Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 15:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe
- Size 1.4MB
- Sample260720-swj1qaev9k
- SHA256 3ff9fb287c820065ff26c05c6b4f9b06b383dd3c5e513204199b4e7eda6528d0
- MD5 db5c3eae7ce5d051233970bba663e07b
- SHA1 dcec21581d4f5f6f67773a07d7d0f57042dc7aed
- SHA512 de1ec4047cc2c3ab80db3c08226966a8bca53a85f6c50233f91e67836a6b9aeadfdde120291c53cd24aae63ddf73494e91fef6843f7a347ee4253e80729745f7
- SSDEEP 24576:aCgj0VfaF3bkT8Aie7wTWLdGI/zMGxYAyxknw4FYnshx8OfVe247:nVVf1T8Aie7wTQzGx4x8EVep
- TLSH T17A65BE40EEC649F3DDB1017154EBE33AA632960A3B16C6D3E3883531B9217D169BA1FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 1652 elevation_service.exe 3500 elevation_service.exe 1312 maintenanceservice.exe 2072 OSE.EXE 948 PerceptionSimulationService.exe 4668 perfhost.exe 2336 ReFsDedupSvc.exe 752 SensorDataService.exe 1816 ssh-agent.exe 4832 AgentService.exe 2708 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe - Drops file in System32 directory 56 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\a6155d2de62f061e.bin elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000090d947a5c18dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000003efa47c5c18dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000033e40f795c18dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005c27227a5c18dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000912a9a7a5c18dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000107fcc7c5c18dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 1652 elevation_service.exe 1652 elevation_service.exe 1652 elevation_service.exe 1652 elevation_service.exe 1652 elevation_service.exe 1652 elevation_service.exe 1652 elevation_service.exe 3500 elevation_service.exe 3500 elevation_service.exe 3500 elevation_service.exe 3500 elevation_service.exe 3500 elevation_service.exe 3500 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 808 Process not Found 808 Process not Found - Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1124 2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe Token: SeBackupPrivilege 2336 ReFsDedupSvc.exe Token: SeRestorePrivilege 2336 ReFsDedupSvc.exe Token: SeBackupPrivilege 2336 ReFsDedupSvc.exe Token: SeRestorePrivilege 2336 ReFsDedupSvc.exe Token: SeBackupPrivilege 2336 ReFsDedupSvc.exe Token: SeRestorePrivilege 2336 ReFsDedupSvc.exe Token: SeBackupPrivilege 2336 ReFsDedupSvc.exe Token: SeRestorePrivilege 2336 ReFsDedupSvc.exe Token: SeBackupPrivilege 2336 ReFsDedupSvc.exe Token: SeRestorePrivilege 2336 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 4832 AgentService.exe Token: 33 2708 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2708 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2708 SearchIndexer.exe Token: SeDebugPrivilege 1652 elevation_service.exe Token: SeDebugPrivilege 3500 elevation_service.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2108 2708 SearchIndexer.exe 99 PID 2708 wrote to memory of 5000 2708 SearchIndexer.exe 100 PID 2708 wrote to memory of 4812 2708 SearchIndexer.exe 101 PID 2708 wrote to memory of 3020 2708 SearchIndexer.exe 102 PID 2708 wrote to memory of 3056 2708 SearchIndexer.exe 104 PID 2708 wrote to memory of 996 2708 SearchIndexer.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_db5c3eae7ce5d051233970bba663e07b_elex_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1124
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1652
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3500
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1312
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2072
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:948
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4668
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2336
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:752
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1816
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4832
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2108
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:5000
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2856 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:4812
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:3020
