Overview

overview

9

Static

static

3

2026-08-05...ry.exe

windows10-2004-x64

9

2026-08-05...ry.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    85s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/08/2026, 06:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-05_fa170fb7248e01916ba500da1288e385_elex_wannacry.exe
  • Size 1.5MB
  • Sample260805-hfk8qsfa69
  • SHA256 3ec5322534b19c3041af3b53a227520520f7be74cf9dca2cbb37ffb3f134dacb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
credential_accessdiscoveryexecutionpersistencespywarestealer

Malware Config

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Executes dropped EXE 15 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 49 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Discovers running processes 1 TTPs 1 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Drops file in System32 directory 28 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 49 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Connections Discovery 1 TTPs 1 IoCs

    Attempt to get a listing of network connections.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Discovers systems in the same network 1 TTPs 1 IoCs
    discovery
  • Gathers network information 2 TTPs 3 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies data under HKEY_USERS 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_fa170fb7248e01916ba500da1288e385_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_fa170fb7248e01916ba500da1288e385_elex_wannacry.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1936
    • C:\Users\Admin\AppData\Local\Temp\2026-08-05_fa170fb7248e01916ba500da1288e385_elex_wannacry.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-05_fa170fb7248e01916ba500da1288e385_elex_wannacry.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3368
      • C:\ProgramData\Application Data\wmimgmt.exe
        "C:\ProgramData\Application Data\wmimgmt.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1664
        • C:\ProgramData\Application Data\wmimgmt.exe
          "C:\ProgramData\Application Data\wmimgmt.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2504
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /v:on /c "C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\ghi.bat"
            5⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4584
            • C:\Windows\SysWOW64\findstr.exe
              findstr /s "YM.CGP_" "C:\Users\Admin"\..\*.txt
              6⤵
              • System Location Discovery: System Language Discovery
              PID:5200
            • C:\Windows\SysWOW64\chcp.com
              chcp
              6⤵
              • System Location Discovery: System Language Discovery
              PID:6012
            • C:\Windows\SysWOW64\net.exe
              net user
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5696
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 user
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3448
            • C:\Windows\SysWOW64\net.exe
              net localgroup administrators
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3056
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 localgroup administrators
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4892
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist
              6⤵
              • Discovers running processes
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:832
            • C:\Windows\SysWOW64\systeminfo.exe
              systeminfo
              6⤵
              • System Location Discovery: System Language Discovery
              • Gathers system information
              PID:4600
            • C:\Windows\SysWOW64\reg.exe
              reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4900
            • C:\Windows\SysWOW64\find.exe
              find "REG_"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4480
            • C:\Windows\SysWOW64\reg.exe
              reg query HKEY_CURRENT_USER\Software\Microsoft\Office
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1544
            • C:\Windows\SysWOW64\reg.exe
              reg query HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Common\UserInfo
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1176
            • C:\Windows\SysWOW64\reg.exe
              reg query HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Common\UserInfo
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1876
            • C:\Windows\SysWOW64\reg.exe
              reg query HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Common\UserInfo
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3980
            • C:\Windows\SysWOW64\reg.exe
              reg query HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Common\UserInfo
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3008
            • C:\Windows\SysWOW64\reg.exe
              reg query HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\UserInfo
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3496
            • C:\Windows\SysWOW64\reg.exe
              reg query HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Common\UserInfo
              6⤵
              • System Location Discovery: System Language Discovery
              PID:5808
            • C:\Windows\SysWOW64\ipconfig.exe
              ipconfig /all
              6⤵
