2536827cb0b68ca8689f8ea21bb5e157e810f3814d626c5999d22dcbb86731ad

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
Size 1.6MB
Sample260807-ea2rrazve1
SHA256 2536827cb0b68ca8689f8ea21bb5e157e810f3814d626c5999d22dcbb86731ad
MD5 c3a3f40cac5f842d39ddb08ed57db6a1
SHA1 1cb67819440b417f3a44aade06e7b5360c61a739
SHA512 3ef67a5a7ba2173d47f6831a229e0ec9d75e3595ca869373540002e6c1c2482f6849a741662310f992a42ec32312c376781f4db6e4be81d6a0ad8213a521f83f
SSDEEP 12288:zN6IHgzLrrJJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHy:6dCN/j2GLl3iFSE33b9n
TLSH
T18B7523689BF36466F866A2780368EF30DA11FED8C616454B8B91FBFF313A794C025153
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3816	alg.exe
3528	DiagnosticsHub.StandardCollector.Service.exe
4124	fxssvc.exe
4796	elevation_service.exe
1728	elevation_service.exe
4444	maintenanceservice.exe
860	msdtc.exe
3092	OSE.EXE
3836	PerceptionSimulationService.exe
3400	perfhost.exe
3948	locator.exe
1064	SensorDataService.exe
100	snmptrap.exe
4720	spectrum.exe
1172	ssh-agent.exe
324	TieringEngineService.exe
2024	AgentService.exe
3120	vds.exe
2868	vssvc.exe
3136	wbengine.exe
4356	WmiApSrv.exe
3736	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\509a86463a3ba122.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_89984\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000884ff12e1f26dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa2e4f2e1f26dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009ddf5f2e1f26dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003bb5962e1f26dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d7959a2f1f26dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d23ebf2e1f26dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006f35792f1f26dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000098b3d42e1f26dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006915d72e1f26dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006777d92e1f26dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
3528	DiagnosticsHub.StandardCollector.Service.exe
3528	DiagnosticsHub.StandardCollector.Service.exe
3528	DiagnosticsHub.StandardCollector.Service.exe
3528	DiagnosticsHub.StandardCollector.Service.exe
3528	DiagnosticsHub.StandardCollector.Service.exe
3528	DiagnosticsHub.StandardCollector.Service.exe
3528	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
Token: SeAuditPrivilege	4124	fxssvc.exe
Token: SeRestorePrivilege	324	TieringEngineService.exe
Token: SeManageVolumePrivilege	324	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2024	AgentService.exe
Token: SeBackupPrivilege	2868	vssvc.exe
Token: SeRestorePrivilege	2868	vssvc.exe
Token: SeAuditPrivilege	2868	vssvc.exe
Token: SeBackupPrivilege	3136	wbengine.exe
Token: SeRestorePrivilege	3136	wbengine.exe
Token: SeSecurityPrivilege	3136	wbengine.exe
Token: 33	3736	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3736	SearchIndexer.exe
Token: SeDebugPrivilege	2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
Token: SeDebugPrivilege	2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
Token: SeDebugPrivilege	2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
Token: SeDebugPrivilege	2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
Token: SeDebugPrivilege	2728	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
Token: SeDebugPrivilege	3528	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 1160	3736	SearchIndexer.exe	112
PID 3736 wrote to memory of 3856	3736	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3816

