56565fd996c05fd48689d4597b564f592ae7b97b1728c0d65615dc363ce1a5de

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_4db8dce75a0eb7d4744ee20d4254f7e9_elex_wannacry.exe
Size 2.6MB
Sample260816-wpbmjstyg1
SHA256 56565fd996c05fd48689d4597b564f592ae7b97b1728c0d65615dc363ce1a5de
MD5 4db8dce75a0eb7d4744ee20d4254f7e9
SHA1 bddbc256a99c6a301ee2db23279ed52ec8afc6f6
SHA512 08504fb9a82b44c05e8b5ae3bca8d9c742c9643ee54a5272fa27030f35654ad9fcb101c2e3732f4728bdd3b7f7e30a25c8b47f907d8d558cb478e0e9575ce453
SSDEEP 24576:WS/Ya7Taz/Zu+1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ozR5LNiXicJFFRGNzj3
TLSH
T115D5E181E58185B2EE61403645A65B76CA70DD593F339AA3E394FE39AC33321EF1530E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
548	alg.exe
5064	DiagnosticsHub.StandardCollector.Service.exe
1276	fxssvc.exe
3256	elevation_service.exe
4448	elevation_service.exe
2400	maintenanceservice.exe
3960	OSE.EXE
4908	msdtc.exe
5008	PerceptionSimulationService.exe
3000	perfhost.exe
4380	locator.exe
396	SensorDataService.exe
3812	snmptrap.exe
4160	spectrum.exe
1640	ssh-agent.exe
4660	TieringEngineService.exe
3040	AgentService.exe
4300	vds.exe
3016	vssvc.exe
2244	wbengine.exe
3284	WmiApSrv.exe
4632	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-16_4db8dce75a0eb7d4744ee20d4254f7e9_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\14bd86bf2d44b5a9.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-16_4db8dce75a0eb7d4744ee20d4254f7e9_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-16_4db8dce75a0eb7d4744ee20d4254f7e9_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-16_4db8dce75a0eb7d4744ee20d4254f7e9_elex_wannacry.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-16_4db8dce75a0eb7d4744ee20d4254f7e9_elex_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103203\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4856	3264	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_4db8dce75a0eb7d4744ee20d4254f7e9_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d93a2d21aa2ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e6693c18aa2ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba8abf18aa2ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f196c18aa2ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af1ed117aa2ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a84ec418aa2ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007cd01f20aa2ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091bdce17aa2ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5064	DiagnosticsHub.StandardCollector.Service.exe
5064	DiagnosticsHub.StandardCollector.Service.exe
5064	DiagnosticsHub.StandardCollector.Service.exe
5064	DiagnosticsHub.StandardCollector.Service.exe
5064	DiagnosticsHub.StandardCollector.Service.exe
5064	DiagnosticsHub.StandardCollector.Service.exe
5064	DiagnosticsHub.StandardCollector.Service.exe
3256	elevation_service.exe
3256	elevation_service.exe
3256	elevation_service.exe
3256	elevation_service.exe
3256	elevation_service.exe
3256	elevation_service.exe
3256	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3264	2026-08-16_4db8dce75a0eb7d4744ee20d4254f7e9_elex_wannacry.exe
Token: SeAuditPrivilege	1276	fxssvc.exe
Token: SeDebugPrivilege	5064	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	3256	elevation_service.exe
Token: SeRestorePrivilege	4660	TieringEngineService.exe
Token: SeManageVolumePrivilege	4660	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3040	AgentService.exe
Token: SeBackupPrivilege	3016	vssvc.exe
Token: SeRestorePrivilege	3016	vssvc.exe
Token: SeAuditPrivilege	3016	vssvc.exe
Token: SeBackupPrivilege	2244	wbengine.exe
Token: SeRestorePrivilege	2244	wbengine.exe
Token: SeSecurityPrivilege	2244	wbengine.exe
Token: 33	4632	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4632	SearchIndexer.exe
Token: SeDebugPrivilege	3256	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 4676	4632	SearchIndexer.exe	131
PID 4632 wrote to memory of 3656	4632	SearchIndexer.exe	132

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-16_4db8dce75a0eb7d4744ee20d4254f7e9_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_4db8dce75a0eb7d4744ee20d4254f7e9_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 548
  2⤵
  - Program crash
  PID:4856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3264 -ip 3264
1⤵
PID:2212