              • System Location Discovery: System Language Discovery
              • Gathers network information
              PID:4976
            • C:\Windows\SysWOW64\NETSTAT.EXE
              netstat -ano
              6⤵
              • System Location Discovery: System Language Discovery
              • System Network Connections Discovery
              • Gathers network information
              • Suspicious use of AdjustPrivilegeToken
              PID:2952
            • C:\Windows\SysWOW64\ARP.EXE
              arp -a
              6⤵
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:5336
            • C:\Windows\SysWOW64\NETSTAT.EXE
              netstat -r
              6⤵
              • System Location Discovery: System Language Discovery
              • Gathers network information
              • Suspicious use of WriteProcessMemory
              PID:5772
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
                7⤵
                • Executes a command shell one-liner
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:900
                • C:\Windows\SysWOW64\ROUTE.EXE
                  C:\Windows\system32\route.exe print
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:3752
            • C:\Windows\SysWOW64\net.exe
              net start
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4208
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 start
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1128
            • C:\Windows\SysWOW64\net.exe
              net use
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3856
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo n"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3908
            • C:\Windows\SysWOW64\net.exe
              net share
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3136
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 share
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5848
            • C:\Windows\SysWOW64\net.exe
              net view /domain
              6⤵
              • System Location Discovery: System Language Discovery
              • Discovers systems in the same network
              PID:5884
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\s.log "
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4712
            • C:\Windows\SysWOW64\find.exe
              find /i /v "------"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4328
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\t.log "
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4480
            • C:\Windows\SysWOW64\find.exe
              find /i /v "domain"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3480
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\s.log "
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1176
            • C:\Windows\SysWOW64\find.exe
              find /i /v "¬A╛╣"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:5324
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\t.log "
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4844
            • C:\Windows\SysWOW64\find.exe
              find /i /v "░⌡ªµª¿"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3980
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\s.log "
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4784
            • C:\Windows\SysWOW64\find.exe
              find /i /v "├ⁿ┴ε"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3276
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\t.log "
              6⤵
              • System Location Discovery: System Language Discovery
              PID:5808
            • C:\Windows\SysWOW64\find.exe
              find /i /v "completed successfully"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1068
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5032
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:3000
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    PID:3156
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:2148
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    PID:5452
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:4816
  • C:\Windows\System32\ReFsDedupSvc.exe
    C:\Windows\System32\ReFsDedupSvc.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:1548
  • C:\Windows\System32\SensorDataService.exe
    C:\Windows\System32\SensorDataService.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Checks SCSI registry key(s)
    PID:2688
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:5604
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4528
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1576
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
      2⤵
      • Modifies data under HKEY_USERS
      PID:4008
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
      2⤵
        PID:5596
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2740 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
        • Modifies data under HKEY_USERS
        PID:5104
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
        2⤵
        • Modifies data under HKEY_USERS
        PID:3456
    • C:\ProgramData\Application Data\wmimgmt.exe
      "C:\ProgramData\Application Data\wmimgmt.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3500
      • C:\ProgramData\Application Data\wmimgmt.exe
        "C:\ProgramData\Application Data\wmimgmt.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5260

