de1646f3779d2829e3e6dc
- SHA1 8407112b970009be6025ea2758041eecc591579c
- SHA512 a5c3b4cff151c1ecc8911f0ca9e9f67ad20799946d9861a08df9dd522c51a141ba093d1408fd514195147d1d335ad3c6797e4ddf3851c63299079abccd8adf8e
- SSDEEP 12288:iIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:iInQ/tbw/2Mkjy6Fr7g0o4
- TLSH T12BC423797964F98BFA2706F14C828182A73F0EC6BFD1938F7B481129967D39416CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 a4917ee65ee025c225e785f71905b0198d01438704ef3f75e67a823f92387942
- MD5 65a7cab685b14c9ac49c57f077056d8c
- SHA1 f7b6e7348e9f97779b8bde7c0a5dbf80f3ea8bc5
- SHA512 6eb5a145047184b528f560a7fa7eb2c82689a37c55d298cf07aa3f64940e24b8c1a028580ee04020c95863d142a389390d69c4b640e7663e41f68313cdea1ef9
- SSDEEP 12288:GMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:GMnQ/tbw/2Mkjy6Fr7g0oj
- TLSH T1CEC423797924F98BFA2706F14C8281829B7F0EC6BFD1938F7B481128967D39416CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 22a08c9504438b7fbe9fbc9f4b7510256d006afebe22e35d4ed89ff8f05ea912
- MD5 13999520c29233868377ffb5ca198b82
- SHA1 4ff56d157da5bd788876dde037a2deeb603e8258
- SHA512 472cee3c37d501e24b9e38e6e2ecf7b7b43d8b6260230add75925ad1b0a988005cf312ccae9cd04058f2da1e3ab49ab0dee93c18aa1c22341cd1d49b52b21be1
- SSDEEP 12288:AiZwb6zzFEoS2cPvykGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:DZMSzFVSOEnQ/tbw/2Mkjy6Fr7g0oB
- TLSH T10C0501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 b639ef45800c99c6a7d1dea6f6440b8e48848abb00e0bb2d8c41c03313196db3
- MD5 931086964971e51111d3c1644a7f7f28
- SHA1 1592c372fac3598264f0c6bd3ea4371e77de7a4a
- SHA512 43e27f51bcf14e0d71cc6987582dac9d0a6f392b84a6ab00ac112625466a949c6b2311a4815e98cb5bab4a23dcd46d802987a91a6f961a66db7f37681baf6d37
- SSDEEP 12288:AtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:ANnQ/tbw/2Mkjy6Fr7g0oo
- TLSH T16AC423697964F88BFA1706F54C8281869B7F0EC6BFD1A38F7B481128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 757de635dfd715fa1198a1e5997b2b192be336a17c3ebe310b501a19cfd77cf1
- MD5 d963d2d96dbdfa9408909d52a014956b
- SHA1 6966009ed086e52ff7cb2f872e5fd4ca78c7e61d
- SHA512 23027ce0694570a63e73e8cb49c0d72556e419fc8b6ff58ffe98d8b21951bc15408eb11b29a01ff2de579b8d65dc807b9038c0ab8fb6186b5d3faeee2e0e1abc
- SSDEEP 12288:9pGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:95nQ/tbw/2Mkjy6Fr7g0oo
- TLSH T1B7C423797964F98BFA1706F14C8281869B3F0EC6BFD1A38F7B481128967D39416CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 14d2be092a7fd83da96b4d89bee554f0d2026bc157b683add090d7492cfd3813
- MD5 8a6315cd154c24ea5d4ec4aacc758530
- SHA1 469b8cbbcc7d52a102c7756ef95cbc9cdea4f2ca
- SHA512 81214e8f4d0f03b22035af11e225ad5e45d9ed85283177c5225fd0f0690c98fd1b80d28964f5b4f6bd82267f6ccdcb135c04487f60d8e6b8332a6da32d60f50b
- SSDEEP 12288:/yPz5L8AGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:yzygnQ/tbw/2Mkjy6Fr7g0o8
- TLSH T1F4F4021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 fd9bf9d1c750ed305505d5a5b63e5e43c4329b3b553dc8473568ae4807defdf0
- MD5 a709b2ce096a729c536ace575e72f875
- SHA1 31ba615935e28ced9ebd4d69c96bc187e4f9af95
- SHA512 8ac2943caf374fec2b7126c457ae095032202bdf5d7e2061994289ae34f94727a95ef63913e45c56ded1a481597eee3d80326461b9abb7fd81f5db6933c4eddd
