Overview

overview

10

Static

static

3

2026-08-09...mi.exe

windows10-2004-x64

10

2026-08-09...mi.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    88s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 13:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_f8a4cdb0f25d081a000491a70f7bb0fa_elex_smoke-loader_wannacry_wapomi.exe
  • Size 1.5MB
  • Sample260809-qmnw7syblc
  • SHA256 1578d19544d444055fb6806c6b317268bfe30a8b952f86afde5a7b34dac880b8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
aspackv2backdoorcredential_accessdiscoveryexecutionbdaejecpersistencespywarestealer

Malware Config

Extracted

Family

  • bdaejec

C2

  • ddos.dnsnb8.net

Signatures

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec
  • Detects Bdaejec Backdoor. 1 IoCs

    Bdaejec is backdoor written in C++.

  • Detects executables packed with ASPack 3 IoCs
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Executes dropped EXE 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 49 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Discovers running processes 1 TTPs 1 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Drops file in System32 directory 64 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 7 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 50 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Connections Discovery 1 TTPs 1 IoCs

    Attempt to get a listing of network connections.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Discovers systems in the same network 1 TTPs 1 IoCs
    discovery
  • Gathers network information 2 TTPs 3 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies data under HKEY_USERS 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f8a4cdb0f25d081a000491a70f7bb0fa_elex_smoke-loader_wannacry_wapomi.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_f8a4cdb0f25d081a000491a70f7bb0fa_elex_smoke-loader_wannacry_wapomi.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3276
    • C:\Users\Admin\AppData\Local\Temp\srUNTG.exe
      C:\Users\Admin\AppData\Local\Temp\srUNTG.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:1508
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3a474f7d.bat" "
        3⤵
        • Executes a command shell one-liner
        PID:716
    • C:\Users\Admin\AppData\Local\Temp\2026-08-09_f8a4cdb0f25d081a000491a70f7bb0fa_elex_smoke-loader_wannacry_wapomi.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-09_f8a4cdb0f25d081a000491a70f7bb0fa_elex_smoke-loader_wannacry_wapomi.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1464
      • C:\ProgramData\Application Data\wmimgmt.exe
        "C:\ProgramData\Application Data\wmimgmt.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5564
        • C:\ProgramData\Application Data\wmimgmt.exe
          "C:\ProgramData\Application Data\wmimgmt.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5956
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /v:on /c "C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\ghi.bat"
            5⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1052
            • C:\Windows\SysWOW64\findstr.exe
              findstr /s "YM.CGP_" "C:\Users\Admin"\..\*.txt
              6⤵
              • System Location Discovery: System Language Discovery
              PID:468
            • C:\Windows\SysWOW64\chcp.com
              chcp
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4120
            • C:\Windows\SysWOW64\net.exe
              net user
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2284
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 user
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3332
            • C:\Windows\SysWOW64\net.exe
              net localgroup administrators
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1712
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 localgroup administrators
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1892
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist
              6⤵
              • Discovers running processes
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:4520
            • C:\Windows\SysWOW64\systeminfo.exe
              systeminfo
              6⤵
              • System Location Discovery: System Language Discovery
              • Gathers system information
              PID:2228
            • C:\Windows\SysWOW64\reg.exe
              reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2420
            • C:\Windows\SysWOW64\find.exe
              find "REG_"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4816
            • C:\Windows\SysWOW64\reg.exe
              reg query HKEY_CURRENT_USER\Software\Microsoft\Office
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4312
            • C:\Windows\SysWOW64\reg.exe
              reg query HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Common\UserInfo
              6⤵
              • System Location Discovery: System Language Discovery
              PID:5936
            • C:\Windows\SysWOW64\reg.exe
              reg query HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Common\UserInfo
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1424
            • C:\Windows\SysWOW64\reg.exe
              reg query HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Common\UserInfo
              6⤵
              • System Location Discovery: System Language Discovery
              PID:6012
            • C:\Windows\SysWOW64\reg.exe
              reg query HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Common\UserInfo
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1120
            • C:\Windows\SysWOW64\reg.exe
              reg query HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\UserInfo
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1420
            • C:\Windows\SysWOW64\reg.exe