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          2
          T1059

          Windows Command Shell

          1
          T1059.003

          Persistence

          Account Manipulation

          1
          T1098

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Privilege Escalation

          Account Manipulation

          1
          T1098

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Credentials from Password Stores

          2
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Windows Credential Manager

          1
          T1555.004

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Browser Information Discovery

          1
          T1217

          Network Service Discovery

          1
          T1046

          Network Share Discovery

          1
          T1135

          Peripheral Device Discovery

          2
          T1120

          Permission Groups Discovery

          1
          T1069

          Local Groups

          1
          T1069.001

          Process Discovery

          1
          T1057

          Query Registry

          3
          T1012

          Remote System Discovery

          1
          T1018

          System Information Discovery

          6
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Connections Discovery

          1
          T1049

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          AcroBroker.exe
          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe
          • Size 1.5MB
          • SHA256 d1349a67206fc71df3a7112040f9760581772ff09c37f85a66387ca07cae0fe0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevation_service.exe
          • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
          • Size 2.7MB
          • SHA256 631400e0838c351f78a2b670a42251d29fede5d58b885d6cc77ae4dc36d5f035
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          maintenanceservice.log
          • Path C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log
          • Size 3KB
          • SHA256 1e4ce33cbca9f996eda5f2a2ac75b6ff1ddb8a3c4d2796efeef024c3cbe39990
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          maintenanceservice.exe
          • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
          • Size 1.4MB
          • SHA256 f2be28d369e4ad814f4e3854f89bff29b610dc315b7ac1df44127ad9c2ba8217
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7z.exe
          • Path C:\Program Files\7-Zip\7z.exe
          • Size 1.7MB
          • SHA256 7b52be8eb0c56577204c6b623126fb3c2c460fd102ae92d99ffa2e7f13f10f3f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7zFM.exe
          • Path C:\Program Files\7-Zip\7zFM.exe
          • Size 1.5MB
          • SHA256 bf0dac7d214281a519d848f8f87b483e7e55caea2df53d46ccf5e00864a30208
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7zG.exe
          • Path C:\Program Files\7-Zip\7zG.exe
          • Size 1.2MB
          • SHA256 c2f0bb339303e82dcc82ce8406826ca019a7956488899e7c5044bc258d6af1d0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Uninstall.exe
          • Path C:\Program Files\7-Zip\Uninstall.exe
          • Size 1.2MB
          • SHA256 6d7379ae3be6dd3aa35692aaddf93992ac25d7adc1a71cb77d97fc7a4c740f8f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AppVShNotify.exe
          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
          • Size 1.4MB
          • SHA256 6ee1ec6159ce073672265116e06542c3a054d8a024aa78295e33df660212082a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          IntegratedOffice.exe
          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
          • Size 4.6MB
          • SHA256 ad0c0531880b23fa7f4015f77648f11c4f624c884b6727414165f927827326b0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MavInject32.exe
          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
          • Size 1.5MB
          • SHA256 d3339b9d33b22715a959999d3019ea4d00a862b34de4f4b77842d921eb0427e9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          appvcleaner.exe
          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
          • Size 2.7MB
          • SHA256 0fe1d866136a2137cff6370d506274d74a5d9ccc951f60711e1f5976a4610def
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OSE.EXE
          • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
          • Size 1.4MB
          • SHA256 fffe57258f572672ddf721daf9e4e556af43753b0992f27397cbb9c9311c1a9b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrmstp.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
          • Size 6.6MB
          • SHA256 3e80d91ddc16b62fc0b3371fb2f929b4c9ef809e30b88c3d84600a57680f3268
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          setup.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
          • Size 6.6MB
          • SHA256 91e88d1ab435bc3492d1ac2ba706bbc8539f40bc90c850d9a48e30dc0913eb0a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_pwa_launcher.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
          • Size 2.3MB
          • SHA256 aa46e0d7e46670d24375760700d38eec0398c265be1765b66f495223cf6aeb51
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevated_tracing_service.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
          • Size 4.0MB
          • SHA256 6b801695b3cfd324089797c6838ae63b62c6dd301b55c46a954482e17dc4da64
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevation_service.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