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4992

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4124

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1728

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4444

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:860

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3092

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3836

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3400

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3948

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1064

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:100

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4720

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:392

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:324

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2024

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3120

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3136

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4356

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1160
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3c54bec5a0261228723cf52b5a9979a26e2113c0d86a2ab4f6be76a650dfc08a
MD5 b13c6c1375413b109625c7a00a8b429c
SHA1 009a6fde6fe1c1e19dc46191eb21ebb632642e5c
SHA512 70a5f0f2d1e7befb43662925d5f5861b07ae30c90ed8377c618592f97a16cdde8f93acbcb1042ea812e5c9f9a7219a9945f8066d0d1401304321a64287247dd1
SSDEEP 49152:9b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnqN/j2U4FH:D3q6HjBPj2jF
TLSH
T144D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.8MB
SHA256 93b0182d772d0c15070176887d854dfc6e35a357935764058fbb0ea7776d4853
MD5 4a1721f93c55db52f9314e83023ecfde
SHA1 e70800f9a3d64bb0dca2b8e346159f2784050f99
SHA512 8b6439a8b8299b3309027268e5d5f6851fec144f5cbeafa1e69df939eb113d32c2cd67e2e4976615a1bd53d9b6fd18fcb1ce58c2e6faa5d010683bf48c59d40a
SSDEEP 12288:H1XLsswWkxy2lRq2czAuJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:VXYfDtczACdCN/j2GLl3iFSE33b9
TLSH
T1F485F128B7E409F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 5dd8f21066f3ccbe251e4062e2a3ef7c1887563cc91162a998b2578a682c3daa
MD5 3d3a194443b4f73eed8a20ea8ae425c2
SHA1 85aa18641e53109d57103c085518eb94457b01db
SHA512 4192fb6b4d754b34b87b979bc9635f4d77f30e74bc16e2ea9f2e97f3e0eb50f40a2943277f0eebb47a2c681830662bfe71f0b79529dd924b85ee6cdf19d46eb8
SSDEEP 24576:M0Le5ji0hmxirMNdCN/j2GLl3iFSE33b9:MPji0AcnN/j2U4FH
TLSH
T16AA5AE26F6748335D073C0B9C5D2A69AE97130855B308ACB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f0293038b557f6f445618b2533f24f110c38f101e08172dc37415f5a8157f320
MD5 4e6003ac0eca11f8120834e0e16c28be
SHA1 02c4e134cb270cad562d5a8e5b0c63aa013f5dde
SHA512 b515db00e74795978503228fafc102b0f19020b5206f9b89e3a97f9467fead24e0d4e9d7f418e3367161d0604e78b1770a25aaabc0575958dd394bdb0e6e6bac
SSDEEP 24576:ea7/ezSC6vUyD/aqgrvWE6q8wyuzdCN/j2GLl3iFSE33b9:Z/ezSC6vUzPvxHjybN/j2U4FH
TLSH
T1C8755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5c437014439829b934aea2afe5f669484b1b9ad04947026f3777e676c99e76f6
MD5 feca681fa850ec7f283c78c334707023
SHA1 cfd8367b577f12983557c71a18ad37a00da5700d
SHA512 b5f9cc7051e1e00588f76752efc91dd349a7d68a028b56934fe5e706cda786e53c9c02669c78ad7313e8d7055ac2601037ed2b974e7e00c1ce80c0f257754bcd
SSDEEP 24576:yVbqPb88hv/l+6udCN/j2GLl3iFSE33b9:yVO88hXl+GN/j2U4FH
TLSH
T1E6559E65F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 f5402e20e9f03690aad62842d0bcfa22bd5c72516bde95ce007602840f1f7214
MD5 492afb7f4ceeb197aba285b890668e85
SHA1 75bb7d5b528d3ecc62378a11eab155a68b4dc2fa
SHA512 d769ac53237b4495422fc002c41efd896af13b44369903d4c86cca2d15c4fe8904a25de9ac6a3fa7e77b4e865c9f45a0980e5c93cddec3a511ad05da99b03a60
SSDEEP 12288:KRtJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHPh:KR5dCN/j2GLl3iFSE33b9Gh
TLSH
T1FF752364DAA4B565F6AF837903ADDE615200FEE8E925884785917BEF117CFE8C033063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 4435cba65979d3dfca9ce97d31f38b33ad50f1965f5422079c7edd75b3a9a2e0
MD5 87fa4d1c585ef7e83697846c90eb8e62
SHA1 85b1aaf00a3683055402482968a439a7875133c3
SHA512 18b09186c97746d600022ad23649ab621ce4f50913b23a5d12e8b8b95bf35a52e626262f9426fcc74497edd6e392400b75c69ac72e5afce2eebcacbf2199168f
SSDEEP 12288:BeBNUbTVO86U6JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:BJIUGdCN/j2GLl3iFSE33b9
TLSH
T1D785CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 16dc9d770b455570c0c90543dbd74246f336f9a62dbfa610750d603f9426d09a
MD5 cccea064698aabac5d1d94953cd3835e
SHA1 87e62061aaddcd8e890d83eb5b3e3c746d72ca12
SHA512 d1402e1d2cfcc91a1e91316d64f3337c7f6f3f26bac76a201bb378fa619dcbd0191a41fd42cd2132399dd768927f7b9c0e10b0c73cf4b90fd7a177ba53afa3ff
SSDEEP 49152:hQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THo:hQvGAdlCEL8c/yRNw5C8j2jF
TLSH
T127267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 55c1d8bcc42de4d92867e3b70b623a5cd7bfe5f93e58e754e4c7b313f52bf9d0
MD5 83e75764cbc8b4fac65b0cb3b6d501dc