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵PID:3056
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2856 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:996
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:2500
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 df2a13f1a5286035ad6432973269b831d526690d79613a615b8ba31831ec50c8
- MD5 3d84bdd00506df38ec81676e430c03d3
- SHA1 98c8f7862423873455d6cf8d085ffd233a07524c
- SHA512 3319b9ad892ae00e7c3489992f11d88316ebe847df494c06a22f71bc8dd00f98be849b3b7c8926b92c8da14bc30a4a96410e0462a61641c3b6eba84a042727c4
- SSDEEP 49152:ob+632BuPkFKRrdE6ohmstBhuXjfS4LWxnKx4x8EVep:C3q6HjBFix8EVy
- TLSH T103D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.6MB
- SHA256 f91ad81619e1d0dacb82d03e3ecf5bcca91088a326c081d41ba69729973acad9
- MD5 45a31a23c652b409095b2fa6d8e7b519
- SHA1 ac20423d3a761d72c4f0f02cf568047162eec399
- SHA512 2c05e77543ce731bb78bc8e0e4d56734778d0999161db5eb68ad9acca85f6276a4071d49a3eebe64eb2d2717b9831f05cdad5e7e8e30c17ea8f23b1333bdb5e0
- SSDEEP 12288:p1XLsswWkxy2lRq2czAG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:nXYfDtczAGyxknw4FYnshx8OfVe247
- TLSH T1EF75F12877D508F9EC6B8139CDB28512E633B8954770E38B03E4A5295F336D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.9MB
- SHA256 c6f8d92a9fac58c636b698bd8838386c64d33bb9fc8e095cea3f51369e39b6b3
- MD5 eeea471d71728331e22950e97bc2fe55
- SHA1 d9278aef52d581e591d49f00c76fb93eb0ab5299
- SHA512 e359bd89b51192359399d30f21bb3c403513cc96e875ee1ff7b4c083d70472853d3dc94543c065960e916b40967f024380b2f138393f904060c9865bc99f9597
- SSDEEP 24576:y0Le5ji0hmxFrMnyxknw4FYnshx8OfVe247:yPji0Arrx4x8EVep
- TLSH T13A95AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 94b1ac5ace4e4c675a5acd2cdfd81210b933a6b1443826db2f6e9bdf846ee413
- MD5 2b0941b5ec17bce5c93887f864aef6e7
- SHA1 99c7681cfcf74e362db84ad395bd092e91ba2f08
- SHA512 ef6b8b1d064ef34070d484e5d385a764bb6d1224a4777f20d49ecf0831885ea15de347068c01ed51a6874373b0d94089ce0c16d3fb4e70ee4a45b4eebf90ac1e
- SSDEEP 24576:da7/ezSC6vUyD/aqgrvWE6q8wyuVyxknw4FYnshx8OfVe247:U/ezSC6vUzPvxHjyvx4x8EVep
- TLSH T171756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 1d5396d20cfda6c510ce387179b56c58dc6af645934469fc1c656bfffdc34174
- MD5 b2c53df2146d024ddd11e1afb2797067
- SHA1 1216fd2c344377251be8c0260464a8a76dfa12b2
- SHA512 ac0b1a55c062f27addd93acb642a1bf6cc6ae2d80c1cf8abe70d1cc78fa9300b278ec62bc4ff64dc8d8ead1e32c91d93bf55cfe382e45cbdb8773b157c2272bd
- SSDEEP 24576:MVbqPb88hv/l+66yxknw4FYnshx8OfVe247:MVO88hXl+Wx4x8EVep
- TLSH T1A7559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.4MB
- SHA256 feef66cfe3cde4696c97b04b2b1712d21545b077f3050acb31fb8ac34a329e6e
- MD5 3cc1590acf35b1ed2a250b90d865e4fd
- SHA1 d817250e13302d74d49df57a620cb803b29dd23c
- SHA512 f4dadee95fa87cb00ea40940852b1b5f0decf5e4e6252d9fccbdae30237ec278e4758012bcaec1786a4d4fbbbb7f187198fb2f7bad31381334baf274acf3f409
- SSDEEP 12288:fNr+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:fNryxknw4FYnshx8OfVe247
- TLSH T15465237CA7DDA4E1FA5E14331B7572623616B9A4DA74C11BCB78B14EE0F0C60E06E623
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.6MB
- SHA256 cf3ecb1c3ae75ae7f483d71a4233a4a0da019226057b316726d6c75c3c733904
- MD5 7d44a9984d74bf952b02cdf09df9ceea
- SHA1 86dde8726a99842a92f9fc5a736f70796dfc7186
- SHA512 3b3c104d4b1bf0cc14a6920ba5dc8e60755a538f43cdf06b235419a84e9a46ae86cd5225fb36880fd3d4fddd54700a5dbbc9b605855b250ff7b6132bc4ac8756
- SSDEEP 12288:leBNUbTVO86UC+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:lJIUCyxknw4FYnshx8OfVe247
- TLSH T11975CF7BEE28FCD2C27E4DB95B918600A77274704B6293CBD175820EDE235E05E7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 dd6387ed30c26b0eef4567cf03b4d9db6cdac4d8eb2347dc8ed554ff486e6e9d
- MD5 807991d9dfe5a951365c1a02d524a1b8
- SHA1 e29f51c9c99dae48e969e5cf600032700aed6ad7
- SHA512 1dae4b56cc480d4701af50567832ac12326e3064e1b39763e3fef7b0566ad13ce7a4eb8e1f3a930e0fe81eb5d88999d15c5d3a6fa4866032619e99082d44a1d7
- SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THN:SQvGAdlCEL8c/yRNw5Cwix8EVy
- TLSH T1ED267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.7MB
- SHA256 322a0f5feaa4b7e31805c9e68331e91e3356fe01f9ec0dfc26031895813b22f0
- MD5 cdb7c99ccbbac45f3ae0f3ad5fd148f7
- SHA1 10ab1f18cd3b464e725b4f14ff8ac1763cb95ab0