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:548

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4052

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1276

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3256

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4448

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2400

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3960

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4908

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5008

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3000

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4380

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:396

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3812

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4160

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4912

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4660

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3040

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4300

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3016

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2244

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3284

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4676
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0f8b4ecacce0d5864f70a5784334bc6351f0beda21b9d6b20af3936e0ee18dac
MD5 959ca75fe6b1e10d4a78a9fbab3e2789
SHA1 6aba2aed022921eda215c374fe981556d0df7afe
SHA512 d624e921620814b48096322625c71a6d6267d8eaad05d4a9b95c6e261a2ff922345dad13e3ef7691bd3dc038103da4c7d77f39a7a2b95e3f7ccd4e76e572d0b6
SSDEEP 49152:nb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnpLNiXicJFFRGNzj3:V3q6mjB+7wRGpj3
TLSH
T1E8D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 da3fe7f3a4b0b556e65b2072c338c7d8f0105c90f189c692000aedb645b544d8
MD5 0e0e6ab339b7bf617897d0dc5c7a9093
SHA1 26b6d807e523cc70b58b26ccf72bf6ce35a67a8b
SHA512 08dca748a8c8b5b34ce8cd0fe0f2fe67de3936e5d08b9846b45fedb87b255805150e72be4c57b39e23d48832643c3915f14f45dcaa2d82c85bcde2ac8a4d23ac
SSDEEP 24576:mXYfDtczAC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FtcbLNiXicJFFRGNzj3
TLSH
T10F75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 aafa6343b3bd4149ddd9fd3e5c933838ca90db2655912a5bd1eba7dfd0c612c1
MD5 a3e52fc7ca61f26eb022b2fcfd8c64f8
SHA1 8e83591bcfebad8f91a0bd106aca7cb3c58532d2
SHA512 9cff4e3b9e1dc23ece1e66a8480aaac6a8c6dc5f7fa7a5a150a423e25cc83e19e5048865c5d65bf67f2044ecc651f9e5b9c395d40f8c44daf72b2bfdde204c92
SSDEEP 24576:F0Le5ji0hmxhrMx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FPji0Az4LNiXicJFFRGNzj3
TLSH
T1D0859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4a57bb78e9e3506dc1ef712fa6c9900c2b94f32444dc7ae660b0f2aedd12e9b3
MD5 c4e4ff2f8cb03104ae67dc89bdc83e68
SHA1 9700c840576ed3f9e3909e56f222647d81bf09d4
SHA512 e4adc4cbaf691718fa62c54f7f8277d85e2f2fbec54f3c08b9e645d8e957c35fe291015aa57ee369313617d7b9efa0014a299da0073fb18879c2d02d2096c789
SSDEEP 24576:va7/ezSC6vUyD/aqgrvWj6q8wyuL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:i/ezSC6vUzPv+HjycLNiXicJFFRGNzj3
TLSH
T14D756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 bb7fa29370181416b75b96f7026f0e8480859079cc43950659aa6df23a31629a