SHA1 1987ac495f7475ccfc7b9d66c7781863ba481c40
SHA512 da4972a92fbd72915cefbb556f88d5df1c2fbae8eb6e5cc48aba33bfc386dfc1b3863ea3901ee76b547d6fedc04f910403e1cb164eb0c996c03cfc20d25ed7d8
SSDEEP 12288:9AwSfxL/2Dc34DLLmt0LDQewsAjkJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b96:udewsAjMdCN/j2GLl3iFSE33b96
TLSH
T12395E031FE74E036C2BF0DB61B36C716142CBA608B6119C3E3E84E9E59746D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5e89b3f658e3392416223cf64a3b2de0cee87c946065b46a6b4b0ef25f6ec249
MD5 975072e8d38647d69a40226fcf001f98
SHA1 bb4ec1698c4f2fe70a43cf2de1faf4850c18f677
SHA512 05ec3170d48624f6b3fb6a0f6f7393795fe3214e1ef2012e248d82c25620f44aa879c5de4ac3eb8326601b76d439eacbea0690d7aad9dee65711027fd696eb6e
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHB8F:bUEtQevvqc2W1cpV2EI32B
TLSH
T149474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 57668a789558ebb20ed9dec1661539f2a22d1baed6409f589e09360938b907cc
MD5 c58ce3d6af448aa1f77ebe6458505ff4
SHA1 ceeeb3a663274bc8b7527701227d9ecff0f3eb75
SHA512 6ac88738eb8818dede685c5ee5fc9e09477ed75d20edd9f8dee8181f85803b0277dacc497027f09edbd4fb3e74a0a59308fd84e43e4194d737e127cf1399eadc
SSDEEP 49152:5CbRquA/m2yL5zQfFiV+XenmE3/zXN/j2U4FH:WoqtVjnm4j2jF
TLSH
T1F9D58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f88715c65bec7cf9f58887bb22a167d0f03e43d85d4c0d3c482cb29dae3dc5c7
MD5 4b68d028127a890ccf9077e5114ac392
SHA1 d04ec06e5aa2dc64a9df87632266bc9c077c2855
SHA512 1a9b91dbacfd1a799bd74c262575d443727e241e54d4637454f01499b4b6afcc8674289d03a9824f4fc4374153bd639d72aef5f1e57c1270032be6bffe60ab9a
SSDEEP 24576:WAhGLJIFoiwtA5l7S53HdCN/j2GLl3iFSE33b9:WAMyFoiq5kN/j2U4FH
TLSH
T16235AD80E7F955D4F5B3AAB899B68571EA72BCA95E31C20F1150D21F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 5faefbfcaeec9a80649493c537c219f0344680804d84a36f441b8ded24474073
MD5 ad76fe610bb8bb9e0f7f516b81be64f9
SHA1 d27512d7a228bee510e8a3bf270d1ac318a8383f
SHA512 617c879b5629249f352bd0f3c5d73f3a5e79b6f6b402b1a7a474f14de5224040d56455e68d93a9c21e2d4f9bdaf062eb0bbe8ebdf0782ae62b219b5288f2c589
SSDEEP 12288:Nmw5HEjsChNVBFgl0WDm+CLJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:owuoOWwdCN/j2GLl3iFSE33b9
TLSH
T17D85F14576E41CF9E96782398697C532F7B2BC512A21CB0F0360C79B6F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 2c3ab0a8d1393d1aa72c66fe7a6b3156e1790945d2721ab57dcfc89dc3e493d0
MD5 7ebd3051295cf1528f51c37cbba12515
SHA1 060a0e84ec63c272b6807a75b9181c7940aa7fa0
SHA512 21e5ea8546aad85c48666a59cf12080fa8974408d19f3ef9bc8acc3c4e86d82ca553fefdc7836e38badfaf2b90d3b4c10d1b321827f4e0015fb9182d195d94cf
SSDEEP 12288:bBZ1IyUJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:1ZuFdCN/j2GLl3iFSE33b9
TLSH
T17B75125933E471F9E1A7823C8AE59A05D321B8A5A73243CF025147EA2F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0dc39072499b98c4903c08190a0bd87284c7bc259ae1c843a81ce5cb9cc3af5d
MD5 c7466a9daf669d59a5b786d2960370bb
SHA1 e78ad698c2fac0d252bd18e26302164096096c59
SHA512 48b30b3944250fa718b8d26961c6080ca43aae3866aebfdfb15b7db79a9490c1d6423dd1b87c02fd9fcb4a5c85467bf012d79c64eb9674da689db0307c84bfa6
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UM:oQRQyi36YOcPQLvw2gAf+PN3zj2jF
TLSH
T14E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ead1556b31a43e5322ef9fdd3f9cc30d421e9de8427c71a3b1ee74079c2fac07
MD5 79094c658038dab44a8f1ff3af822fee
SHA1 9b6d17e53b9a941c91fabf30d5ae37dfee30be33
SHA512 c95377badf4a7717607185fc52103dd52cb00f16b39afe2c5b9cc492504bd1390fe42095265ee0ccb401f6f14648cdcd5318606f8a504b9a7eb0ded417167334
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UM:oQRQyi36YOcPQLvw2gAf+PN3zj2jF
TLSH
T101667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5fc30acd817b01e197134a0effce91d2f999ed54bf17df32e62c9a1e0bf4294d
MD5 8b3f381e46da9fe3f48480d2de7f1000
SHA1 799300cca6039a8a5fdd0a3882a2c745bfbb80fe
SHA512 1b734df046e68f9983936e004eb47751cd6d8171d76002f8f6dd577b18e19aa018e5ac72e0e3339f7c3a3f57db46d7b0d560f84ac9fb776907326c55d87728f3
SSDEEP 24576:1wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL01dCN/j2GLl3iFS+:x68Qg55nhheWu7PNU3/nN/j2U4FH
TLSH
T166B54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 988f5b53dd6e31923e28deb640d24ac280f073056ad734cbed86bced8d403ef7
MD5 3bb1fe18acb31676b71eb131a63e2843
SHA1 993a7d02373e33af63bbc36da7bad160814ac23b
SHA512 c27b2b27d1a76cf8523687161f916fcb4f1c6c60900a5ae7d0f7e633c28b80883a899290a17f0c57169c9c8e56751dadd5e27148837f4e766c4b57f53754ac95
SSDEEP 49152:G3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99e:Xy5112gYy5azzVvL69nLKnhZ2j2jF
TLSH
T197168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1d11cfe1815e41b779f8bb953a79068ad69904a8804c8f73fdcff7532ff7c565
MD5 487d601145ee995f09a4c2f3acae1a10
SHA1 3dec6bb5fc221753278edab9b5f097573bf4a1b4
SHA512 c1ae6ac386ea10393830c6cf353e7a3a2ed1c58dca5535aa05e3b83917808706dc1b7be49d15b88cace32efa24d607429ab9c309594a684e165d8db9bf86af0e
SSDEEP 49152:wB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl1N/j2U4FH:qu6JmVxd2dbj2jF