- SHA512 a7ef638ce9a59e037066b3c2719c51d1425172ed8967b5648c66bbc2a8697259b90821dcdd5f24a6a6b3be3f58214f4a7d4605f54124104a79fb20b153e6cc93
- SSDEEP 12288:TAwSfxL/2Dc3LDLLmt0LDQewsAjY+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:M6ewsAjYyxknw4FYnshx8OfVe247
- TLSH T13F85E030FE74E032C6BF0DB21B36D716142DB9604B611AC3E3F89A9E99705D1637AA17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 5079a5ad6162cedc18502a747b6b0991f9f8a29735a9eb9a01fc9441aae5903c
- MD5 80749dbe242516ab6105c2d839912560
- SHA1 ac5c4ebe66a44e26786ccc7f41927fc752fd314f
- SHA512 03b762e74088e4d2b850f2562d1dd5b317c7eb353d94bb501f491d6307e0b9d9dc8946c8bb47848e5919180cd16a878d0ec4590c5ebabad220c0e31240b84bd8
- SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHG:qUEtQevvqc2W1cpV2EI32
- TLSH T1BB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 596b71970b559ae1503612231e18b150501e198fdc8cf4ef77429a62bb38e89d
- MD5 5014eb3a821269928ec4b20b066b7233
- SHA1 b12caaace33976aa92b44c7022c1aa236d613986
- SHA512 daf0027f9d38c4cf15460a366ba7392ea3b151a0ec719a090b2495496101980496a5e52222c9d2694160c741f2fc6c4f2f4a3b692e55e431c867fd3f03ae6824
- SSDEEP 49152:6CbRquA/m2yL5zQfFiV+XenmE3/zbx4x8EVep:PoqtVjnmUix8EVy
- TLSH T132D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 d9943bdc352bc315881f1c0fce2da8bcd764c085a2e781db73259ebb999ffd04
- MD5 431e9b5e1efadcdafa4093671c1d30ee
- SHA1 8112e23567194878473413e18210e2370f8f9fca
- SHA512 b2ea51874f33e3cb8aa56d4a6b50319091f7dcbdfe2265e127d0eaf3213b02d679be1031d830b889edc68b62e49f224489312c012393d634c10ae2146aa71cd0
- SSDEEP 24576:8AhGLJIFoiwtA5l7S53xyxknw4FYnshx8OfVe247:8AMyFoiq5kx4x8EVep
- TLSH T13C35AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.6MB
- SHA256 d756a36cc138db249b4aa30052af275f9bbdb4cc8a4e2022a214d85a63a11bd4
- MD5 c5e3cc04d88be3cf413653ba0453a172
- SHA1 9d5085349abee27209c846440e8146dcc1f1d82e
- SHA512 0f0225386a9219f966fed75330b572278737bf3fa7ad214097de68af7ac5392a4ec518783c07e3da776890a1f72bfe35477cbbc11d89ceea558de14e11eacf13
- SSDEEP 12288:1mw5HEjsChNoBFgl0WDm+C1+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:wwuFOW0yxknw4FYnshx8OfVe247
- TLSH T12F75F14977E91CF9E96741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.4MB
- SHA256 f9c29d98b0fa1eb2305e9c0b8dcd87d98a5c8022cf4e73bc48db900c5a218337
- MD5 55c5c4e06914b7710536a86f4870b3d2
- SHA1 3c6512a584f983957c7d692ec7a6094b2983d039
- SHA512 7094272bbac8daedf60193d10fdf348093db1841ce5b88ce6d96a3471640c5afb460def5d4d15ebf4ce8bc926e7bb39ce9e3750c455fcdecab54e8d783aeaec8
- SSDEEP 12288:ZFZ1Iyo+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:DZuvyxknw4FYnshx8OfVe247
- TLSH T1D86512AC33E860F1E1A7113A89F15205E77274A2677183CF4764625EAF72DD09D3E722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 034217a1b86170adac03b0820137fd484988478b3caae9c0f66c1d286fd3c45c
- MD5 11346dd12c6f58df60512d1bf3b8fcc3
- SHA1 f5b19ddb0712ceb2bf3ffa6888651024bc87fea6
- SHA512 072b044076986e12dd2318ef1fa7eb1e45b2d614db54d6435bc28fa4711b5d8c41ee5aa1e15d081334abc9164cce9e9c4cb4b456c32acfa4706f6eb286522507
- SSDEEP 49152:6j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U5:ZQRQyi36YOcPQLvw2gAf+PN3Bix8EVy
- TLSH T170667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 38dafa45bc310b66b0459422ce20a813b3567d951f5cd11f5490ee0a9cf23e94
- MD5 b416372d0e90cc838390ff6e35fc7b42
- SHA1 827b11e4467959c4c6f9edddfc675d3715a178a1
- SHA512 e3bcb8b5c11c4ebf8ca9aa5486898cd52027def83c800c60153a3aa9542c00038de98fd50f2d671fda20722f51bd61df8ca89f8ab584b992288fe17a1593004c
- SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U5:9QRQyi36YOcPQLvw2gAf+PN3Bix8EVy
- TLSH T126667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 0d61cc1e3f93285e096d10a28b5669c9e2eddbc58fb4101edd42263f7ab28af0
- MD5 3f6e6acae235d480860e1c6ff61209be
- SHA1 782831b258de85c1987f3198241427d09012e7a3
- SHA512 d79dbf83c430c30600fddb8798d1a30fe35167626abd603af59646722e4847ce50c4d217ca3a84b75379e41a8a8205b770a6e26d39abe162f2beb3053f460acb
- SSDEEP 24576:CwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0fyxknw4FYnshx8Z:868Qg55nhheWu7PNU3/rx4x8EVep
- TLSH T1FEB55A33B2F600A9C44DE1769F46873196D27C758FE0E3DB8515720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 d3d5b2d0892b8d52106f10d5455a8cb9d99c9863331620a4bc81c0c95892e955
- MD5 0e56d2834869c8e50ff40d0f9a1658eb
- SHA1 8ad573cb0ad795fe55d6e171a57a96e98d33a8bf