          • Size 2.8MB
          • SHA256 ccae137370e423d39c16790c1f368e25ebfadceb969a15dcbccc346b3abd3e54
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          notification_helper.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
          • Size 2.2MB
          • SHA256 6f032133e066589ad30e2e9e35ddf00cae581d04f8eb2aebb7788065bac07e06
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          os_update_handler.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
          • Size 2.4MB
          • SHA256 2848d843e2416524ee8b32f9ee682e034ba97a9008e7b4f6a602af0c8b9bb051
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_proxy.exe
          • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
          • Size 2.0MB
          • SHA256 eb7ebf94a06ee355e4d09e6ac49939294ad65ac377c5304c45b2ec4362dd43f2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          appletviewer.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
          • Size 1.2MB
          • SHA256 7293be49b17d69f4598d0506fc7a55412fb4038fc9ba818678874ff033168c63
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          extcheck.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
          • Size 1.2MB
          • SHA256 f76ac8bf84307636c941c1b88a4135923f66f6497d33f0aa91c91a575cf1a81f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          idlj.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
          • Size 1.2MB
          • SHA256 f338c79efdf7498920dad611fc8f4099218cc12739d8400240c432372298b871
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jabswitch.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
          • Size 1.2MB
          • SHA256 610cd534cd617a3434bcfe4e39e422b90402ddb342afb27b7ebd8c9f6e4bc8b1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jar.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
          • Size 1.2MB
          • SHA256 542ee97918753d162d4ff435512ab334313a37f2affc41404114cba2aa1fd15f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jarsigner.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
          • Size 1.2MB
          • SHA256 67c738b720922ce08f6c10c3e339255741c531c563bc25e56055091362632a85
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          java-rmi.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
          • Size 1.2MB
          • SHA256 63a6b5d464981cdf65363466b3e9757dff84d8602f8d567f1e64913cccd013eb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          java.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
          • Size 1.4MB
          • SHA256 803b72ee5b48898eceb1df1796006f924a3574ec418c9180ca3af228dce86fb2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javac.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
          • Size 1.2MB
          • SHA256 d9b3a0dc448965dfe968cfa20fec27f4b82fa388042ecb2aad69ba31778e7912
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javadoc.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
          • Size 1.2MB
          • SHA256 39d3997d1018a738497c6460e8f6c83bee510e5135419793166c0293795b69cd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javafxpackager.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
          • Size 1.3MB
          • SHA256 2288e6da0c884b74990ae566fa0f6712a7594ad8cd3778037221b2cd8f0a533f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javah.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
          • Size 1.2MB
          • SHA256 b4deb61748668c7a037b705638abb8dfc743d9c30d6568276033ca9c3871e525
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MsSense.exe
          • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
          • Size 1.6MB
          • SHA256 4d1b035d0fdfa38490520ee710d89589e907b07b40f04b2b35757744324ae789
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NisSrv.exe
          • Path C:\Program Files\Windows Defender\NisSrv.exe
          • Size 3.5MB
          • SHA256 fc3a62b1943c68c8e624f4e354b42efcd9a41dc102bf863892c72ea397cc5fdd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wmpnetwk.exe
          • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
          • Size 1.4MB
          • SHA256 4eaacd2ea50d6b448e72a58a7d0cedda2f5871a87a4f8b265657bb2e2fd475bb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Windows.db
          • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
          • Size 1.2MB
          • SHA256 537d543697e7975e0db97f92b011cebf68c5c7abc05ff4247b19255952f5969d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Windows.db-wal
          • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
          • Size 317KB
          • SHA256 796b47e59013f7dae2905fdcb65044117d9ccc75fba7cbd35722dacd6507cb4c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wmimgmt.exe
          • Path C:\ProgramData\wmimgmt.exe
          • Size 1.5MB
          • SHA256 3ec5322534b19c3041af3b53a227520520f7be74cf9dca2cbb37ffb3f134dacb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          INFO.TXT
          • Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\INFO.TXT
          • Size 13KB
          • SHA256 eecd690c341fe5d7b329663f082faf4c08ee4c7c778f4fc598f2c2de9a9f4e09
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          drivers.p
          • Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\drivers.p
          • Size 15B
          • SHA256 d8a21e76d208e48198b4afa4a54157044255e074acd5c25f99d9894ad70fbde2
          • MD5 SHA1 SHA512
          Submit Download