              reg query HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Common\UserInfo
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4272
            • C:\Windows\SysWOW64\ipconfig.exe
              ipconfig /all
              6⤵
              • System Location Discovery: System Language Discovery
              • Gathers network information
              PID:4748
            • C:\Windows\SysWOW64\NETSTAT.EXE
              netstat -ano
              6⤵
              • System Location Discovery: System Language Discovery
              • System Network Connections Discovery
              • Gathers network information
              • Suspicious use of AdjustPrivilegeToken
              PID:556
            • C:\Windows\SysWOW64\ARP.EXE
              arp -a
              6⤵
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:3664
            • C:\Windows\SysWOW64\NETSTAT.EXE
              netstat -r
              6⤵
              • System Location Discovery: System Language Discovery
              • Gathers network information
              • Suspicious use of WriteProcessMemory
              PID:2800
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
                7⤵
                • Executes a command shell one-liner
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:624
                • C:\Windows\SysWOW64\ROUTE.EXE
                  C:\Windows\system32\route.exe print
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:2400
            • C:\Windows\SysWOW64\net.exe
              net start
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1824
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 start
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5016
            • C:\Windows\SysWOW64\net.exe
              net use
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3316
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo n"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4248
            • C:\Windows\SysWOW64\net.exe
              net share
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3940
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 share
                7⤵
                • System Location Discovery: System Language Discovery
                PID:948
            • C:\Windows\SysWOW64\net.exe
              net view /domain
              6⤵
              • System Location Discovery: System Language Discovery
              • Discovers systems in the same network
              PID:3200
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\s.log "
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4484
            • C:\Windows\SysWOW64\find.exe
              find /i /v "------"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:980
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\t.log "
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1988
            • C:\Windows\SysWOW64\find.exe
              find /i /v "domain"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2392
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\s.log "
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4444
            • C:\Windows\SysWOW64\find.exe
              find /i /v "¬A╛╣"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2564
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\t.log "
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3304
            • C:\Windows\SysWOW64\find.exe
              find /i /v "░⌡ªµª¿"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2448
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\s.log "
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1260
            • C:\Windows\SysWOW64\find.exe
              find /i /v "├ⁿ┴ε"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2980
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\t.log "
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4052
            • C:\Windows\SysWOW64\find.exe
              find /i /v "completed successfully"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4720
  • C:\ProgramData\Application Data\wmimgmt.exe
    "C:\ProgramData\Application Data\wmimgmt.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2108
    • C:\ProgramData\Application Data\wmimgmt.exe
      "C:\ProgramData\Application Data\wmimgmt.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3160
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4596
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    PID:5812
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:3520
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    PID:2696
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    PID:1364
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3100
  • C:\Windows\System32\ReFsDedupSvc.exe
    C:\Windows\System32\ReFsDedupSvc.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:3248
  • C:\Windows\System32\SensorDataService.exe
    C:\Windows\System32\SensorDataService.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Checks SCSI registry key(s)
    PID:5076
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:1876
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4580
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4492
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
      2⤵
      • Modifies data under HKEY_USERS
      PID:4508
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
      2⤵
        PID:5660
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
          PID:2456
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
          2⤵
            PID:2564
        • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
          C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
          1⤵
          • Executes dropped EXE
          PID:2260

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              2
              T1059