- SHA512 ad15b69da94c3d1ade49a889386120532450631b259a692e79cc7f995c90b2af8d0ac16d05ff48ce12642282f50a9c40ef51ca2fd8faa5de2182e38fde899f83
- SSDEEP 49152:s3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk997:Jy5112gYy5azzVvL69nLKnhZOix8EVy
- TLSH T154167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 d65cb142c4b19f2084028dd3428044097e91e456e2410d5e3c0f2199ce91d1c9
- MD5 2c5edfc9190072551ef5be0e9b3f10bb
- SHA1 4449e1ae94bdb6d22685ea369b833265fedca1ec
- SHA512 defa399ea7a105d59d756821ca9a7c30222348a89a929ac473f2e38e27559b461383d2dd010a405cba8cf9183d10a1028d1cb48a20994b0f119dfd1fc482dfe6
- SSDEEP 49152:hB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glpx4x8EVep:3u6JmVxd2dpix8EVy
- TLSH T1E8D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 02aa0668eb8b1ec7050745ab05f577ab9b8040c04c271755150aaccbd4cadc0c
- MD5 569c84f82bbbbbdab849fe3775c762c7
- SHA1 b30012c0900290b57a5767cef62c9aadd65dc0bd
- SHA512 ba5a080520232cc8ff45d1dbe58d9d7677541da6f7fd889bc3e35523c68c5d4116ed3420a945f4b474eb7997697781a21d4d3b437aa2863cbe651c65832d2fc5
- SSDEEP 49152:71hpsNoJpF1A6UU44CwH7R4xdx4x8EVep:7mifPbRUix8EVy
- TLSH T1C1B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 41c7c59e49591a40a0ddc00f1373430d0b6b7f8bb4384b1ccea86acb6ba3b478
- MD5 3c9fcf1e35d92e7663032cacbff24577
- SHA1 159a826642e189ce78882dbfc0a2e81181c6f85c
- SHA512 d18e2cb803aa0bac6e7c7d9175b66195e436c65b62d7ade0d626b5e7cf2cc0662426973b4b4b3827a77549d17b4bd2381ff493331e2c7d0c8aee5d1e7881bbed
- SSDEEP 49152:nSuZQIY0Be2KRRVtOnks6NMHqax4x8EVep:95dKTi61aix8EVy
- TLSH T1E1C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 834bbe178014e423bfc95681ac2d950405272127d428c1e44fa9c07c1f278456
- MD5 515b3cff4a1f4a72dad35e0b22d064fa
- SHA1 73967f990383f8ccfe4ddedd98c0c6e85aca8d19
- SHA512 c55bb15d7287a664fe06b31594be7f8080707f3a41de24994ad1fc05ac5228aab08b3bb8fbfd6606c71478891e016cf4baac426703a31691afede567724c5356
- SSDEEP 49152:zhtSn8EApI0figngiDn0AP5w5x4x8EVep:yX2iyphIix8EVy
- TLSH T15995BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.4MB
- SHA256 4cebf82019bdea18610dd4cfbf642f1f9edef390b60ff500daf255df3d8b2439
- MD5 5af59abdc63e6b4c9e58575d4c9ecfa6
- SHA1 9d6176c3528a55d92dcbe9b0daca9699335594cc
- SHA512 259fce03395043dfcf2e9cce215b33b0ff89bbefc457dc8251c58ce61a3aa5920d770bd99e5382f82967f17a6c85f39e71c68ce6775454527067c3a29b9b94b7
- SSDEEP 12288:pT+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:pTyxknw4FYnshx8OfVe247
- TLSH T17865237CBBDE95E2F50D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.4MB
- SHA256 ca7298b70b9f20574044c4b597bfad9f9eff58ca2da917d7d0b442adc562d37a
- MD5 916267fecc69656bf7750974abc07076
- SHA1 b0ee4d215d31d28b83d47a6fac4cfe7b80314581
- SHA512 f75b89a7325abbc660065cef94580a32768b56cb344b3f7fd44f7439799f015186eb677d3e0edb3592b03209510fa54b08a0ec82203c56b6fa666b7d85831b38
- SSDEEP 12288:fM+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:fMyxknw4FYnshx8OfVe247
- TLSH T1F365237CBBDE95E2E50D10734B7163626619B5A6EB71811BCB7DB00EF1F0CA0A02E563
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.4MB
- SHA256 e23f7b72e845c485bb13cd3dc93cf412552f26f6299b46b32a72cd130685d9cf
- MD5 926d129c1d74f071b85f2b8664806484
- SHA1 ef5183b84aac67a94da31589c51731254095ff8e
- SHA512 f2338c98c446c7f7a8f6b22dc4b019484389d2237df6adf426c40beaef63cb8be2db1ffd03fed035d8c16db5a041f04798b2586df7c83ba89b7191ae6f417b3b
- SSDEEP 12288:fq+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:fqyxknw4FYnshx8OfVe247
- TLSH T12165237CBBDEA5E2F54D10734B7163626509B5A6EA71811BCB7DB00EF1F0CA0A02E563
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.4MB
- SHA256 d4031599207ee92d361c0c0bf831e306ec15573cad590d2a2fa07d11d53e5564
- MD5 9cdc06a4585fefd30340b7cb4184dcc2
- SHA1 938966c0c40aa5b8af9037c9b1bce4e51e8b30dc
- SHA512 f4b559993ffb4b43a79da949b12947f0a5579ad0c79f322cd75acca0642e8a8c82943b73572a18454bc3890d3f373166e4803be4b7096ab689bd1bbf7890d03e
- SSDEEP 12288:IVR+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Kyxknw4FYnshx8OfVe247
- TLSH T1D065237C77DE50D2E85A51738A716222B265F8E5E731C35FCB24710EE9B08A0A43DB63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.4MB
- SHA256 09b1040a56b8a63a9a8e3cdd70a57dbf9a47dabe35fb157dcb78ae6eaefa1944
- MD5 6b755dc5c2d896ffc537109fc467820d
- SHA1 e91ed0a50f3fbc91fee8493d7c989304a987b458