          ghi.bat
          • Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\ghi.bat
          • Size 3KB
          • SHA256 1ebd7eae014cf21830a64f251bf768e2935fa3de5223dcb86f3e69dc88c384c8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          INFO.TXT
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\INFO.TXT
          • Size 43B
          • SHA256 56ce2769194c06591d8011f0e94b23c95338c820aba5a612f6ccb1dc9f7b0232
          • MD5 SHA1 SHA512
          Submit Download

          9e46d8fc5387db0e.bin
          • Path C:\Users\Admin\AppData\Roaming\9e46d8fc5387db0e.bin
          • Size 12KB
          • SHA256 f976617885920d8cbb06ebcc2c7ebde88379400c7432fd18c5351a564930d9e8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          perfhost.exe
          • Path C:\Windows\SysWOW64\perfhost.exe
          • Size 1.2MB
          • SHA256 4264023cf09c05fd28f05c1456c50bd045cabcd3f2c58b861d2109dedef59a8c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AgentService.exe
          • Path C:\Windows\System32\AgentService.exe
          • Size 1.4MB
          • SHA256 778c3213a3590cb4b3df5507c9dd5e89cda65ae1bca532a2088ddf178af8a992
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ssh-agent.exe
          • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
          • Size 1.7MB
          • SHA256 fc9fcbbacdcdcf2ede675fcfeb96a9b3ae0550f0a120ed5da4902624e124b886
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ReFsDedupSvc.exe
          • Path C:\Windows\System32\ReFsDedupSvc.exe
          • Size 2.6MB
          • SHA256 97e8d5937eaa6a06811001a36bc4d0376922cd405b4d2d863a8b300bc8e5ac3f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SearchIndexer.exe
          • Path C:\Windows\System32\SearchIndexer.exe
          • Size 1.4MB
          • SHA256 9bf93bd636a8df1198e2f57f1b81cf856c1cdd56704440ffcb07837f71333953
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SensorDataService.exe
          • Path C:\Windows\System32\SensorDataService.exe
          • Size 1.7MB
          • SHA256 cffdf5802afe261b95ae5b64ac6822b62b4893421a9a8ff2779f36538ebd972c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SgrmBroker.exe
          • Path C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.26100.1150_none_f5f28f643cc492d0\SgrmBroker.exe
          • Size 1.6MB
          • SHA256 2298852af59e30355d00855e1a943fc87d970e3e7a04a967299bd44db80591df
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AppVClient.exe
          • Path C:\Windows\system32\AppVClient.exe
          • Size 1.3MB
          • SHA256 cf44958b0b20ce4e757a349e38141981fa85ebbee62db000209e5b5c78b12c60
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PerceptionSimulationService.exe
          • Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
          • Size 1.4MB
          • SHA256 ca3d1e4ee8931b64708f4f9eff07d43e908dd26f70b78f8f6f47c4de85f1d80b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1548-395-0x0000000000740000-0x00000000007A0000-memory.dmp
          Download

          memory/1548-397-0x0000000140000000-0x00000001402C9000-memory.dmp
          Download

          memory/1548-305-0x0000000140000000-0x00000001402C9000-memory.dmp
          Download

          memory/1548-112-0x0000000000740000-0x00000000007A0000-memory.dmp
          Download

          memory/1548-111-0x0000000140000000-0x00000001402C9000-memory.dmp
          Download

          memory/1548-105-0x0000000000740000-0x00000000007A0000-memory.dmp
          Download

          memory/1576-165-0x0000000000620000-0x0000000000680000-memory.dmp
          Download

          memory/1576-159-0x0000000000620000-0x0000000000680000-memory.dmp
          Download

          memory/1576-375-0x0000000140000000-0x0000000140172000-memory.dmp
          Download

          memory/1576-158-0x0000000140000000-0x0000000140172000-memory.dmp
          Download

          memory/1664-66-0x0000000000400000-0x000000000057C000-memory.dmp
          Download

          memory/1664-58-0x0000000002500000-0x0000000002567000-memory.dmp
          Download

          memory/1664-53-0x0000000002500000-0x0000000002567000-memory.dmp
          Download

          memory/1936-0-0x0000000000400000-0x000000000057C000-memory.dmp
          Download

          memory/1936-14-0x0000000000400000-0x000000000057C000-memory.dmp
          Download

          memory/1936-1-0x0000000000D20000-0x0000000000D87000-memory.dmp
          Download

          memory/1936-8-0x0000000000D20000-0x0000000000D87000-memory.dmp
          Download

          memory/2148-203-0x0000000140000000-0x000000014016F000-memory.dmp
          Download

          memory/2148-72-0x00000000007A0000-0x0000000000800000-memory.dmp
          Download

          memory/2148-71-0x0000000140000000-0x000000014016F000-memory.dmp
          Download

          memory/2148-78-0x00000000007A0000-0x0000000000800000-memory.dmp
          Download

          memory/2504-416-0x0000000000400000-0x0000000000424000-memory.dmp
          Download

          memory/2504-394-0x0000000000400000-0x0000000000424000-memory.dmp
          Download

          memory/2504-338-0x0000000000400000-0x0000000000424000-memory.dmp
          Download

          memory/2504-391-0x0000000000400000-0x0000000000424000-memory.dmp
          Download

          memory/2504-473-0x0000000000400000-0x0000000000424000-memory.dmp
          Download

          memory/2504-457-0x0000000000400000-0x0000000000424000-memory.dmp
          Download

          memory/2504-420-0x0000000000400000-0x0000000000424000-memory.dmp
          Download

          memory/2504-426-0x0000000000400000-0x0000000000424000-memory.dmp
          Download

          memory/2504-431-0x0000000000400000-0x0000000000424000-memory.dmp
          Download

          memory/2504-429-0x0000000000400000-0x0000000000424000-memory.dmp
          Download