TLSH
T14BD59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 93316cdd69781d7748738408fe1502217061db90b0edaabdcfdd3726a312170f
MD5 5b5d27be434df8af34ee3fb267921ecc
SHA1 a865361296ed9f6f0512a6e9460cc65a97ae6e7a
SHA512 6b0a189263b450f0a314209fb4eb9ee3c778c7a365c0c13f20a4f66bba0ed715bc3d30edc181b1a7c1fff44565c6398e2950b3e0ee15b1765cbe3a27d19ab81a
SSDEEP 49152:m1hpsNoJpF1A6UU44CwH7R4xpN/j2U4FH:mmifPbR4j2jF
TLSH
T13AB5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f18e1e4f07a5a74d765f4b854154c9991acac0856c8cfb2b9af61d5b3edc65f2
MD5 570ace5ababf5bb38042c2541cf6aee3
SHA1 9dc415f1b25857642d75bd798e814b552de89bb0
SHA512 e77cf8e788a531585cea56e33b4b9d79b170e04d22f8d587ff4f74fabad8cb26e743d4da74020fc3a8c186c69d95038deba6092a0ed0e5249690d6fbdd712d53
SSDEEP 49152:1SuZQIY0Be2KRRVtOnks6NMHq6N/j2U4FH:b5dKTi61aj2jF
TLSH
T18DC5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7cdc30b5bee74b422efec5faded963d1b8ee77b13b097610ea35266bc76ca230
MD5 fd850402d9e7bb93d73bb363ac8bafcf
SHA1 b5d0aa6a4c64d2a07f27f2b83839e0f90b047ae4
SHA512 2faafafb602df0c6237e4100d32e415db01e0898f1b5d69b9c9a895733ca4df0ee7b56bf945e1f90080f424d1d9f743b7de7a2194dd5921544d1b55a0eedaa5e
SSDEEP 49152:ihtSn8EApI0figngiDn0AP5wFN/j2U4FH:DX2iyphUj2jF
TLSH
T1DD95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 295bab8947ae1d0fcc6ee009f9dbdd7403cb5dec31a82795dfe86744db52dc84
MD5 b1a50e716920bd9905b9de8818d1744b
SHA1 7d7611666b0add5aeebe4a6cabaa329a3c1527ec
SHA512 c533e1bc05aedd5801e01c49100dd3958cc7c2145c8fdf0cd9358ee5135f5bb451cf2d7ba5ced61526dc82db0d9c31760f8f490d96fff5daca09cafb83e82d0f
SSDEEP 12288:WVJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:WxdCN/j2GLl3iFSE33b9
TLSH
T19E752364E9E6B669F15BC37943A9DF515100FEE8F6264487868166EB237CFEC8033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 4d3ff4054adde61200dabd2f3b357db4dbc0fae00112aa93e143b120fdb85970
MD5 24fcca962b6e34ff2f38dcd01130279c
SHA1 2438f73eeb0b050b09784ca81a020a4462cf14b5
SHA512 e86ee19508594ddf1a5f5a819c1560891a23d8acddaffbb9d40a7a7c9f0a259e0963df793ea71f3b6b4ee289960caab3c9dc1716ee733c0ebda3a6ef75a2056c
SSDEEP 12288:sYJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:sYdCN/j2GLl3iFSE33b9
TLSH
T152752364E9F6B669F15AC37943A9DF515100FEE8F6264487868156EB237CFEC8033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 2061289f0439aa30bdc1088ecffa17902a13a6f0ba77f01aedf3dd3b948eba13
MD5 ef2b061bc46ff3b8f02694044e8b9909
SHA1 1339254f6df25e51d8aa539f63158b42a0eadcf8
SHA512 8a522338c52fc76293f13c0bd273ed0b73287a04aaeb4329bdff3167bd672d7bc72d1f23351349c93a47ced9af808312e9d2da47561140c94aa950ce485996aa
SSDEEP 12288:pCJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:pedCN/j2GLl3iFSE33b9
TLSH
T16F752364E9F6B659F15AC37943A9DF515100FEE8F6264487868166EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 41abc406aed051cbdb6ca046726030e249a8253935f7b0eb4274225bb192cf0c
MD5 805dff77e2647b882ba648c5955226bd
SHA1 c50e5e2dcc81460cd7b8c42b99c28e17ba6e3530
SHA512 9ebfab000371e1cc463332cc4acb8cd3167404bcbf04575a3f92acbe096104c67f14feddca51c58423a5083f46782aa0aa2fa3a4a3e172e2d25cbf16892d3200
SSDEEP 12288:rVnJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:VdCN/j2GLl3iFSE33b9
TLSH
T1E8752360A7F561D5E46BC37C83B5DA21E220FDE8E73245CF87400AEB1B75BE89432562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 33dbfdca5dc857046b4efe6bb459199bd06a89d5062afd90ae14d512d5fb109b
MD5 d5b982a064ab1472b2d808fff174aacc
SHA1 a5c2a94adf8a54fac06d42b0c912b69fcce8900c
SHA512 6569efec82e44ea80425db5a30d33c744f99c3e1ebfaf12f35061dd147a15709572ed09c36122e808bc6793648065cde06995da0ecb86a62190ad2f79794f0c8
SSDEEP 12288:V/JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:VvdCN/j2GLl3iFSE33b9
TLSH
T191752364E9E6B655F15AC37943A9DF515100FEE8F6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 8514004f5bdc3fdf8e4749e6d164d1ab56ab006cbb2b39814fd0d0384345b8da
MD5 90b257ca4e0f35c2a434afd43cccb550
SHA1 ade7ae0e902706faee52eadf4a28d267399efa25
SHA512 85861d2ac590d596eadda8d43acb53e4668819e91258ca487fa749dcfa50d64336d03fb7fc820d732385592fb68b7968ff3e3de0643c827597312805094ecbda
SSDEEP 12288:mMJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:mkdCN/j2GLl3iFSE33b9
TLSH
T10F752364E9E5B669F15BC37943A9DF519100FEE8F6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 024a607890e9c0dd3aa5e3334d943696a32a4ee1ff5d910a1c26fc4fea29b18f
MD5 ec4f843c401ec8c8cf4b5d2f2db969ae
SHA1 49fdd6895c8c4e3bdfabdb1a29d72d62018edc43
SHA512 80addb8958cb6deb0a86f31ae89fde0c38f650463ea1b123c4def0dfec3dc6ec21973f97d5f64a3847c544d1d2603f3cec70323484df68101a5483dfd658a93e
SSDEEP 12288:WQJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:WgdCN/j2GLl3iFSE33b9
TLSH
T14A752364E9E5B669F15BC37943A8DF615100FEE8F6264487868156EB237CFEC9033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 7afb5e91c9bab70c2e27da3ab5aabb5c487677d161280a82722926489fa9f2c3
MD5 32b40cb637f64b1b50ca85c9867200c6
SHA1 06a480b92eaed67717f5c1b334724c8dd8f5862e