- SSDEEP 12288:JtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:JNnQ/tbw/2Mkjy6Fr7g0ol
- TLSH T17DC423697964F88BFA1706F14C8281869B7F0EC6BFD1A38F7B481128967D39406DB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 8149c341caf556e2a6573ca6c43963cc7d2eb3b7d367fcb9faaeb894b99ad2b3
- MD5 05bc12edbf4b76b041d4d70ac846e2aa
- SHA1 8efdfa77ec6e2311577968ecf63c55aca975651a
- SHA512 b653390a1709d2097a202c4879adbb017b7b99352e59ab1fd4f3c08303299498f4d5305a3513b09bb00aea8335b10f52d2cba22f6f1cd713d62a9331e2ade136
- SSDEEP 12288:/tGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:/NnQ/tbw/2Mkjy6Fr7g0ol
- TLSH T154C423697964F88BFA1706F14C8281869B7F0EC6BFD1A38F7B481128967D39406DA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 717KB
- SHA256 548780d8fad5fc10353ec803d1e6784156e8aefc6cf296c0e731596c367e948a
- MD5 b273467d86c3e4a4c8c8fdc55fd43825
- SHA1 c58e083afa8df4acdac646a0af5105471eb87676
- SHA512 7b9c4047caaadd9eebca56a5fff761ebc6d0deeee27e40edad8d172740b281d75c5ed547d0f2323e872a867b329100871d1492cec8e0652e9e80c9f4c63aa8c4
- SSDEEP 12288:jyPz5L8AGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:OzygnQ/tbw/2Mkjy6Fr7g0oJ
- TLSH T168F4021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 ee7e8974506aa757bd8aa247feceef90353797a237b36decedff3e100173eda4
- MD5 ef264ef9fe5c8b038149c9195c6005cb
- SHA1 467e4487cc60f62a6bd7d5baa32006d87db7dc39
- SHA512 2bb2c96e8a53ba83cf5c0a0aab50cddb1a64da9d4a3c5c43d37d2e473c2156e6dc968125d6ccf6ba0c36ef289d5468fa49bbba6c32d6480a320fcfabda02b653
- SSDEEP 24576:kcP4mcvIjkGOxhKP2l71nNKbrh/8KB1nQ/tbw/2Mkjy6Fr7g0ov:fP4m4IpOO67W8KLQ/lFTjN4
- TLSH T12C65AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 50c49f42411efb04f9d267eb2641478e55a158a6f7ac2f6ce440af64b0063cc9
- MD5 dbede197abe4513854c5d24ba398613e
- SHA1 e84e35b1a49a1e62d30a148a7e9a4e6e312b3c4d
- SHA512 cad84ff3c1efc5484be115cc6ba15d00cbb488e614114623f05a3abebe4493beb005f45b1ab4ec36cc7a1efe05115762aa1b02e541e1978cdc9b949bb2571113
- SSDEEP 12288:fNsf9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:8dnQ/tbw/2Mkjy6Fr7g0oa
- TLSH T185E4F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 b400b10bc93962b8348554996127364b6b006e3b682e50d33be80eb48a67cee9
- MD5 a1d618d6c7715b5b5ccb9128c34559a2
- SHA1 fcb30ce83b8bcb88f63b1b11088b2ed78c60de45
- SHA512 cdd0bb5474e6c7cf11232ab2713eb6f10739ef7adeeb6079395f9fbb23d12fe812a9ae816bea680f55be1ea1fcd10f40918e235e0073f2555881feca296a3f59
- SSDEEP 12288:1dGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:19nQ/tbw/2Mkjy6Fr7g0ol
- TLSH T118D423696768F94BFA3B06B05882C151673F0EC5BF90D38FBB08222D957C3D41EA6745
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 b06fd0fa053404f7cea4a23e46db2b31739a9b05eadca0277eaa73f7664a6e8e
- MD5 710613880ed5a92e25a7507b57fcf44e
- SHA1 2594b6fb07f9cafa4e974869a2e1f7aa808e8c08
- SHA512 71972f314e2a32a2048bd6a7c35bd9a9fe7069487f514592d5e7daa933ba954e2c2eac678d84343a1bb9bce95000cd4a69594b9f9b56ac0e0c23f692c547207e
- SSDEEP 49152:qa0h2GEkuAe73q3pp46zwwQvQ/lFTjN4:qa0hNYG4Jw7Lm
- TLSH T1EB859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 659KB