              Windows Command Shell

              1
              T1059.003

              Persistence

              Account Manipulation

              1
              T1098

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Privilege Escalation

              Account Manipulation

              1
              T1098

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Defense Evasion

              Modify Registry

              1
              T1112

              Credential Access

              Credentials from Password Stores

              2
              T1555

              Credentials from Web Browsers

              1
              T1555.003

              Windows Credential Manager

              1
              T1555.004

              Unsecured Credentials

              1
              T1552

              Credentials In Files

              1
              T1552.001

              Discovery

              Browser Information Discovery

              1
              T1217

              Network Service Discovery

              1
              T1046

              Network Share Discovery

              1
              T1135

              Peripheral Device Discovery

              2
              T1120

              Permission Groups Discovery

              1
              T1069

              Local Groups

              1
              T1069.001

              Process Discovery

              1
              T1057

              Query Registry

              3
              T1012

              Remote System Discovery

              1
              T1018

              System Information Discovery

              5
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              System Network Connections Discovery

              1
              T1049

              Lateral Movement

              Collection

              Data from Local System

              1
              T1005

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              elevation_service.exe
              • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
              • Size 2.7MB
              • SHA256 24922110a70a7f26cd11b52786a96711de9c0d8d88b5f213d5b86d60c1032890
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              maintenanceservice.exe
              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
              • Size 1.4MB
              • SHA256 8376de62000e358f7a9cbd2131ad3e222e4517a25d4c474edb8e20098cad4ee0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7z.exe
              • Path C:\Program Files\7-Zip\7z.exe
              • Size 1.7MB
              • SHA256 01eb00d25857f76b0c496b1e293ad8b0dc7428d1438f4cbd5c47b4ca6f8bf298
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zFM.exe
              • Path C:\Program Files\7-Zip\7zFM.exe
              • Size 1.5MB
              • SHA256 4e8598cc86394b7bb401fcb804a86e4234d7d3828368ac20da8c023c4cc2feaa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zG.exe
              • Path C:\Program Files\7-Zip\7zG.exe
              • Size 1.2MB
              • SHA256 feb3adb719c971a83ebd9b97c09298d301ccffd6c50b7ab9da6514cabd64f37f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Uninstall.exe
              • Path C:\Program Files\7-Zip\Uninstall.exe
              • Size 31KB
              • SHA256 7562eaacced3aecf4ea74f2232d25f66ec702aec712c959f1fe07b02c1bd21ff
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Uninstall.exe
              • Path C:\Program Files\7-Zip\Uninstall.exe
              • Size 1.8MB
              • SHA256 56f03b4a50f7d1d0a8c85f5b602aa4257504a7c0dcadd159bb6836a35518b13c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVShNotify.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
              • Size 1.4MB
              • SHA256 7255ad4328398622337919202f2a3b52eb5e9f9281655cdfbb06fb45ef5104bf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IntegratedOffice.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
              • Size 4.6MB
              • SHA256 80643b86f4f1d55d37c5abba3a700f9d9d7b58ef6016dcb71c22f98ea2ceefd4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MavInject32.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
              • Size 1.5MB
              • SHA256 797c04e213bc77c8b4f4dd64e33a7b4320ec01ad45da8239c268b759bf551879
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OfficeC2RClient.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
              • Size 24.0MB
              • SHA256 af4c232af0f861e5161346218fd85a73e65286711bb4f9dcffc73dc9ffb48034
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appvcleaner.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
              • Size 2.7MB
              • SHA256 58eac94e61232bcd44c95b28ca1c6e406d7d61446b1d7580439f660a9f391979
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              LICLUA.EXE
              • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
              • Size 1.1MB
              • SHA256 9b48f4372be62a03028a0f7c74257cf54b8d0c1c4a10cb8334ca3c9334a2cfe7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OSE.EXE
              • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
              • Size 1.4MB
              • SHA256 12b54f24ff0e397e2019d857e5f6c2311e7b4c2bf217617759cf71f56cb05a38
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSTOInstaller.exe
              • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
              • Size 1.3MB
              • SHA256 1fe852c35c7c2f13a0140ca640cde36ebcb2b32da5473da1b5b92c51fe61489d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrmstp.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
              • Size 6.6MB
              • SHA256 bf67d106c6758bdda302c06d933fbadd5aff9f6c8e9781bf96b0f79bb1e24181
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              setup.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
              • Size 6.6MB
              • SHA256 ca87a14d373194b29918b04d90c335992213ce60045a42c8c17d0389e48d8229
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_pwa_launcher.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
              • Size 2.3MB
              • SHA256 778861f87519009dca8d3da478417f5b3cf9a756ed131990e6ab1d56dd6776b7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevated_tracing_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
              • Size 4.0MB
              • SHA256 8143dc4a27ea645ac5e51b9f0adf84857380167a3b12130414db7eb75b81d3a2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              • Size 2.8MB
              • SHA256 1be3cb38784c5a8eebf0d4aa2b1e0d5de852c2f8225cb7d00276d0561f1812e7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              • Size 3.4MB
              • SHA256 6c96ad01b9df9f161206acdcc3970a4ba4aebcea742340124c4612225e526cc9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              notification_helper.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
              • Size 2.2MB
              • SHA256 76b4deb179fd5502c8ff3753d3a86ee5bdf20f732ae66ad05afdd696caa51873
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              os_update_handler.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
              • Size 2.4MB
              • SHA256 f08722c3cabcb1f533b74a8e8922352f86b73f2433e6b253e155c444b6b6efd0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_proxy.exe
              • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
              • Size 2.0MB
              • SHA256 984ba74250c323eb0ba1941c6dacdf9f7b82b163fbe6ccb206c1ff86e5242639
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appletviewer.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
              • Size 1.2MB
              • SHA256 4b20ae9a786363ed41baaa83cfb83c6aff7478dbfbdbb7d3ecd9e99a8cd776b3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              extcheck.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
              • Size 1.2MB
              • SHA256 e18eb21faac4130f5c74cab8155a15f1585a507a1fb07dc1c49deb56d4a97a5a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              idlj.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
              • Size 1.2MB
              • SHA256 20d556f5bb0fffe574295460032ffb7375ed348f01cc759e635e490375ae7f87
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jabswitch.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
              • Size 1.2MB
              • SHA256 28df2cb18a5ef3e23501674f73f85c39d2a7863a410575267d51a85cd9b07d95
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jar.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
              • Size 1.2MB
              • SHA256 0ce1dce264f970e0f99236d70b7f7d6cf6296ecb5d550df51effb10c6c45e7c4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jarsigner.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
              • Size 1.2MB
              • SHA256 135d4908feccfee0baeb37213b4ffe87e0b654de2d32ba3b8d90d454b4807826
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              java-rmi.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
              • Size 1.2MB
              • SHA256 e36fd63c91beb1bf5dfccbcc6fab7ec473dc5c7161c6c8725543b2291af36c2d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MsSense.exe
              • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
              • Size 1.6MB
              • SHA256 c1b16750c76cd08017cb306d6cf1f76f8317605fc12f35c464276a67b46bc42b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NisSrv.exe
              • Path C:\Program Files\Windows Defender\NisSrv.exe
              • Size 3.5MB
              • SHA256 22627da0ae02e5e2d41c9b7a0633980477530f4d01af64311ab9d7bb34a357d0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dotnet.exe
              • Path C:\Program Files\dotnet\dotnet.exe
              • Size 1.3MB
              • SHA256 89baeb3f562542f3cce95c4d8362879586dac9ec0deadf79a3b68be17bb67d3c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wmimgmt.exe
              • Path C:\ProgramData\wmimgmt.exe
              • Size 1.5MB
              • SHA256 1578d19544d444055fb6806c6b317268bfe30a8b952f86afde5a7b34dac880b8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              INFO.TXT
              • Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\INFO.TXT
              • Size 13KB
              • SHA256 42862a9a57ca5f23356e93cae247e1ed0ad1d54f7dfc8834db5f3f99035d6a1b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              drivers.p
              • Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\drivers.p
              • Size 15B
              • SHA256 d8a21e76d208e48198b4afa4a54157044255e074acd5c25f99d9894ad70fbde2
              • MD5 SHA1 SHA512
              Submit Download