- SHA512 116cf84de939faa0d2dd9aeb51df3377e228ae325efc2a5f11111b9d83570f6f47efd513f35c8c57b7407d98fd5fc542f6f6614baa234799d5f58dc7e642ad21
- SSDEEP 12288:+J+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:+Jyxknw4FYnshx8OfVe247
- TLSH T17A65237CBBDE95E2F50D10734B7163626519B5A6EA71811BCB6DB00EF1F0CA0A02E563
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.4MB
- SHA256 428b6edd04f07571a791c4625063626c7ffda9cba0103cbf1161a06964fd877a
- MD5 25566f8a2d50ba5cfd0e6c258151c732
- SHA1 8f96aadf6760822459c3327d88d57db941874787
- SHA512 6ce4664bc40ee9c7b35e478c03a2aa0c7c55a1ca65d9a79ef95834cc4a66dc8aa3cffcc8e8c8fc0daac9aae4bd2cd09124c3ce15190150a29a873d411aed5545
- SSDEEP 12288:vA+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:vAyxknw4FYnshx8OfVe247
- TLSH T1C765237CBBDE95E2F50D10734B7163626619B5A6EA71811BCB7DB00EF1F0CA0A02E563
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.4MB
- SHA256 fbe71157c1213c086536a42c0a03d6661e12495a1f0251ccbae49c60f4e4d782
- MD5 b0e0d111989cea6cb286114e522adc29
- SHA1 6eed6e35e0717f7505fbe12d432286010560f6ba
- SHA512 033f82d24cb174bda533a12f6fa05b90fb2bde9d4459ef82513d1776eb7c890a6c5f1126dfb6af691e63e9d137829868a80f63a240094f501107dee6e269abe1
- SSDEEP 12288:qk+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:qkyxknw4FYnshx8OfVe247
- TLSH T11765237CBBDE95E2F50D00734B7163626609B5A5EA75821BCB7DB00EF1F0C60A02E963
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.6MB
- SHA256 825feeff9b7a232c3364db62199f01f983ec441308f0a93a7176474fd023f884
- MD5 f2b863fa0b79697397ec00abc3b8e561
- SHA1 ebcb1250c5c3187c354fed6d7d5b0205a0ee31a5
- SHA512 caa8ab38a286fae6ee1c1e92b13cdf430d19c593ca1f1996c3a541b41b8b02115a12855362f2ca658f9ad633f705923111bf091813d175782896ab4a2e3d10ce
- SSDEEP 12288:jiZwbZzzFEoS2cPvys+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:OZMdzFVSOsyxknw4FYnshx8OfVe247
- TLSH T1337502A8B39018F4EC67413ECD259916D6B27C694B70C21F43B8362B5F736A05C3EB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.4MB
- SHA256 464281f736bda5d1736ba44f639654bfd002357175169a8c538e1eff3798eb47
- MD5 1bcc3637f1e95d29b421e808c828f8c2
- SHA1 f84bf1f9873190936ae3f0f6256fbbcacffc6053
- SHA512 adea49567736e89de1c8158f602311d4cbfb4300d24fc142e8f9689c5b9fa70f1c4a98c872d9b21137c0da7111ede4b85beef6f1df852504aaa5540a2a49f4f1
- SSDEEP 12288:W/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:W/yxknw4FYnshx8OfVe247
- TLSH T1336523BCBBDE95D2F50D10734B7163626609B5A6EA71811BCB7DB00EF1F0CA0A02E563
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.4MB
- SHA256 defd233292d874ba99e0a485899bbfebd1dbc31413791451ed53843e20bfb13c
- MD5 235da25011865d7f153f126e3b9a9420
- SHA1 26a929bdedc3e183618ab6e16f7fb1ccfd4142c6
- SHA512 01e3afe0312e47b440c8ff569e9b787c0dac9c1ce6de54d9d963a91e8e1c96261bfb1f34544b907e1815fc1cc5ef984b2aea9b9acc4ece7d7289e0be6758955b
- SSDEEP 12288:b7+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:b7yxknw4FYnshx8OfVe247
- TLSH T18C65237CBBDE95E2F50D10734B7163666609B6A5EA71821BCB7DB00EF1F0CA0A01E563
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.5MB
- SHA256 7a5ff9a80470955284ed9d645afe5c4ce032121e108906a35a115065bb03d94f
- MD5 678357f7130ea03f7fafaab227c975a2
- SHA1 a731d1f0a9aa442d485875787a587661eae89352
- SHA512 dea1fd1be87e818154ee39764a9b5fb111fb06acf39d3a2e3e7d0c168b4e84c4353a97d69abe0975f4aefdc4ee74cd1174915c4f5ffdb9a485c1fc22688bc9e1
- SSDEEP 12288:GyPz5L8o+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7zyoyxknw4FYnshx8OfVe247
- TLSH T19775125B73E530F5E12A4236C9621612F372B872473086AF87A4537A6E735E09D3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.4MB
- SHA256 e527f031a2f3655b902e18a5d8eec596fca1effabe8035d0b22e1eefbde341da
- MD5 93600a0302aa92b6c6aa83e3f033b21f
- SHA1 757b8c67453c3b91d35fa183b06cee452cca9941
- SHA512 94d4eef2c288dce2bb432b74645ab34a0f85c17062c5440f3fbd0a8a570d71fd8ad16c471fce759f920b684d160ad4e7c57a3efa2360a0833e267232fd0c7e36
- SSDEEP 12288:e/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:e/yxknw4FYnshx8OfVe247
- TLSH T11165237CBBDE95D2F50D10734B7163626509B5E6EA71811BCB6DB00EF1F0CA0A02E563
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.4MB
- SHA256 a693dadbc59a188eff1507dddeaa4e2b9d9cde71b23bbe7485e4ab1902fc0d09
- MD5 578312c1222e04cca413f526b0b95ac5
- SHA1 f9c8312a6a4b5f83aaddefad21937ff0b5c280d2