MD5 c7e3010dd35d82f5fad3af22feb4c0ca
SHA1 88d8e6998cb929375f3f1d6a86c0c3cbeb4119f6
SHA512 55c351d98a02eabc564dc153149bba6c4827f6493c42ff4b75da6b56efb1dc68a94d7b21070a5929454a2f9dec16fd82c7d6ee4acb71b05fb0be06b6fd46faaf
SSDEEP 24576:BVbqPb88hv/l+Bu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BVO88hXl+YLNiXicJFFRGNzj3
TLSH
T14F559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 85c9ceaaa039e9d8d52ad89344d5128a39940ae8a027312f5df0e9b77845ea72
MD5 ce0b1018664ca5c88dca5a9ee9e0e0c0
SHA1 55722972f642f304d58d6ed0bebbbee1de4615e4
SHA512 aa8a33406ab2f3b20457ea3e443d4a5894ed77cc0b89fbbee214a0ca6f2d42a5640bb2b7fd6d6424e77725b16fc78bb4593ff75c736eb960cdbbc9e6ed2b51e5
SSDEEP 24576:WGd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/LNiXicJFFRGNzj3
TLSH
T1DA5523D3468855B1FBFD003A867A5828B5845E2CCA595CE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 8760952fae2e5607267c75c6ff56d05e3419f0367c357daf138c927be649daf9
MD5 cdc94509bc25dce9f166186ca513b3e4
SHA1 de45321158b24eeb0eb499a115ca3e2d251abfd2
SHA512 f7cd96675ad3ac1df7e36ceee50b200585007406cebb3a1942af5fd480b21c37b2233e2e692ede8b01c6f1facf8c5652f0e528116c6ba6c4bfaaa9db4cbae2e7
SSDEEP 24576:rJIUW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rJIUWLNiXicJFFRGNzj3
TLSH
T15975CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 db1073fdf32f8ede8343f35631c7b76d4e29efd8a25fcbde5795ef338c23ca40
MD5 9ca02afbbecbac4b9babb76557a0bcf2
SHA1 75378a7c56794bccf3db79bcdb1d97d39dc54ce2
SHA512 b76ed424133df5c12106b6ea1445eeed0e5a47127134804c326e06f04c960fbecb2aff7bcd79a96a0c194f6039f1c4895cfb24594a7ddb11a8ed464ef80fea92
SSDEEP 49152:zQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THI:zQvGAdlCEL8c/WRNw5C77wRGpj3
TLSH
T11E266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 de697fee5f7d1bac20cd0dcaf1dccb529d68bac5c6f766922adbc45ed6a69464
MD5 c0f2abf289537dacc5461c9de4600394
SHA1 54dd4d6629253de7fe36b7bd622c089c50788c1c
SHA512 895bd57a8998b9b370f2f53be0ab6c5f54728fcfebddd1702793d3542ddcf00d327f268f51342a9aeb974c902da59f0a4e6b28c16069ee7cc741f481b45fe9ef
SSDEEP 24576:jfewsAjo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zljoLNiXicJFFRGNzj3
TLSH
T1BA75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a29c84258424b76c0fd4e0875faa9bb58c34deaba457898ae7a205c439a82e22
MD5 d2abb14becb4b81451fd0ec512cbf5f3
SHA1 95f7cb8b0e12b3d130b0c980c751bbe2e0a79fee
SHA512 95ee7a5bf63a9e6d3e48e28c5b13b495ee30040cc441b20884efb0d97d1e485f55880bbd8e3cc0ff525a2a70b40528917318a40b96b0ad3f191b1c2fe5a99b76
SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHcF9:vUEtQevvqc2W1cpV20I32g9
TLSH
T1DA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a2d47556bb510693c42927ebc20f43419945ab103f5cf86e7c7c0de0bacf013c
MD5 4d4e533f5008e42179a050d3191d91b3
SHA1 1220e7b133510e9b9f694b1ccc373e8b3e14aab3
SHA512 00521f9b90ca74fbf42be0a5e324e6e583ef924d0c62f60fabd2fadaf55b947d05c726b6e58d9c7c72f0757f1aee7285fb031b9561174aceb2c2cbed2f690a31
SSDEEP 49152:XCbRquA/m2yL5zLfFiV+XenmE3/zILNiXicJFFRGNzj3:Aoq2Vjnm/7wRGpj3
TLSH
T11ED58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 297704f14613631dad505234dbd4ca8a1dfcbf5e0e48dd391690705bc8fd35b1
MD5 f9074af99cbfd101fb1d9e268de972b5
SHA1 b574400a86c6d09cafb1e10f5464f4bf206de51f