          memory/2688-124-0x0000000000770000-0x00000000007D0000-memory.dmp
          Download

          memory/2688-343-0x0000000000770000-0x00000000007D0000-memory.dmp
          Download

          memory/2688-346-0x0000000140000000-0x00000001401BA000-memory.dmp
          Download

          memory/2688-344-0x0000000001390000-0x0000000001633000-memory.dmp
          Download

          memory/2688-339-0x0000000140000000-0x00000001401BA000-memory.dmp
          Download

          memory/2688-117-0x0000000140000000-0x00000001401BA000-memory.dmp
          Download

          memory/2688-118-0x0000000000770000-0x00000000007D0000-memory.dmp
          Download

          memory/3000-30-0x00000000006E0000-0x0000000000740000-memory.dmp
          Download

          memory/3000-36-0x0000000140000000-0x00000001402D4000-memory.dmp
          Download

          memory/3000-129-0x0000000140000000-0x00000001402D4000-memory.dmp
          Download

          memory/3000-37-0x00000000006E0000-0x0000000000740000-memory.dmp
          Download

          memory/3000-38-0x00000000006E0000-0x0000000000740000-memory.dmp
          Download

          memory/3156-67-0x0000000000C00000-0x0000000000C60000-memory.dmp
          Download

          memory/3156-42-0x0000000140000000-0x0000000140175000-memory.dmp
          Download

          memory/3156-44-0x0000000000C00000-0x0000000000C60000-memory.dmp
          Download

          memory/3156-51-0x0000000000C00000-0x0000000000C60000-memory.dmp
          Download

          memory/3156-69-0x0000000140000000-0x0000000140175000-memory.dmp
          Download

          memory/3368-50-0x0000000000400000-0x0000000000424000-memory.dmp
          Download

          memory/3456-412-0x000001A463E80000-0x000001A46405B000-memory.dmp
          Download

          memory/3500-404-0x00000000023A0000-0x0000000002407000-memory.dmp
          Download

          memory/3500-399-0x00000000023A0000-0x0000000002407000-memory.dmp
          Download

          memory/3500-409-0x0000000000400000-0x000000000057C000-memory.dmp
          Download

          memory/4528-142-0x0000000140000000-0x0000000140168000-memory.dmp
          Download

          memory/4528-149-0x0000000000730000-0x0000000000790000-memory.dmp
          Download

          memory/4528-143-0x0000000000730000-0x0000000000790000-memory.dmp
          Download

          memory/4528-151-0x0000000000730000-0x0000000000790000-memory.dmp
          Download

          memory/4528-153-0x0000000140000000-0x0000000140168000-memory.dmp
          Download

          memory/4816-94-0x0000000000400000-0x0000000000537000-memory.dmp
          Download

          memory/4816-95-0x00000000007C0000-0x0000000000827000-memory.dmp
          Download

          memory/4816-100-0x00000000007C0000-0x0000000000827000-memory.dmp
          Download

          memory/4816-278-0x0000000000400000-0x0000000000537000-memory.dmp
          Download

          memory/5032-104-0x0000000140000000-0x00000001402E9000-memory.dmp
          Download

          memory/5032-25-0x0000000000E70000-0x0000000000ED0000-memory.dmp
          Download

          memory/5032-17-0x0000000000E70000-0x0000000000ED0000-memory.dmp
          Download

          memory/5032-16-0x0000000140000000-0x00000001402E9000-memory.dmp
          Download

          memory/5452-90-0x0000000000B40000-0x0000000000BA0000-memory.dmp
          Download

          memory/5452-84-0x0000000000B40000-0x0000000000BA0000-memory.dmp
          Download

          memory/5452-82-0x0000000140000000-0x000000014016B000-memory.dmp
          Download

          memory/5452-219-0x0000000140000000-0x000000014016B000-memory.dmp
          Download

          memory/5604-341-0x0000000140000000-0x00000001401DE000-memory.dmp
          Download

          memory/5604-138-0x0000000000D10000-0x0000000000D70000-memory.dmp
          Download

          memory/5604-132-0x0000000000D10000-0x0000000000D70000-memory.dmp
          Download

          memory/5604-130-0x0000000140000000-0x00000001401DE000-memory.dmp
          Download