- SHA256 fbaf844df76812a6e950a90249be23b5fabcc728a42306a55d44f5fe8ab1ff0d
- MD5 39352eaaca618195288439c5c2b3cf23
- SHA1 849d2f2f2bb33635bbcb6c193d07db32996eba9e
- SHA512 f27285c986783c29133afbb7c3081b6ff605f62ce30118390007666541de500ea9a5532bf8c3fcdb0985388aadcbded7f734323ca61e5e7734d11dc4e30f479d
- SSDEEP 12288:+hbHjfXUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:+hbHjP0nQ/tbw/2Mkjy6Fr7g0oO
- TLSH T1C0E4027D26AC30DAF63692BD88928546D7327C552B11A3DF2381423D4F3BBE41D7AB81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 224b87cde6082bb18bcfebe3d79a5c3f08d6a3b64e0f0a4e4af0f63adea2de94
- MD5 2f28ee1815beb41a36dc1865ae21bbae
- SHA1 7993c7b215289aaf2d2bf0c396a704936afe2ed7
- SHA512 54e80875a9d6d32d6d16ea74e4b3d414eab2d3ed761d771a47610bc1e0ce594343d8592b226df44575d1c25a3d04567727cf7689366f2bbcc39509c1da0040dd
- SSDEEP 24576:Z3YgnJcRTk4yti+R5dBR/8nQ/tbw/2Mkjy6Fr7g0oE:ZIgnaTk46pBR/8Q/lFTjN4
- TLSH T16745BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 578KB
- SHA256 12691cb36e648de3bda5a78a6ff22471034de9c10a0e9c3d9bc03b192ca1651a
- MD5 ded410035e62a0880ee694d76945f17b
- SHA1 41980ba373ef4f6f147c22c7a074b6ae35839649
- SHA512 fa4c9f42f2788edf64cf90fc3349f6ec1f2dff0ef20a243b9ed368c67466dc5adfd24ea41c36eeaa5f7b6012cf34204d3e660ae879a82bcfff1611b732909c5e
- SSDEEP 12288:pZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:ppnQ/tbw/2Mkjy6Fr7g0oV
- TLSH T1D5C423686614F98BFA2B06F54C838546673B0EC17FA193CF7B48222D967D3D41AF6780
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 940KB
- SHA256 5866fd27d4c3839395e955fd24288e9ceb195c40a5483e9181c668dfe8f8c712
- MD5 8546cf6d0d2f31b3417216ee24ad8946
- SHA1 1791002616166c8ac924733aceb0aebe13dbbd9e
- SHA512 b184b05c790cebb63b269c84424d316979e8ed63a289f3cb0c66008dd7f31b5a1fa9d83c8dfe49dda1191268480505af4771b403694db8d0406ece5179b235ce
- SSDEEP 12288:/Ob9A4LWOsvAYFT+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:ApL3UT+nQ/tbw/2Mkjy6Fr7g0oE
- TLSH T1E125F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 671KB
- SHA256 bd1911c6cb0012633186080e35f79cf9693ed6981bb14ce1233ceda3335792eb
- MD5 2156d554dfa3b66efd835efb4bc14700
- SHA1 21e22b95a2a181b59a55bb2f3c26a75c2ef8eab1
- SHA512 1d0549c80a754c13021d2c3244f58d53772a98fd535ce43244307e10ca85cc5a0475ee8e6b913d533d07fcab62b87300eba99d9f0bc354d631c032c838789415
- SSDEEP 12288:wpFtpOqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:yOqnQ/tbw/2Mkjy6Fr7g0o9
- TLSH T15AE4022D36EC60E6E536527C89838249D37278921B6253DF0780817E5F7BBF81C7AB81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 9fb87c1f321b5b80383fc1a2674e73a978341b86c810cd6540387dd5767f47fe
- MD5 76fff7f0f0f45dce9bd1dcfd150b3bd9
- SHA1 6df75a3020e18491939b02d141c3693fb119effa
- SHA512 b3c62da8daf762636766cd26f88d4f9c370a83f25a99cae45c3e180e760f389cee7ea2887fa53d09306556d32db80246951567d05f01efe0e161e286a7575deb
- SSDEEP 24576:W7NM9YqZqmWMUkPjZM48Mv6bEhsNnQ/tbw/2Mkjy6Fr7g0oo:W7cBWMpPjN8DbEhUQ/lFTjN4
- TLSH T199659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 42d4af36659c36a743b994810523c87fc87127301670ff1f8b1002ca2be3928f
- MD5 0a8b2f6b99bb8179b4986c49fc412c67
- SHA1 90a834ec544549c399505e3c7be0303885eeaca0