SHA512 186cc5c144c9473586136e65f99b10e9e0d4087d2581392a86711796e87ae6fcdbdf67f994d5b0e16b0513acfebb6dcdfed8838918905fa4a9fbf380a768898e
SSDEEP 24576:qAhGL6IFoiwtA5l7S53f/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qAM5Foiq5vLNiXicJFFRGNzj3
TLSH
T173359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 7e6cd0e1b3bc1cd608e2580e37479ad8cb764949594bbb257290b896eb283fae
MD5 a42ba17d051dbac1b6035946387df8fc
SHA1 9d578ecd88771a9c68702173c000a5902043993f
SHA512 ffc6f9aff0eab41863069928e78cd8a3094040467f8e4b37fcdc412b7725e0ad03fee21c89838b2db80a411fab1cf91ae3edeb1405ddbe23492a68f328caed95
SSDEEP 24576:fwuROW8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fwSOTLNiXicJFFRGNzj3
TLSH
T13665F18632940CF9EABA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 d7eb6395e6cf51f3cfd1400009e28d191464a9f300884bee2bb6989897310246
MD5 a900a02938d1f7f995ff681a4d8a3b57
SHA1 5bfad9cac70238443487402d59a9283286be39fc
SHA512 faba9c171838162a8405d740b0f9600a54f06a256b067a822ec005ca5ee07b176472df6e20267c0511ea83f894afaadccf012d7486a6c00b97bd8baa867a06ca
SSDEEP 24576:8ZuZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XLNiXicJFFRGNzj3
TLSH
T1A755129622C820F5E2BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 cfe985130728af1c9d6f4ef642b6b9a0f4aa3ebc3fba4ad6d777c67ed22958b4
MD5 38ae7cc7f104d30d31c5885fda2ce19d
SHA1 104f01c4356ef5ba2a8207cb85362d9c021051f1
SHA512 586990db74048cd146f1940985bc045b56a0979ae40e2975699c3149dd5d342cfc5d6a3552728c7c141a05e75d07f56f4810e312ae2343817347192f4eed1e2b
SSDEEP 98304:CQRQyi36YOcPDLvw2gAf+PN3q7wRGpj3:ZQyiKanX+PNuF9
TLSH
T142667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a5094a72e019eaf1f3ca71901a7cc8a5ad21afd9324fc0829771b46ba5b2a3b2
MD5 f1f0c95d714557664d45acd155c62e6d
SHA1 37a41083784a1f1f2baeaf43675ba8515c322fd0
SHA512 c00e3a0eebfaf777f66f3ef6ff5c8af8aab46904651d30525d5a000113f1b494f59528363a97d4908af1fd0d564e8199d722aa5bea1342c5cd60821c238da91f
SSDEEP 98304:+QRQyi36YOcPDLvw2gAf+PN3q7wRGpj3:lQyiKanX+PNuF9
TLSH
T197667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 66b71e8506703598cbf2c3460420c2f065e1f59be804049bbaee223f01cb1f8d
MD5 c0bc33e5af3c1fb5eb3004f00441a938
SHA1 73464e45fd8d36cbe55e916de5cb046e0c82c09c
SHA512 46f8e7fbe52ad96116c1819d0ad27a82b205f6f44bca20d29b47262bb4bacb1b5007dea650338a12471caf0ed48e79128ab7289ccb0bc6638d8d5ea70ccb4d99
SSDEEP 49152:g68Qg55nhkeWu7PNU3/4LNiXicJFFRGNzj3:athTRc/47wRGpj3
TLSH
T15CB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4512b7580f7613f21236ec6b2a21a0c2f96f747ef0c12bfc4ed1690679b6182c
MD5 59dd097661fef12251c0db2463936e45
SHA1 5c80852b41e563635aadc9eea515e7115f1ae047
SHA512 9b5e7d93a4536a00dca212c6b6eb676ba1f9c27b4cfdcd14e561acca59391c83ac4775004497c76b0a2c1fc25bec00b643e47cf8031a9a1d70135dd272a1e023
SSDEEP 98304:Fy5112gYy5azzVvU69nLKnhZd7wRGpj3:oLIHRWhrF9
TLSH
T135167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 10f9a8d100cc9e3e898ce59d8b6d447511599e043dd2280eddb088238524b046
MD5 ff0098f330c169cdbdb7065bb4ea3998
SHA1 bcbd324250d04d90a73210848615e35a374ff28a
SHA512 a1d02628605bf11d76b043992bb0bab8fb0affcd0fec6384f696085eb13d02dea531a6bf1e39df2a3e565699ca798c61a2e5cef3cc38db77798ece340437aa84
SSDEEP 49152:0B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glSLNiXicJFFRGNzj3:uu6JmIxd2dS7wRGpj3
TLSH