- SHA512 d282be13e6c5ce9554c5ac0f4d8058e3b589d3a41c67aad1f9a6ecb1f968ab510d83fcd0f25ba02deca2709fabcd25ac2731955160b8b02a4df1f3aebb806ce3
- SSDEEP 12288:a/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:a/yxknw4FYnshx8OfVe247
- TLSH T1E465237CBBDE95E2F50D10734B7163666509B5E6EA71811BCB6DB00EF1F0CA0A02E563
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.5MB
- SHA256 9c728a9e50b07f592dae4201187fd12f6d20982bbad1cbae340bd7bb3c97cd0f
- MD5 1b13fcac20b3b718bb8fbce4b661f51e
- SHA1 27b93b0415d12dd94b978b170a54e0ec6623161d
- SHA512 a257c1c0fdfefed6ef0efae68bbc91bab6e5a73eeb0eab38d761ef3cd7f6e2d5aa12cf00f90acfa84bad6a358acc3e4e3212e455efcb079b4ff3550979ac070c
- SSDEEP 12288:UyPz5L8o+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Nzyoyxknw4FYnshx8OfVe247
- TLSH T17B75125B73E530F5E12A4236C9621612F372B872473086AF87A4537A6E735E09D3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.6MB
- SHA256 185f58ab93bef5fc60b36e42e094773cc128b4ed1a75b304e6fe325207c426fa
- MD5 9c1aa59ff52f7d0edb1a48f4c56dc4bc
- SHA1 260aba514c6b0e3ef359b2ff57e14dfe45b7d237
- SHA512 97b84d6e6a9b818355daeb02b1582eb7f0feae8daadbf05118112584e82b0d460dde8c437c8b47c9663b00e6feea3022956f3152871d12ab35ab38b2dd10582f
- SSDEEP 24576:vTGaLl3z0zDayxknw4FYnshx8OfVe247:vTFLljgx4x8EVep
- TLSH T1B67502A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B9F736A05C3EB56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.8MB
- SHA256 5d0fbfcdd4fecd5802eb2e5fb8ab14441bf149411db832678f5c3242abef7a6c
- MD5 029a231c1d45a0b2f62eb436fb753e6e
- SHA1 116e948a50ef0d3f5e446e5a6b32fae1fb66765c
- SHA512 c42b0030665e7020d551bc057c3b983fa0a7901635e79ca8fd0815abf062b274fa556b20980bd3b4d2325b5fa37e249a01513e0f2fc4dd36300f432d9cb12010
- SSDEEP 24576:u3nd9CHKy7GZuyxknw4FYnshx8OfVe247:wnd9CHKyaTx4x8EVep
- TLSH T1AA95CF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.4MB
- SHA256 9f100601d2be580db51fa3905e48caa7ee59ea02d07a2b21772a44d0fe9b797b
- MD5 f54835612a053013e9a0e53a98122c7a
- SHA1 1fd169593e408531268d5daff626c8e4501725e1
- SHA512 341cac4fc13888b8c347c2f3a7d1e5a48869cefa1da990a8868a0dcd7dfba6d327cb0a93feed1b20b4d6d8dc1c4c1174b4c3f173a5f12c0097b2b079153dbf26
- SSDEEP 12288:xK+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xKyxknw4FYnshx8OfVe247
- TLSH T1D365237CBBDE95D2F50D10734B7163626519B5A6EA71811BCBADB00EF1F0CA0A02E563
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.4MB
- SHA256 80cbc7394697aa528d742140aae212740cfdc5f74e2dda21b7088bb1eb9513b5
- MD5 aacf7e06537c69f6cc8a7172a0449935
- SHA1 58c892023018f3b1233c3ce62d05ef259c86b675
- SHA512 95cc554884e07d4371649fbcb72b7d4dbaeaa50060c6512dfeb6cb34b1a15aaf2661fe3cae3bfc8a0720841c917fe186d027b61e3169293512eb81e696693f1f
- SSDEEP 12288:BI+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:BIyxknw4FYnshx8OfVe247
- TLSH T10565237CBBDA95E2F50D10734B7163627609B5A5EA71821BCB7DB00EF1F0CA0A02E563
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.4MB
- SHA256 4baf4b9ba7011fd60cbeedb1299f14755d7d1f54c1efbf1fc5164078d313f34d
- MD5 82e624d421efb4604f35668a5c38cab0
- SHA1 9aaa86e7745c3f935e9c50b365e0f5da9966bb36
- SHA512 5955fa6c16e692bc9394b803831c717d62fde15a8a91a7459d78e993adfa5c553c78895cf32b34e0b6d32d82505b26d29be020177104823c416de2fcafb3791a
- SSDEEP 12288:Bt+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Btyxknw4FYnshx8OfVe247
- TLSH T1036523BCB7DE95E2F50D10734B7163626519B5E6EA71811BCB6DB00EF1F0CA0A02E563
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.4MB
- SHA256 0d5cbfdb3660f7281076f8ebee4d30b53d0a7a37189803a040c102f2a9e6c163
- MD5 dd6d1d09303524cd6520deea6043e74e
- SHA1 d403942b9d316bed58a3350f1a524b11a7f5be6c
- SHA512 24423cab412809cc16e08be4bb3a8c59fb1afdbe43dce91b34d15dc75fd24be186f77815e782e25c99fb809ede8937061fee10e070b52ca243f9af9b090112da
- SSDEEP 12288:K/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:K/yxknw4FYnshx8OfVe247
- TLSH T11C65237CB7DE95D2F50D10734B7163666609B5A6EA71821BCB7DB00EF1F0CA0A02E563
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.4MB
- SHA256 23a73b704cb1d22e921765b4391c4ca8fda5da98b41161f2974b768c4c9ac7d6
- MD5 8b9f73c5fea97c24553a47a3f7f707a5
- SHA1 f7007e43b7280ec665708e4bc606589a1a6e7b79
- SHA512 f91ca7078151e33db238357e7240b36ba167a8fe2d4f7eeb24c0af17509d1766bad1f73cc85fa8ab9fb76a9309d4803e070cc7cfa9a7fdb3c7e2e19285feb2d3