- SHA512 4ff93c97ff8e686b2add6d8f2fdfa2f597835bd353e714e30f795deab9975812ccb15374d46779079c2c708fe8a699763139621ea1a00846081ec57ef3698c11
- SSDEEP 24576:NW6BApg2YuyuNDYTabvcdvNYf8km1jnQ/tbw/2Mkjy6Fr7g0oL:NF2YuHNETovAvNYf8kmtQ/lFTjN4
- TLSH T139857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 15e5591acc075058de592ce56fff912494ca9764d26f508e7c500267947e2970
- MD5 3f609411cc8e26c69862879819a7a018
- SHA1 3d07ee14d8910a5e9653dbeb6ebe682ae239d936
- SHA512 f7dd381a3d616fbddc3b0ce4892c1b84f44f578336aed4c42b0831854d7c6196f767c2889a18a15037424f0349826a65c07f76b07ba58b4fa36d469ad3f55b84
- SSDEEP 24576:rAFs06+Omlf3NXEbTo2nQ/tbw/2Mkjy6Fr7g0o0:kFs060lVXuPQ/lFTjN4
- TLSH T14265AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 885KB
- SHA256 0eb06b6755078fc3b6207879743bc5fa2ec8575365509b9953851ee3e77ad7df
- MD5 828da766f57e9922eadb0c74af49f579
- SHA1 20ef3cfcb80a17b6045567dc89c5045b986c38eb
- SHA512 2eabb5c8de971bafdc1ff595bff234426d6e02722f7abc3b72e71de7ff9fee21e3e900fba8d422508d63f543af6df9862c21e5ceb8967ba47b77a93e594bdd5f
- SSDEEP 12288:rCJnJ5D3VkrDzxNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:mJnJ5D3WXPnQ/tbw/2Mkjy6Fr7g0o2
- TLSH T14E15D03DD2A810E9E477C2B4819A1746FF72386D2F226ACB2864D5357F22FE05979F04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 f782f88b2ab12d738352f99ca7d472a4c507b2da76128d112808d4badf86ef3e
- MD5 32647d9b68f02a6143e87990f74f4f61
- SHA1 25a46478673ec09aba9a8d60ff76d610a4d4ab60
- SHA512 bf85bff1d36f29e3161869b109765968630db81e8dee391b91a42627c3eb7085f2d33964bd4e71d551670c40d6927a6ff466fa550c543d1913fca303619156ae
- SSDEEP 24576:8EPghm6/7IIXdwcXrif7qQncjlP65i3Vu8nQ/tbw/2Mkjy6Fr7g0oi:jg06DIKdwc+eQnSt65aVBQ/lFTjN4
- TLSH T1D0955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 661KB
- SHA256 ea6420b548959238ca6d3be01020af61604fd020bd38b647c5e3e7ac0e4c2c33
- MD5 d71b408d530b64eda6f7985f46c49785
- SHA1 75859887b650b2f965c6b9ca415a1bf4e5adc850
- SHA512 eab899cc8de546fb44f77c20c370baae3b2fd211da8cff0c85e8e02cd726693419469cf96b890dce6b289a51facf8dcf7474d19d2eb91e4d0766e3bee8ca9c21
- SSDEEP 12288:LEP3RnLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:Qn7nQ/tbw/2Mkjy6Fr7g0oW
- TLSH T176E4126D27ACB0DAE52B517D88918145D373F4A12B5267EF2680823D8F7B7E81E3DB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 712KB
- SHA256 aadcfa5890591c0160ca9cae5f91c8831898845ff01bbbfbbb188a1dbc47cbe0
- MD5 9ba076f5ba854e298c87008725ad219e
- SHA1 55e2aa514ab9adf1a9edb295d644a5d6c6167552
- SHA512 ba646f012a316a72077ff52b20639cb0aba5a46ee144e8984e66a7009eadcc152a45040a5009cf8ba877a8092ee80a30a75d70be118d8d7cb2a803884bc6510a
- SSDEEP 12288:UjkyEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:UIyknQ/tbw/2Mkjy6Fr7g0o/
- TLSH T1BBF412186398F4C6FA7A06788DA381919B367C506F2193DF6280F23E9F3A3D46D75B41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 584KB
- SHA256 58574811a69c1cbd2c90687937b64d6f5edd4fde70c8b79074cfc0a3a975995c
- MD5 a3fee74fe5e644781b11c2891fd89a6f
- SHA1 fbe08611138a185991aa386b5808b08fea5b3b92
- SHA512 e6a969849d520efba5d35ea62b1496e3092d1da544aba071990aa4bf47c7e8befdbf46a7798a6020f53f4b2bff775d6af931dd1b86e0997a191b1527dc1b35b8