T1B9D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5881c23b72c8d914e43c18f378d5ed9f1129088387a6b7a86a686c5ea26c03e3
MD5 42c6ab1ec4b39bfa5d9809969c5a4a5a
SHA1 e0edcc30a852fe2b62aa8352c9aff575becdb8e8
SHA512 a0a60042ce14a3eab8a7a78dcfc9489f4e47c18bb2e4b82d50ff3bcc95c997f87bc44771df2d255e5155ffd377bbd1644b49d07b1de6ff441fabce67e9e500b9
SSDEEP 49152:N1hpsNoJpF1A67U44CwH7R4x2LNiXicJFFRGNzj3:NmifPqR/7wRGpj3
TLSH
T104B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 232e099982482ef48dc918f3c2e41eed20002570ae723fe69dfc8ee478deb2ce
MD5 11e3f69c612937bb42115bebd7635952
SHA1 2972f7f339ebfad5c95b2d929ebbf3e3e61ec048
SHA512 3b127dc11aeeb725eca23b6f5e685cb0f47393466f5bd02e3867c09f61ab65d723d8bd02fc879706b6f9a51688500e1d5dda2460ad3590746035de823df09b4e
SSDEEP 49152:TSuZQIY0Be2KkRVtOnks6NMHqZLNiXicJFFRGNzj3:R5dKqi61Z7wRGpj3
TLSH
T139C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6b44be4097d413deda1806d3dbe9c2c9727b4a1f4907fc6921cadca1883fc291
MD5 ca8f498294fea54fcd9df58633a6783e
SHA1 fb97f8b32c27c4085a8d57fb8d18176080e5e84e
SHA512 3af3f009b10abdafd4a9ebcc6afcb59a2a209d1eaac0a912ec0303a453d2521229f7dbd815f32227d2cf9f6bd032e4e6094856d5a0b236667346e914880553e5
SSDEEP 49152:LhtSn8EApI0figjgiDn0AP5wCLNiXicJFFRGNzj3:KX2iWphz7wRGpj3
TLSH
T1DE95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f77a6889d0287f996e1e3238c2211477560fb6525f564bd4a7f1e28ee1408070
MD5 b220ee9fc495ee36f366ea76f9c4c1d9
SHA1 c0f1f90a77a0528d164f7eb892c86bbf0d11de7d
SHA512 2958e22c749a725738b9dbb2721fe28adb13c5e7421a88cbf34c7c60950754931e7098ee5e928cc86576c1b46653529ee39e75b803e51b785d973d1f15134136
SSDEEP 12288:btTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FA5523D3558955B1F6FC003AC6754428F5882E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c240f93054e3e60fb4c02029f6cb809dc5c8e0bca88e993d5c0eddb32b94e0ec
MD5 e20e3f3486bde8917f04483363393d68
SHA1 aed747c176260031745e843210fe5a340d98f770
SHA512 9ad24ebfe111b3827d1d93ad34f127a3b5a23b49f61ed38ae5be7364a3b3b38b50515de2714c96075bc7057a1ac58aeb81b2195113831971eea44bae71d0855e
SSDEEP 12288:I8TiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:I0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CB5523D3548955B1F6BC003AC6754428F5882E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 4498d1d9dcc7c20d006d77c7372bd9b83e9f5ba98e924bf470cf50893e4dd482
MD5 6525e993628599c325423b51ae585bba
SHA1 ba99827aeaabdc2de94d75fff16244e9d6c7e404
SHA512 d92f2c423de20a7523a82223b0470eda6f2d81e5f5096e0834fd15ebcdd1ea4ab1f15306e186c154205aceb06d1f359151a937246cafb14f368ffd0049d70fc6
SSDEEP 12288:xuTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:x+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1485523D3548955B1E6FC003AC6764428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 5cd3fe561ba8a59f81f6f88b34304d12c28fa5bbaa3115c4dabaeb687cc7a0e8
MD5 184b8ccb0f8a10e534772eb2cb453d7a
SHA1 493a83c783ad8eb4d5cd8306b85df4e7135b5eda
SHA512 92af2d206c27d0cee57fb62f6f938280c56f93e19920900474f909bca1530db9252c8fcf6fae6fd50b9dfe16287ac9298b66a791c4603cf43de01ebab8536330
SSDEEP 12288:PVvTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:t/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C7552392168900E1E9FD8039C6764424F2E47D6CD7365AEBD3003D0E5A74FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 8698d38ad3ce915b1852a552c8d1fe91199651b49b3e2c3a144b875cd71b01c2