SHA512 853f39bf28c3974671294aec32d6014badfa27a01e57e93d3334ab98c282c5d4cef3594e8340576102cd6d775247fb87ab4e5b591748b26c588dfbddd04e2448
SSDEEP 12288:PiZwb6zzFEoS2cPvy4JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:qZMSzFVSO4dCN/j2GLl3iFSE33b9
TLSH
T1B78502A4B39018F8EC67823EC9658916D2B1BC594770C64F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 4431b49cdc6e9dcf147617be35141174740f82fa7fd08cb88782e6f9dcddf39c
MD5 043839196632bf6511fb02c75650ba8d
SHA1 30fb9bfeba8342dfbd34bc4e00209eecfb8dd4c8
SHA512 a1369f8c926f61f7464489419fc757c24f9851c80a6ff164e80c4f3e2efa7f4a277101a9cced8664e8471eb9e4be50e3b7519f949bee094b3912bb7ea7789c5c
SSDEEP 12288:FhJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:FVdCN/j2GLl3iFSE33b9
TLSH
T1BB752364E9E5B669F15AC37D43A9DF615100FEE8F6224487868556EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 2b35d07fff6ab1e52a8b597c2cbc2d8879ff2ca3cf675a9becdec65010dc905c
MD5 995d5a5eb0db6f1eee80d7d2dbf0cd3e
SHA1 3552d12dd0590a871313acbbdecbeb9aaafd91f2
SHA512 816c9ca9b1a947f76ac12cf4753e4490ee2108c4490ca28f7e381d0247ede80a9a966b7fb5b4cf7d641e28f7aa1c22349508c6fccd77bd2f8a416aee4b94eabc
SSDEEP 12288:ndJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:nJdCN/j2GLl3iFSE33b9
TLSH
T1F9752364E9E5B669F11BC37943A9DF615100FEE8F6264487868556EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.7MB
SHA256 26ba227aba5f5b2637fd35e8e364e927500c054292e20761617a8322111b2025
MD5 7302481987b3857219d24bfae4ebf8ca
SHA1 829c0d6c7246e9b2842f38f238ac24e10e379d0c
SHA512 14c2cc7d3cc4bc10796507b0f1dbb8273b16c745f190b446b1fa1f189041d902b5e9e4c00cf59048df0a31acdbf45b32d131baeb14344eba67ba882206b11861
SSDEEP 12288:gyPz5L8UJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:RzycdCN/j2GLl3iFSE33b9
TLSH
T13785021777A130F9D167823889A65A11F331B87597208A9F43A007BB2F377E49D3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 9394f258417be745e10eb997530d4cb13a9bfcaf83b0a07efeb17930424f33dc
MD5 0693827d8c84ec2457ec4e2564558dc8
SHA1 b6dad86dd4719defdda9cc2f83da0df767de4c84
SHA512 c24aa37d968087e5e7675138edc462a71d4cf61c52a2160506d51cde9719ee924cbcfbb11731db20f6e41865388a267dca788bdd69e4dfb70b6bb803101c86ed
SSDEEP 12288:VhJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:VVdCN/j2GLl3iFSE33b9
TLSH
T1E7752364E9E5B669F15AC37D43A9DF615100FEE8F6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 211c19aac144163f6a621624d979db8f4caca9924a5389492d621ee397175eaa
MD5 1170fe8c9296cb2ccf58bc8a27d58b89
SHA1 96dfed2d3cdaf18dde7bd7a04ba892e2f2e201c4
SHA512 246b8b64752123edb57b125acece261df45d949522c410cd4e72dc0d0be3445c0489331b0013e02dadb3c3c49d73e3dd37788d9104ab8549ea3c783d1576a203
SSDEEP 12288:ahJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:aVdCN/j2GLl3iFSE33b9
TLSH
T143752364E9E5B669F15AC37D43A9DF615100FEE8F6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.7MB
SHA256 d2e59b0af60e861648c41c28b85087cdd97d34792d27b070f27924a71b7c709b
MD5 3f3ab5e6471606167924fe110b071b77
SHA1 50177bc85c052e464254ce4c6add5712a8c080cd
SHA512 b5f3e890022b5bf137e775851869012953eb643901303868f039b2d4a30262bcec0fca92bc056d70ca051cd880ca46d40460ba76eab493e94539ef4c6dae5552
SSDEEP 12288:3yPz5L8UJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:6zycdCN/j2GLl3iFSE33b9
TLSH
T1CB85021773A131F9D167823889A55A11F331B87597208A9F43A007BB2F377E49D3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 3aacdb2f9c91911e5a27ded16be29cf932f7273a319f13c1955f8e2131b482f9
MD5 e85692dec4dd93681c746020964e592b
SHA1 978cb059c959e05d55afa02adff9b03d513d98ca
SHA512 4589e71c01f18298ccca96728ca4269192ce60b2476987b044335c7e1087a8e9a2c0206c2d63785b846f905a7e78c2a2ed14dafba4e7990813fdd11dc3f03b24
SSDEEP 24576:McP4mcvIjkGOxhKP2l71nNKbrh/8KB9dCN/j2GLl3iFSE33b9:nP4m4IpOO67W8KAN/j2U4FH
TLSH
T1C665BE2DABDC0096D0BB817886658A49FAB1742A1F3286CB1160937D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 af7d1f7d4b78871d27a7dc6e243eaf08f952b76e6bf740bfb52ac9ab99cf75e5
MD5 90df9d7c826758b68718f15bd87be134
SHA1 50896062b3d99e966340345a73a81e3671d61e9d
SHA512 c2ca0edf42555340688f3c1a5be22c556b86f67e63142f769a0c4e44bf9046f15d029e450566cd5baf1267f16b014541b2e9d8c0e0e4bcf37c031f4543e2682e
SSDEEP 12288:qNsfxJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:jFdCN/j2GLl3iFSE33b9
TLSH
T195850119D29812E8D06E9279C7558A41B3237CA493E1C3CB43C0F5BE1F7AAD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 9cd5a51183c77c8a912bb04116958abc10b3576cac219ea1fa36599e36fb0f7c
MD5 8a74a8f7910d087406297e7fd006ae51
SHA1 3f1bc62be1ae62c97dac3c2d32c26a9e3f34679c
SHA512 e7117c3c65f782e4287cab9f724689718cf26c98f95d3d7f9ac82b144ce0cc0bffebe663577e6b254e84a86a9996c01eda0c1c31e836dccb81409db1c1f7d6e0
SSDEEP 12288:3RJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH0q:3ldCN/j2GLl3iFSE33b91q
TLSH
T15A752364D7E9B656F17B83780369DA356200FEF8EF258487858157EB1278FE8D832423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 b0a29edfc76d31b55dad4210661b752f06d1d44b060414688c60688057b3dbef