              ghi.bat
              • Path C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\ghi.bat
              • Size 3KB
              • SHA256 1ebd7eae014cf21830a64f251bf768e2935fa3de5223dcb86f3e69dc88c384c8
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              INFO.TXT
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\INFO.TXT
              • Size 43B
              • SHA256 20baad0534e4a226112b14c5733246ec690d8f67ba78d2f9e8b93eac02e37df5
              • MD5 SHA1 SHA512
              Submit Download

              3a474f7d.bat
              • Path C:\Users\Admin\AppData\Local\Temp\3a474f7d.bat
              • Size 187B
              • SHA256 bd96247b64b3f99cabd4b8e4efdf0a84de3b55c6137b78aa3211b806fc4d6ec8
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              srUNTG.exe
              • Path C:\Users\Admin\AppData\Local\Temp\srUNTG.exe
              • Size 15KB
              • SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              934ae80e05f6396.bin
              • Path C:\Users\Admin\AppData\Roaming\934ae80e05f6396.bin
              • Size 12KB
              • SHA256 d4d0a04dd953fb0cad79e9e33b57b5c79875a9b87d249c536c0ea8925d3384be
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              perfhost.exe
              • Path C:\Windows\SysWOW64\perfhost.exe
              • Size 1.2MB
              • SHA256 766ff7d7e4ee95bf1ca84e906cb2076a1c283628f7220198877a94f660f34d35
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AgentService.exe
              • Path C:\Windows\System32\AgentService.exe
              • Size 1.4MB
              • SHA256 4178435a8cef9b2a61b5c771c37dd9d433d4a0346f781f0bed1fce957bd7718a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ssh-agent.exe
              • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
              • Size 1.7MB
              • SHA256 6db4379e6bced03dc48d93ab619538e159fc64b35d1c9503e747aec610ad1671
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ReFsDedupSvc.exe
              • Path C:\Windows\System32\ReFsDedupSvc.exe
              • Size 2.6MB
              • SHA256 c0b6dd52ac71a84b7e940a899879de4b04235950e85b244be3fca99fac0e3616
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SearchIndexer.exe
              • Path C:\Windows\System32\SearchIndexer.exe
              • Size 1.4MB
              • SHA256 b6d8e7d99a00b95f25f00161a618099d12663145b521f2393e5976f7927dbe9d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SensorDataService.exe
              • Path C:\Windows\System32\SensorDataService.exe
              • Size 1.7MB
              • SHA256 8bf62d429117aeea35c91921925bf846d4d17715f2550fc6e0c88d116e8a63f7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wmpnetwk.exe
              • Path C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_10.0.26100.1_none_007a743337203bf3\wmpnetwk.exe
              • Size 1.4MB
              • SHA256 6478fb51d8012172975d79280a16ce9c87e0f8bfa4c239acebfb262d8ee45c9b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SgrmBroker.exe
              • Path C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.26100.1150_none_f5f28f643cc492d0\SgrmBroker.exe
              • Size 1.6MB
              • SHA256 0a9bdc568b90249877c8a5866bd58fbd8c042800de50d5b020dbbd25e5e852d4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVClient.exe
              • Path C:\Windows\system32\AppVClient.exe
              • Size 1.3MB
              • SHA256 b013f5c6e6347dd2e9c0d5cd2dca90313197968f9096f448647a71a1f89c5e54
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PerceptionSimulationService.exe
              • Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
              • Size 1.4MB
              • SHA256 03de66f782c2ce2abc7033d9a6f15879b11741ee4b1ed9306a6e18239a47bd74
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              934ae80e05f6396.bin
              • Path C:\Windows\system32\config\systemprofile\AppData\Roaming\934ae80e05f6396.bin
              • Size 12KB
              • SHA256 d2e8eccdbc36b35e9165601f05fe276012aecfe2296198b5c9ef2c1fa85ffd22
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/1364-133-0x0000000000730000-0x0000000000790000-memory.dmp
              Download