MD5 83260fad97e8bc90fa9027450bd2fbea
SHA1 8bc07cb0d2fc0a56fe71e493a23237e4c2876c89
SHA512 27c5a9696dcd08ccb174fcc24c85a88993d29aa87a82cef7666e88a9b5fab6de23be6d94d7a7dfc6a16cb90b05ea919a9b8c3d8bb77abdaba2a9699cbea1bca8
SSDEEP 12288:U3TiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:UX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1645523D3548955B1F6FC003AC6764428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 2e2b1d868de5610c91336f7410addd1241e0aecb7b71ddd989f778ee55b343b1
MD5 ecac24f255db9a88861cd946c5bc32d8
SHA1 686216cd0eae920057da7cdc077f5ab0fe98893d
SHA512 8e51160d131d407a16416f44b0afb503c6c47afc679aca1336bc79eda8272668bbae938522636fd5e93ff4a934fd5d8d12fef5e08aa0751b3328d7620c1d6ff8
SSDEEP 12288:noTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F75523D3558955B1F6BC003AC6754428F5882E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 6c442e12da3d29b907311d812f8da31fba913850079fe1e80f73918bffd0dbe4
MD5 282d1ee7ee71659e1e3d06a143023064
SHA1 09b96d69880834a225a4a13626f7fed0b4aa0573
SHA512 7378f13b5bc73ec2d15bf805300ec24226b12c9122aca8ddb9bf81b2c04b372bde1b24fbb8e082c63a8fdc62c7b79e1a76e09a84546cb3dd3e7622b3e872eeaf
SSDEEP 12288:6kTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6M/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17D5523D3558955B1E7BC0039C6794428F5882E2DEB5658E3E2083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 325699f0b8adc8b95fa7577e17083d2e7b530729e494932faf2bb22f43947e26
MD5 e306a5838edaa6dc8332b09db765f392
SHA1 8023164fac4f00f124e9bf59623987082578db85
SHA512 f5691b60c082febf2616617e72f38f3e2db8f23615c783e69b317a94c6fe03bf259b143b75d2b836b87beb9dd81a3078785f4eab2ae5aa70fdd7bd0abc4bd9b1
SSDEEP 24576:PZM3zFVSOU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PZM3zfgLNiXicJFFRGNzj3
TLSH
T1FA750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f8f1a2d528aa8c5a8c6da629e3996a80bd2b348ce862acff8ea0789ee7f0db89
MD5 8c9ebdc8359bf41e1f9310aedc7e368a
SHA1 680679d9addd57d84d8d79871dc0cd6cc996d67d
SHA512 29a3e9ac2651334b534e2d65145517e3ac4b8c11abed7eff842701527d57b1ade8beafa21711f9e13955d0d595e462b16509bcc5e11b19f52cf13dfcc66ca51b
SSDEEP 12288:PBTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:PJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FF5523D3548955B1FAFC0039C6764428F5881E2DEB5658E3E2483D1EA27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ca14df82d78afea058363333f30213b864a65f58f30a7bb30a2cd3d6e6669ca0
MD5 95c01d430c6608b825ed8c55eb599a59
SHA1 1e45da117a70a5158b3b556ce8bb2d3297d8e0f4
SHA512 cc3f5cfc790935a556302660d67df5fc0a6f0dc0e2b98a9f1c062726577e129e452e847466cab2ce78023986c3f24cb6d130f53c03e14b486e4855e95fc3893f
SSDEEP 12288:4lTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4N/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DE5523D3548955B1FABC0039C6754428F5882E2DEB5659E3E2083D1EA27CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 8f3005eaff5e2ed75de1cfbbed227e82f1263916223f8e92220a8526284195c9
MD5 8235df4a7a120d68886ad939fc6d480b
SHA1 50541b846997a3ee15c8868b176866879d8571f8
SHA512 6d571c98e65bc6c1508867e9068245d54b1bfc45988450983ba999acb888abe97cc22b7653edc03ecad59812e0950a9eb9a18332c7499af7d9afd8e279c1128f