- SSDEEP 12288:ZyaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:IanQ/tbw/2Mkjy6Fr7g0o9
- TLSH T1B8D4236C2625F89BFE2706F448928582973B09D17F9163EF36846239CB7D3D416F6B80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 20c3e7f83d6df893518bf8a6297793cb3a6aa71760b5f850fc5ef9df31a1803e
- MD5 dd61a69f581024ce5cb2805814348754
- SHA1 4f12bf192aea8e40384cbe17080bd42e9aafaece
- SHA512 c99e1977a9870650cf958528652e766da997f066c389a58e056c3ca4e6385fab8f6c3aada12b1f44d34695841639f6ebd04db0ce2de0c8c76f55d497020df41b
- SSDEEP 24576:5Q9MxZKdcz9dw3FnQ/tbw/2Mkjy6Fr7g0ot:5VKZFQ/lFTjN4
- TLSH T1D3558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 772KB
- SHA256 0f3d93d9040fbe85ca0ed08228b94f53a9458da6b39d9359e94c4f2470baaca5
- MD5 0ca29249b4c569863e80a896712c7970
- SHA1 497f167ea342fe972f892624df9af0781dbe1759
- SHA512 63027f399e59ae21182d193109667873e46750ec84e8ae4e8f05ac1d1083e757fd94eb32c5d963607b49b8963bf5e0cd373231950a72b48b512b82a4fa54e5a4
- SSDEEP 12288:LyoKo2JRple9pQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:LyocDApwnQ/tbw/2Mkjy6Fr7g0oy
- TLSH T136F4E01FBB6990A2E136813C88818745E773B4706B6263CB6691C33D8F776E87D39B41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 7582a222b7d0fc69a09919caf9d99d2515c0a2ba5fdd667484d16c856c32147f
- MD5 03cc104d0b7126abc5cf765e4153409f
- SHA1 937de48a9276c479c2782cab5c07a9ed6e32cb99
- SHA512 1ce942af4447ae58f770db1366726aeea8994438c2d7234329b2c18a34c9bb6e88593046c011b442a2c96e49bbe99c17437e9bbb692c1a8ddbe50338d4cd486b
- SSDEEP 49152:SWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKwQ/lFTjN4:E0zuNIZLm
- TLSH T11CA57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 cb9cbaf874409e8976d5928b7112b755f83c6d1354e940cb2a9401c7265c3bcf
- MD5 35ff0c2a60bfdf3f5ced9fa393a4a07b
- SHA1 83b5745e93f317032137cf16aad5cb8390e8e3b7
- SHA512 e428b01f61918587593ef912f650b58e51c4b5e6d978c02cd0838b109994e6bdb80be694a4523a0032b6977a11f7300e57cf39bf26f1265a8ea78d0b39efe044
- SSDEEP 24576:o1QT7EcpfxR+N5AWAz3ooiYtjMqb7nQ/tbw/2Mkjy6Fr7g0oV:VTDxR+N5YzTfjMKQ/lFTjN4
- TLSH T1F755B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 877KB
- SHA256 ca8021df086b0a1b97a85fae8aaea8d6a9a586899cd01f28af6563a5349851e2
- MD5 7e44ec5df20ff7a15e7a25a3e6ee826c
- SHA1 91c752d94fc5e0611e500615d953ed606fe25d3f
- SHA512 a20fe5d8e2f6442aec466f7fa02660624206b078e3982b72385c1b0e120e1658bdddab568467a9a1a9113f1f6f480dcd29145e6c98b7d925d5c33d038d872097
- SSDEEP 24576:MTMdOz0FFS+imSLHnQ/tbw/2Mkjy6Fr7g0oE:E0K+imSLHQ/lFTjN4
- TLSH T16A15E17E636D14E5E53BC27D9A438906E67334620322A6DB0690C17D2F6BFE4397EB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 635KB
- SHA256 cbad680ea54c22e4f1fa2c87b822dece55a89e7eb6b5c2afc26a2185efdf83fb
- MD5 9ce2f30dafaf2a978594d47b31f3fb25
- SHA1 98ffa866dfb5650bead717568dd5580ab62f12c7
- SHA512 2c1206a60f10be253a10d593de83feab4c70665c557341a4507b1a044e652e8b0bedc5ee528bb2fcd3311acf5d400a89335d414699d2cf1dc826ae9c60af57b2
- SSDEEP 12288:u4K+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:c+nQ/tbw/2Mkjy6Fr7g0oq
- TLSH T11BD4122D23E874DAF93352B48962414697327CA2276167FF36C4C63E8F3A3D44979B41
- MD5 SHA1 SHA512 SSDEEP TLSH