- SSDEEP 12288:rK+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:rKyxknw4FYnshx8OfVe247
- TLSH T1476523BCBBDE95E2F50D10734B7163626519B5A6EA71811BCB7DB00EF1F0CA0A02E563
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.4MB
- SHA256 e5a566a0e0db51e3f1d9717859432890b717964b2861f888f5d977ed17ae9fb5
- MD5 435689279b8534e9ae1d4275c01d64b4
- SHA1 3d352ee687c022b3538374daf8f5fc27ab325a04
- SHA512 22ca09241e0ffc28acdeb710b0ff087ea239ceedfb976bfe8b03b1ac7a6b7275339a148a22c38f42f3b8f6213e4e9ec3aad4ad1a5b9cd6c5233f7fd34f362c10
- SSDEEP 12288:2X+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2Xyxknw4FYnshx8OfVe247
- TLSH T19D65237CBBDE95E2E50D10734B7163626509B5E5EA76821BCB7DB10EF1F0CA0A02E523
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.4MB
- SHA256 3a9ded209665c5de48696cde81eaaba00a734d18e5d5ec9024f48b81de671eae
- MD5 3ec514a5b383a7ae1e8ec302a48c3d87
- SHA1 7e205fac6251e63f90830b963aac0885e5a1073b
- SHA512 41bc04c575f5f8983999030cac15447dae6375c222c46978d6df43c56c7f1a3a653bc7b53b349557adfe425a962fa96a1ce3bbdff11f648e18058000258b274f
- SSDEEP 12288:PJ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:PJyxknw4FYnshx8OfVe247
- TLSH T16765237CBADE95E2F50D10734B7163627519B5A6EA71811BCBBDB00EF1F0CA0A02E563
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 1.4MB
- SHA256 6248e9dced7775cab847ec65b006e2a44876bb41f8af2c6bd3f4fa01ad91c6ce
- MD5 4c2af899d273c31e14b8e3100dc6745e
- SHA1 ba643deaa8653802aad03c742689375e444e91cf
- SHA512 bd67b03cadd1c471759cd17447cfbf4490f31ebd94f8694725545c574566c9d4bd1ae5376ccd4ec055f5391faa9dd16383ea37e7dca1e47b1bf6fd1a463520f2
- SSDEEP 12288:xS+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xSyxknw4FYnshx8OfVe247
- TLSH T1C365237CBBDE95D2E50D10734B7163626509B6E5EA76821BCB7DB10EF1F0CA0A02E523
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 1.4MB
- SHA256 9ce58d211a5c01ccb8db559f4ec83343727b55a14f08d433596f6eb292243c9f
- MD5 0c31799f9cf7b0299b186264773e14a2
- SHA1 7f9323be5497dcb8a538eb0524c64173e14e133e
- SHA512 c803e42eb28171efe0fc08d3b4169db0dd4ec249bdfefcae3889aaed187d52e2af0305d7fb24d5b3ac6344ec6addeb0d02ef5917842cc7ddc002b74e873c8674
- SSDEEP 12288:1J+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:1Jyxknw4FYnshx8OfVe247
- TLSH T1196523BCBBDE95E2F50D10734B7163626519B5A6EA71811BCB7DB00EF1F0CA0A02E563
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.8MB
- SHA256 fb25fd5569a346da14bc2fb4943ad15a8ac4248281a1c02d88f35552d9ba2f44
- MD5 b3806bf53e08957d8af349da22e06fe5
- SHA1 23856d709590e81bff79681f75ec3c5c8cc85405
- SHA512 ae91c8b55dd7dbc04c1c4d4daae60528bbb37775b1f20c3f8093491127677638ead12659008aabb8fb3dd3e2703bdb6a829a663b34ec857feee6c9d7d1338f1e
- SSDEEP 24576:NfwvJk9RX6wkyAILyxknw4FYnshx8OfVe247:yMnYIux4x8EVep
- TLSH T11C95CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 164e3ad3043115e0c49505cc7c57325189b802db1a5b6c1f6cce7a4072d0e222
- MD5 b08f31ece9ecdbb12850066514c52429
- SHA1 fe603b67ecc93eebe4ffeca19c2dd67496ca0b95
- SHA512 a6c17bb0d8977d2d079a7e1bb5b83dd4824c46fdf7227b9aa5e008e0a5c1a79debf865cf3373b50bf208512480842a3a9aee7ffd35c3794e89ecb56e132ecae5
- SSDEEP 49152:CYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Zx4x8EVep:8ySzPhix8EVy
- TLSH T17E066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 50abbfa33655ddee38138ba01cc80790734268217dba7c3f6bd18b5bf8c1b3f2
- MD5 c0875e90547cbbf73c910fc34f67f86c
- SHA1 61343f12861ba656976c24abc074ff6acdf500f2
- SHA512 58caf9cab377e2408c981166d8ae8788a799348b85e2a63fa3b737f9eeed31236e66e25f0ac230ed38f71ae4dee789ddac8d824d5f470ef6daf31f6fb185a5c9
- SSDEEP 24576:a47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY8yxknw4FYnshx8OfVe247:a47JUQj1irIhCnDHUPfF/px4x8EVep
- TLSH T10765AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.5MB
- SHA256 cffbfcc14c6c528dfc6dfe26161e521b60a686c847a4763a5a84a7daaab1ead5
- MD5 5f6830983dea913fad47aa3bbf49224f
- SHA1 9b61897a2248c586b969fad39abc0b16c5e7dab2
- SHA512 a1d8cfa3161e3e759f7188f64ff2ba6b38d844a0b957027f39d0f24c49c7594a8c654791aed3ed2f3dc6d1756c53adfa9e2a3114d39f088f57aa37241c695e2f
- SSDEEP 12288:X+sfv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:tvyxknw4FYnshx8OfVe247
- TLSH T1C375F028E29802E4D06E2176CB625641B3237C6597F1D3CB97E0F53E1F71990ADEAB13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.4MB
- SHA256 e09b62e272729d4c520052a72590f4d203bac5889fdaf5b17b78e50abda6102a