MD5 b8d243651044c9a57392bc7786577008
SHA1 249b3f81d3f62d307a55a594b644fc594d254b90
SHA512 17d4d3d7fb65caf545e02f5e9c86c2f4316c6ba4ab493f59afab61ff6579977ed0bf8f880a43da48ec75eb5f8ce33ae16947a15d8bef18549881c3ae7076ae97
SSDEEP 49152:7a0h2GEkuAe73q3pp46zwwQ8N/j2U4FH:7a0hNYG4JwBj2jF
TLSH
T1EB85AF1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.6MB
SHA256 d11032812d9613715723f11d0a247cc1d0c1e03148ae5aa14d65fa154c6d3f68
MD5 5cf9360fa8aa1bd735602ab31fa2e4b6
SHA1 2238a6c6638f1b8dc3e8dc0039d21b917be964c5
SHA512 a2ba454f2326f0696437c8544b51e87467859752ed31cbc090a36542153b3d6c92196f278a6a25b71ff500d67fc85a6e2831bebfc1244fd9760159ed6756c670
SSDEEP 12288:FhbHjfXoJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:FhbHjPIdCN/j2GLl3iFSE33b9
TLSH
T19875027D66AC21D9F176D27D86958A06D330FCA4572183DF42C182BE1F3BEE84C36A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 44feeccd6a0b038eb2e739a85ef458b31afbe09fc1d08bd054663aa27dc974fb
MD5 b948f1f2b130c36392a41908adf1fb4d
SHA1 1ed71b9e9a5c3f36039a390cbaba147f0a502a81
SHA512 5ba9cb237e34ed236fbc43066b9ef9d7a8c58a921fb08f34164d6ce8c84379bdde8f5bc08579d15af3274ecd3fa1e11f8c1c0c85722b14dcc06e8558129cc329
SSDEEP 24576:g3YgnJcRTk4yti+R5dBR/wdCN/j2GLl3iFSE33b9:gIgnaTk46pBR/7N/j2U4FH
TLSH
T1C045B02DF3B910B9D8AAD236450147B5FB71782D1F209ACB0170C538AF1AEE85E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 ffb9bb104839f311b100b092f3ba32fbc601ea74fbe433720e4296bf0e95ea34
MD5 eb97d4b8ae08e30466090279221107eb
SHA1 039c844f6018a7788eb4ea1067a54df72312d9fe
SHA512 edba4f7086365833f63471b8c04820036c6b1a7d88cb874095b9826543550e00dabaa48f0a5ada51e983b218c525c855996d5e281db137ba8e835666b6878d6d
SSDEEP 12288:/NJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:/ZdCN/j2GLl3iFSE33b9
TLSH
T142752364E6A5B659E16BC3BD03A9DF215100FFE8E73645C7858166EB237DFEC8032062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 888a00c10b530275b79352318d48c4910aa918059e1d796b93ac6a3b1d37f256
MD5 ea9b834954a298ae064cb06541424023
SHA1 6236318ddd3596eb1e7dd928f1f2a5bfc8295df3
SHA512 b4e0c640e4ef2f32dc061f97ba53ce5ae93678623fddbfcf7d546a8482b5062b2a10c8976c8d0679c8503d7e3e60495680ebf5c2179e4ca5404fba629ec00eb7
SSDEEP 12288:lOb9A4LWOsvAYFTuJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ipL3UTCdCN/j2GLl3iFSE33b9
TLSH
T1ED95F154E7A410F9E97BC23CC5A68A16D271B89C1724E7CF03A84BA61F237E54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 cb4ca418943b19a91b7ab35a76a55b09566f11b38c1ebd77b2f66e65def2478e
MD5 f649f72b6b5925af8de75b7881e909eb
SHA1 c1855c7be8804ebb283bf4e3fddd4776b78b7c59
SHA512 4c9e4ca83bc1bcad07f43ff650283cfa6953a30df0e8bd6ea68e8f840eaa592ccea07e135d22e0f5e814f2cfdc25375bae847b3a55cb18f7184a312a819b5067
SSDEEP 12288:+pFtpOaJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:UOmdCN/j2GLl3iFSE33b9
TLSH
T12875022936ED20E5E17A923D86968709D330B8A5572247CF42D081FE1F77FF89C36A61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 72a05d3175581319d99118315cc6857fdf47c2ecd77d57a3584c1a6608a3c728
MD5 27c278fb6c876847e34a37be4feee0a4
SHA1 7befa0ca825f1cf3681d024667bf8fff6ec86a59
SHA512 c8e86e338f5817db527bb79653cfb398c2fdf3ef13e7b52e5692766a423c8e4565ea823ecc241d4561ceed45a5b6c3cae57072b32a31f086858b32ef8af6de5a
SSDEEP 24576:g7NM9YqZqmWMUkPjZM48Mv6bEhsVdCN/j2GLl3iFSE33b9:g7cBWMpPjN8DbEhTN/j2U4FH
TLSH
T1FB65AE2E6BEC81E5D477D13DC9E28605F2B1B4611B318ACB5162833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 7679e563de01a9e7807a386cfe2b1bb2be998e0bfcfe9b6e6f45bd56704ef679
MD5 2c6559c3ccdd01e72caffc04c438ccd1
SHA1 82af9f78627075d15519f73b550bcaa54ee67641
SHA512 81d24b17d3acd705bdf0bb4388bd0b5ae0e0b8f0a3723a2fa218e833c1d557e88bd8b14d5ec2dd1cef01b14204b2ed13ffa64668c33704c6ffb8ae243fd65c52
SSDEEP 24576:GW6BApg2YuyuNDYTabvcdvNYf8km17dCN/j2GLl3iFSE33b9:GF2YuHNETovAvNYf8kmqN/j2U4FH
TLSH
T139858E2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 3760bb2987d275d89ad21942ce4d7587e9a2f4d0d3657363030b800d0f83afa4
MD5 15a1f4cbb68a313d1ea0189aa8e06667
SHA1 ab99826eb7d79a1325a20c6f95a2e5d212962eaf
SHA512 79f4254bb22c4a6869a8aba9bcc7faff8dd8a66b65a91160b9a3643a1bacf1329c4354afdf775e48578b163a822c61ea5779d16443307df552cac9e4b4a9d741
SSDEEP 24576:MAFs06+Omlf3NXEbToadCN/j2GLl3iFSE33b9:hFs060lVXucN/j2U4FH
TLSH
T11365AF2F62EC00D5D07ED17D8A97C91AF2B1746307255ACB0260867E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 623b96742b1dfd7f71b23d3538c3dfebc9c02019d8c6c21b9a23e77b650aadac
MD5 8ae6ab5785c52868814c7df092ba29e3
SHA1 9f3589cec2fb98615daa514238f9c19bc2039720
SHA512 27200c862a026aa2f59bc8052219525466d54fd170b3f70d376fc12d9dfb686ebc00469ec93890908f617892bb5504b88e9b890a5232874cd74b3dc0a5bac93d
SSDEEP 12288:pCJnJ5D3VkrDzxBJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:AJnJ5D3WXPdCN/j2GLl3iFSE33b9
TLSH
T11895D02CD2A810E8E4B7C2B4829A5B56FE71387D2F2269C718B4D5353F12FE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 90013a14d0f869ff192a698bf000c7149c5a581c339939e40a42476150b2a531
MD5 8b5915c325c88674c5be8a0a1a7bccd5