              memory/1364-139-0x0000000000730000-0x0000000000790000-memory.dmp
              Download

              memory/1364-131-0x0000000140000000-0x000000014020A000-memory.dmp
              Download

              memory/1364-250-0x0000000140000000-0x000000014020A000-memory.dmp
              Download

              memory/1464-22-0x0000000000400000-0x0000000000424000-memory.dmp
              Download

              memory/1508-5-0x0000000000BA0000-0x0000000000BA9000-memory.dmp
              Download

              memory/1508-45-0x0000000000BA0000-0x0000000000BA9000-memory.dmp
              Download

              memory/1876-189-0x0000000000990000-0x00000000009F0000-memory.dmp
              Download

              memory/1876-183-0x0000000000990000-0x00000000009F0000-memory.dmp
              Download

              memory/1876-181-0x0000000140000000-0x000000014027D000-memory.dmp
              Download

              memory/1876-353-0x0000000140000000-0x000000014027D000-memory.dmp
              Download

              memory/2108-69-0x0000000002450000-0x00000000024B7000-memory.dmp
              Download

              memory/2108-81-0x0000000000400000-0x0000000000626000-memory.dmp
              Download

              memory/2108-74-0x0000000002450000-0x00000000024B7000-memory.dmp
              Download

              memory/2260-446-0x0000000000B70000-0x0000000000BD0000-memory.dmp
              Download

              memory/2260-444-0x0000000140000000-0x000000014020A000-memory.dmp
              Download

              memory/2260-438-0x0000000000B70000-0x0000000000BD0000-memory.dmp
              Download

              memory/2260-452-0x0000000140000000-0x000000014020A000-memory.dmp
              Download

              memory/2696-127-0x0000000000870000-0x00000000008D0000-memory.dmp
              Download

              memory/2696-121-0x0000000000870000-0x00000000008D0000-memory.dmp
              Download

              memory/2696-120-0x0000000140000000-0x000000014020E000-memory.dmp
              Download

              memory/2696-239-0x0000000140000000-0x000000014020E000-memory.dmp
              Download

              memory/3100-264-0x0000000000400000-0x00000000005D6000-memory.dmp
              Download

              memory/3100-143-0x0000000000400000-0x00000000005D6000-memory.dmp
              Download

              memory/3100-149-0x00000000009C0000-0x0000000000A27000-memory.dmp
              Download

              memory/3100-144-0x00000000009C0000-0x0000000000A27000-memory.dmp
              Download

              memory/3248-160-0x0000000000750000-0x00000000007B0000-memory.dmp
              Download

              memory/3248-153-0x0000000140000000-0x00000001402C9000-memory.dmp
              Download

              memory/3248-449-0x0000000000750000-0x00000000007B0000-memory.dmp
              Download

              memory/3248-295-0x0000000140000000-0x00000001402C9000-memory.dmp
              Download

              memory/3248-451-0x0000000140000000-0x00000001402C9000-memory.dmp
              Download

              memory/3248-154-0x0000000000750000-0x00000000007B0000-memory.dmp
              Download

              memory/3276-20-0x0000000000400000-0x0000000000626000-memory.dmp
              Download

              memory/3276-0-0x0000000000400000-0x0000000000626000-memory.dmp
              Download

              memory/3276-15-0x00000000025C0000-0x0000000002627000-memory.dmp
              Download

              memory/3276-8-0x00000000025C0000-0x0000000002627000-memory.dmp
              Download

              memory/3520-116-0x0000000001DB0000-0x0000000001E10000-memory.dmp
              Download

              memory/3520-118-0x0000000140000000-0x0000000140214000-memory.dmp
              Download