- MD5 c08085503b965ef31c00491f5c969ed9
- SHA1 0af5539630e8c2b2ffe037bc7f6c8e48dd694ddf
- SHA512 4faa939ecc2e8c35f7420f61d986e7bf774b6343fde132949413ea3bd0f04a62e44f1f931d785f789c6f301d39a997b0c0aab942140511bbad684d1d05ad454a
- SSDEEP 12288:v47H+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:QHyxknw4FYnshx8OfVe247
- TLSH T1AF65237CA7DEA892F86D11730676A231320AB5B49B70C1DBD728B14EE0B0CD0D87E617
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 7245ffd33677cf7328bd94b8a0a2cb002cfa815fba474015543c5db43ec3a8b2
- MD5 a844ddb900f0caa315a43e29a01e4292
- SHA1 d16fcb46fce5e38aebe792965fff9b33e7ab7816
- SHA512 95dfbb2affbbd271a42f60b819071b6891542a2d3ccf3f27b6b3654c63eea662efaa3dad76004bcbf05e13cf862245e76d3544f7626bec2898d4df34369255bd
- SSDEEP 24576:qgb6bmBIi49WNNFpg1rSvFv7bYVyxknw4FYnshx8OfVe247:qgb4mBIBhGFXx4x8EVep
- TLSH T16165AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.9MB
- SHA256 e9a49b0bc7055ed52bce9463f90ed357d0f8cefce732fff9ddad6371f08a87a8
- MD5 7dd3061ec26943a666c022945cf898dc
- SHA1 1b3abea6fd17445e3e1016ef1e3aeb092c046f75
- SHA512 6c953470e845c0c3084ed0510f314c5fc32178efcb9e5d8da962350e1b5e4a2eff64e1a7c118e15d59b0af3a9667ec31fb14f3578197babdf281ec4da9a277ee
- SSDEEP 24576:/G88u8FpJqH1Kzria7/msyxknw4FYnshx8OfVe247:O7ZFPqVVa7/4x4x8EVep
- TLSH T15295F16877E101F1D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 11636d6c70c25f46ce586425464b743f7cc9ba4178ac5ec4aa72f96c678f8e46
- MD5 524a51c386ca23ff48c325d5a868b99d
- SHA1 b334017af3f77412dc0672e1c8c18e33320bd913
- SHA512 be0335d1419f437420ece688d4df7970be034cf27faaaec2affe2460a5e3fedb74d98174a976da7b605410dca32ec7f937aeeb63d050579f271b3032611479fc
- SSDEEP 49152:+BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjDx4x8EVep:BG05lO43bmix8EVy
- TLSH T123D5CF6E62EC11F9D0BBD17CDAC6460BEBB23425033556CB02A486A91F27FF4957E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 343934fede70d779d0506d7893d7d1250208bc084b7b291561f4aefb3367c261
- MD5 88e7ea23b5da293c69410eb89530dda5
- SHA1 9be34b01759a9f023a3a7dfe4312154c54d83072
- SHA512 c8f942d4cb9ae8685262404a13ae7dc072594c12fda7d20947fa6044a9717abcf5680aa6c96818bee3dfbe656c97cb4033e29374868a47094748e44905780c4e
- SSDEEP 24576:Zfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnmyxknw4FYnshx8OfVe247S:Ja5POZ3+Jt2pasx2+mrx4x8EVep
- TLSH T19965AF5DA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 a1d2d8d38d47fe62925b063e0ebba5638292030b145fde0d952124f3defea3c3
- MD5 21d4561aee9de39c3b53162ecaad4b5f
- SHA1 c24b922a0833cb11756196fbf8fd502f1f6fffe1
- SHA512 3cf5c1a718036f691ff92e1b920cc308100f6e91d2431a6839fa60e89b1f8e55297d36afb2e4d68ce5368479600940a6bab856382a00daad9f328da70fa3605c
- SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7FkUyxknw4FYnshx8OfVe247:PNc/zEOVHFYx4x8EVep
- TLSH T17F857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 7747ced45822f0c33bfa20e57837fa4e8f5ee4d701b8e415de95140e589c8950
- MD5 56954db2c41ec7dda174484155830670
- SHA1 28ff82b0890124398f4795e7fb4ab00fb24279e1
- SHA512 1ca2eca7b955508bbdf9b3fac08ab6bb89cf50f2605c34c9f4f9818fc2784f175579b4db86c461cec601368023b1989ad6f9949091dca03564b5ee43b68f964f
- SSDEEP 24576:l8kNvNnaFeYhJNtmZBmSyxknw4FYnshx8OfVe247:l8MwBtOmNx4x8EVep
- TLSH T13755AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.6MB
- SHA256 841a5935010bb31dec297ebf95fe23c2aacebe10b78dad7f5be3239570b859c9
- MD5 f697ebbac13a83b73683597b58bf4ca3
- SHA1 e6640878315213e7ffdb9f1910a86d97156d12a4
- SHA512 4c35affd0667b222d51e3c86ed84b4fa67d3fbd7864a06db94fb5e6a46e97f301fd7bec0041414ead24ae402ee7b69714f89657d6be3c5a3bd0db88edeeccdc8
- SSDEEP 12288:FHvUrBFrEjwaQQ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:FPUr+NQQyxknw4FYnshx8OfVe247
- TLSH T1D275F12E22ED18E5E67AA17D89924319F771B4621712D2CF02E0817E5E73DE8BC3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.7MB
- SHA256 0c8a49342da001a4f3c64fddd5ae1dbbf73631db65739e9577dbee3980f94051
- MD5 3c7d87e750b66696df9bcb79b96ff585
- SHA1 55a6c1100e20851a23144778af8bd55df218cee0
- SHA512 0314239078a95042228ce0fa588d72a8866f7af57a78b069e04b0a6d0aa8077c83f82c94484294a98e8903d2af348473f5d2f5909a28a2716581132c094ac57f
- SSDEEP 24576:AD3FHshBIYQgAzyxknw4FYnshx8OfVe247:ADVHeBIAA2x4x8EVep
- TLSH T1DD85E17DE79C04E4E57AC1BC8A638606E77138A9033256CB02D491BA5F67EE46D3EF10
- MD5 SHA1 SHA512 SSDEEP TLSH