SHA1 925a7fb54a482fc3aa9292636d88073689b1a145
SHA512 b2f844fa452015819c097e8a6931940ee2a8ffa49c126b59ab9b6838b3acc02bd611e1cb633984dd1ad304a824e48e1a2705caebb494312cd74767a298426244
SSDEEP 24576:kEPghm6/7IIXdwcXrif7qQncjlP65i3VuwdCN/j2GLl3iFSE33b9:rg06DIKdwc+eQnSt65aVGN/j2U4FH
TLSH
T150956C15B7EA5294E8B3CAB1CA6291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.6MB
SHA256 09911e57ffca13062cb880f95c66c6a5fa6350fca9f128ff1c3ee152822db3a3
MD5 6fef43bebbe2134ebdcccca9225df0f8
SHA1 29deb8ca603205eaadacd70399d07f9c9cca9ad4
SHA512 e4e204e99160c89c05efb4dba2556d3327d5dec2b85878186513c6e61cbe21a176a790938e8adfb412bc0a2f45a73762d96249b7b37183c31df7b8fecaa2e37c
SSDEEP 12288:9EP3RnLJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:enTdCN/j2GLl3iFSE33b9
TLSH
T11875126D67AC70E9E12AC13D82A18605D331F4B4AB2217DF42D1C2BE4F77EE85D39A11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.7MB
SHA256 f07a96e5a6212d8c7be96d5791ae2043216f7944ded3d6277c1e0ab09f632191
MD5 a1ff75bc646277d8bf3b2e02c0a9ff61
SHA1 5658afe16167adb2b654abcfee2046b21845f749
SHA512 85df4a23d07156a537c45aebf4b29709d0330b63fb0f4f9044bce70a8a86b5d54cd276953d98d663de41e3dece887b26e65c68b401d429e9365e4eb8751a1d6c
SSDEEP 12288:VjkyYJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:VIyYdCN/j2GLl3iFSE33b9
TLSH
T10B851214A3E4A195E57A437C86B686619A30FC70EF2146CF41C0E77F6F7ABE49831B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 3d01f00edeae3a1be4026e7b336f6c8d97dfd95538805a11e65be315d9446175
MD5 d01ad54a0eaf2efd736b2ede1b792651
SHA1 401bed10be7302b6b7ea4ded4f102d3e2fa3a1c5
SHA512 7e921c5c6fdfd73e8560f2b5dbd1364e7727ae83b1c4012dda3a3f3170bd21640d95e3d029185cc3704b67a8a728dfbb551c603773ac282fc38cb7a56e51048c
SSDEEP 12288:QyKJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:t2dCN/j2GLl3iFSE33b9
TLSH
T116752368A6B5B569F52AC37C03799F215210FEF8EB2144CB41C1A6FB5379FE89033852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 e35d40e8239e95f30013eec47adcbd39ac543716353d6264f18399742cf4314c
MD5 96c9f46b3e3e328c2d3edd4f96a8f0d5
SHA1 e3feda5a21bdae4de05f576205d5702f2c80ff04
SHA512 44111d30e163645ea8701ccc0735da52848d63c78d851095e64eb54b693d021ab2a6f8b6f653b9c0cfa4032927bf5bc6c8f0f03d387c58bd6769348469914e76
SSDEEP 24576:hQ9MxZKdcz9dw3tdCN/j2GLl3iFSE33b9:hVKZCN/j2U4FH
TLSH
T120558C2DABE9159AE177D27995A250C3A633B4301B31C6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 534f0647a2d05eba07da316665bf3544b64a555101d2db846ab92e4eaadbbf52
MD5 f88fc893576827f9d5dd913b20c5cec8
SHA1 cde8ef724857566e706dff36ba9493ba57a363c8
SHA512 4a2139bf984f037e0285d89725d730f26998d97f2f151394fba0f2694b505d6016bd6176ff7799fbad3a110868000be48dd495c7e0f7e7a2aace165e80b2db72
SSDEEP 12288:PyoKo2JRple9pkJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:PyocDApMdCN/j2GLl3iFSE33b9
TLSH
T1E585E01FBBA940A2E076823C89858745E773B0705B2253CB5691C37E4F27AECBD35B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 201f97fd0b49244f3aa381800025f6baa7b579e9746a87faebd19d00eb8c8031
MD5 a8a89d9c161f578960f2d6a8432bcec2
SHA1 ba5de95277a907745181ab39dd45cca34bd5d383
SHA512 a278529fb4d42f4f1c81215197301133e4107964f2224dd79118e74890ca42341aeb08e96d1fc4f85423e3b84adf8a1f2ab61ecf5bf1fbf8a94fb4babc74c55f
SSDEEP 49152:SWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK3N/j2U4FH:E0zuNIrj2jF
TLSH
T116A57B3DA2F800A8D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 bcd5275828ce67010e8bfd3eb271703ca844af6a60c32bf4c509e2d37676fb31
MD5 db2f244b5613cf27cddcc7a0e8989bb8
SHA1 df57bedfe9982e6d3fa1cda44b34d0f9975ad68a
SHA512 5f41caa49d8335284793ae9af33131119759c2a309d6b79a7a9087811b5d02047c62a5c37546b12bdcefc29b46d74a0019de4f137eac3427f6aca36badec4179
SSDEEP 24576:t1QT7EcpfxR+N5AWAz3ooiYtjMqbTdCN/j2GLl3iFSE33b9:YTDxR+N5YzTfjMJN/j2U4FH
TLSH
T18655B02EA7F815E9D17EC5798B23C512FA727861033193CB42A0C17E1E6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.8MB
SHA256 21f12953a3a05292ddc606436fc78a0cf8c4fe3f91ee28481d8c009e20b68561
MD5 a7c657bac7d8ca585e668ebb354a8998
SHA1 9a8412b054b9bd706c38888eeca6bb0be0b2bf98
SHA512 30e6b7b7f628ed8434c5cde288bc327a7f4a0707f02dbfb39f9b08296c6928c4218c83ce0e450faa061738f6f44fed78a74079c833e720adb04fbd569262084c
SSDEEP 24576:BTMdOz0FFS+imSLndCN/j2GLl3iFSE33b9:r0K+imSLUN/j2U4FH
TLSH
T12E95E13EA3AD14E5E47BC27D8653C906E67274A5032166CB06D0C1BA3F5BFE4793AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.6MB
SHA256 e24d546a6863e3694cb4b53c772bc5daf992a98b4d810d851fb938f00f0da1d8
MD5 370f0ebb657789ed7a3154a7cb720753
SHA1 9f3db58bb44fe21652feedb5569e1e8b168d1b0f
SHA512 bca0c80022fcca5814ef6b8d1c2226ea44d33fa9e71e8b45f276a0ea938549839c3d09fb21f7e82944915e2666f389901de76b9a1b2c89e06cc6e2670d899b56
SSDEEP 12288:N4KuJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:JCdCN/j2GLl3iFSE33b9
TLSH
T17575121C63E830D4F4768278877A86159220FCB4A72545EF15D0CAFF5B3ABE8D435B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/100-196-0x0000000140000000-0x000000014027F000-memory.dmp