              memory/3520-105-0x0000000140000000-0x0000000140214000-memory.dmp
              Download

              memory/3520-112-0x0000000001DB0000-0x0000000001E10000-memory.dmp
              Download

              memory/3520-106-0x0000000001DB0000-0x0000000001E10000-memory.dmp
              Download

              memory/4492-212-0x0000000140000000-0x0000000140172000-memory.dmp
              Download

              memory/4492-372-0x0000000140000000-0x0000000140172000-memory.dmp
              Download

              memory/4492-213-0x00000000006A0000-0x0000000000700000-memory.dmp
              Download

              memory/4492-219-0x00000000006A0000-0x0000000000700000-memory.dmp
              Download

              memory/4580-194-0x0000000140000000-0x0000000140168000-memory.dmp
              Download

              memory/4580-201-0x0000000000810000-0x0000000000870000-memory.dmp
              Download

              memory/4580-195-0x0000000000810000-0x0000000000870000-memory.dmp
              Download

              memory/4580-203-0x0000000000810000-0x0000000000870000-memory.dmp
              Download

              memory/4580-205-0x0000000140000000-0x0000000140168000-memory.dmp
              Download

              memory/4596-193-0x0000000140000000-0x0000000140376000-memory.dmp
              Download

              memory/4596-82-0x0000000140000000-0x0000000140376000-memory.dmp
              Download

              memory/4596-83-0x0000000000E60000-0x0000000000EC0000-memory.dmp
              Download

              memory/4596-89-0x0000000000E60000-0x0000000000EC0000-memory.dmp
              Download

              memory/5076-168-0x0000000140000000-0x00000001401BA000-memory.dmp
              Download

              memory/5076-175-0x00000000007D0000-0x0000000000830000-memory.dmp
              Download

              memory/5076-357-0x0000000140000000-0x00000001401BA000-memory.dmp
              Download

              memory/5076-355-0x00000000007D0000-0x0000000000830000-memory.dmp
              Download

              memory/5076-337-0x0000000140000000-0x00000001401BA000-memory.dmp
              Download

              memory/5076-169-0x00000000007D0000-0x0000000000830000-memory.dmp
              Download

              memory/5564-23-0x0000000002400000-0x0000000002467000-memory.dmp
              Download

              memory/5564-28-0x0000000002400000-0x0000000002467000-memory.dmp
              Download

              memory/5564-35-0x0000000000400000-0x0000000000626000-memory.dmp
              Download

              memory/5812-95-0x00000000007E0000-0x0000000000840000-memory.dmp
              Download

              memory/5812-211-0x0000000140000000-0x00000001402D4000-memory.dmp
              Download

              memory/5812-94-0x0000000140000000-0x00000001402D4000-memory.dmp
              Download

              memory/5812-101-0x00000000007E0000-0x0000000000840000-memory.dmp
              Download

              memory/5956-427-0x0000000000400000-0x0000000000424000-memory.dmp
              Download

              memory/5956-67-0x0000000000400000-0x0000000000424000-memory.dmp
              Download

              memory/5956-62-0x0000000000400000-0x0000000000424000-memory.dmp
              Download

              memory/5956-448-0x0000000000400000-0x0000000000424000-memory.dmp
              Download

              memory/5956-432-0x0000000000400000-0x0000000000424000-memory.dmp
              Download

              memory/5956-60-0x0000000000400000-0x0000000000424000-memory.dmp
              Download

              memory/5956-371-0x0000000000400000-0x0000000000424000-memory.dmp
              Download

              memory/5956-456-0x0000000000400000-0x0000000000424000-memory.dmp
              Download

              memory/5956-463-0x0000000000400000-0x0000000000424000-memory.dmp
              Download

              memory/5956-479-0x0000000000400000-0x0000000000424000-memory.dmp
              Download

              memory/5956-210-0x0000000000400000-0x0000000000424000-memory.dmp
              Download