Download

memory/324-200-0x0000000140000000-0x00000001402CB000-memory.dmp

Download

memory/860-190-0x0000000140000000-0x00000001402A2000-memory.dmp

Download

memory/1064-195-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1064-315-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1172-198-0x0000000140000000-0x00000001402EB000-memory.dmp

Download

memory/1172-124-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1172-118-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1728-207-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1728-47-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1728-41-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2024-131-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2728-8-0x0000000002140000-0x00000000021A7000-memory.dmp

Download

memory/2728-251-0x0000000000400000-0x0000000000685000-memory.dmp

Download

memory/2728-320-0x0000000073710000-0x0000000073749000-memory.dmp

Download

memory/2728-4-0x0000000000400000-0x0000000000685000-memory.dmp

Download

memory/2728-0-0x0000000002140000-0x00000000021A7000-memory.dmp

Download

memory/2868-349-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2868-202-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3092-74-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3092-191-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/3092-68-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3120-201-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3136-203-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3400-193-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/3400-91-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/3400-96-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/3528-16-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3528-26-0x0000000140000000-0x0000000140292000-memory.dmp

Download

memory/3528-22-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3736-352-0x000000000C920000-0x000000000C928000-memory.dmp

Download

memory/3736-351-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3736-206-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3736-199-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/3736-172-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/3736-156-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/3816-318-0x0000000140000000-0x0000000140293000-memory.dmp

Download

memory/3816-14-0x0000000140000000-0x0000000140293000-memory.dmp

Download

memory/3836-78-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/3836-192-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/3836-84-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/3856-377-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-381-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-388-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-386-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-372-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-371-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-370-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-369-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-368-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-367-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-366-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-365-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-364-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-363-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-362-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-361-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-360-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-359-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-358-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-357-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-356-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-376-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-390-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-378-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-379-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-382-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-380-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-389-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-383-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-384-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-385-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-354-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-355-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-375-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-374-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-373-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-387-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-393-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-391-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3856-392-0x00000237A3C40000-0x00000237A3C50000-memory.dmp

Download

memory/3948-194-0x0000000140000000-0x000000014027E000-memory.dmp

Download

memory/4124-338-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4124-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4356-204-0x0000000140000000-0x00000001402AF000-memory.dmp

Download

memory/4356-350-0x0000000140000000-0x00000001402AF000-memory.dmp

Download

memory/4444-57-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4444-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4444-61-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4444-63-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/4720-197-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4720-107-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4720-113-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4796-37-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4796-189-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4796-31-0x0000000000800000-0x0000000000860000-memory.dmp

Download