SSDEEP 24576:1zyY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1zLNiXicJFFRGNzj3
TLSH
T1E4650247629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 e73fe97aa51fc3e645310f02d374fc6d08b088b3c5006a580d707e8c68dba597
MD5 c3aa79dc77fd4db9fcf1c1da9cd64b5e
SHA1 88d6c951cc572f3f6ff5ad6233f79bf269aecde0
SHA512 75e527a00b832b9f70d220a67843e0a77981c21339cd287a671cabbda82e5b36033c0c8f1555ddc422fab760631cf9139b502b65f16cbb5d8a2c4d05116c83e6
SSDEEP 12288:ZBTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ZJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A35523D3548955B1FAFC0039C6754428F5881E2DEB5658E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 dd32b32e071dd0c5e415e47132e0ef12ea52a52e461452a8e9ef9ba4dac379f1
MD5 9317d21743721b4066700eca4713f430
SHA1 b97fdd56222675a6b5a3c16f5356b8e2a28caf34
SHA512 266f33e4d07858eb8051af8f91266b127ace616d299d12d4e2b19ec30f148e9d34163154ff5181ee0d7380ab10c5610b8e44911fe0dc012767b214402dea797e
SSDEEP 12288:wBTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:wJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15A5523D3548955B1FAFC003986754428F5882E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 e5bdb93f588cbae9b272b8b168e2ae2dc211af543572a300e8526d619a5c3f5a
MD5 d18b7d7e0f1e01cf8912b5a162a421d9
SHA1 e188a8b672a77512148f9e30e8d47cc91c2fa412
SHA512 48a002681a870d9fb952d5ad39585f2d5d8cbeed9317b067b8ff57515ca405937e8cd5b95cdb90cf8440aa5c98d4ae88361295ed48de5461b6e98cb0f62a1d41
SSDEEP 24576:OzyY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OzLNiXicJFFRGNzj3
TLSH
T112650157629530F9E17A4139C9620911F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 9865a9b5c57a25bd2cf0308c0db05cd6c76580da8f2fa68495b56dfe5e10efe8
MD5 0ea41d329ea6aa0fad6d96eae47bdddc
SHA1 14e7396f13d11edda0e9ec49ddb5ed8c741a29f2
SHA512 61465c6abcb311d8a5c968d44e74c32fb7eaa6d323c4b76946281bbcf3603635eacb84d160b3c9461a89b7adaac2b6a6fcb0bdfe8b43e1790e78482f36a55735
SSDEEP 24576:NT8aLl3z0zDO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NT7LljLLNiXicJFFRGNzj3
TLSH
T1D87502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 2615a8072512ff77d3471741cb42809f204274f4816c90df3876a0e7b3693cc1
MD5 b8a44923eaf7222282bbe86dee46014b
SHA1 6a5ce1496e6de62244e11cf5e3ee3c77a11bf758
SHA512 416b9245d4186d545ddffda050fbe7952b7f03061c8860e49ce62dc6cd86d52c5cf881ceb050f55d1cce0bfeb388544bc1d62ef7077783b039a6256e5c227e0d
SSDEEP 24576:K3rd9CHKy7GZK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:srd9CHKyagLNiXicJFFRGNzj3
TLSH
T1BA85CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 b0a0d86ae4221d439723cbd92b606ca8daa76ffcb06622dca3c6753551765525
MD5 7d9f878cb916535ad5b0faed15e9d9ae
SHA1 12782e3f81f7decceecda5e7b3612aa90a3a2168
SHA512 f8fe0055116e6e44af03dfd9ae1eb1dd70b2d8d506df27140ff864bf5d2f57402a749d6f3f0af4411417f8e37e5b50338649e654b5fc80721a4f72f596199f5e
SSDEEP 12288:6OTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6e/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17D5523D3548955B1F6FC0039C67A4428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 959dbdd8eb8d40a2c4ad4596dacbe9db3abe55315b0f4c989d77d17833d56507
MD5 0f48b4148e8271a069ab42de43b4c99c
SHA1 678cac89463d4c7def7f93e80e3e8ce1407a15c3
SHA512 c2154659f9c0b76bd41f677e9cebc48bca08943f2a195ff771fe0bbd8c9959924da881e7d22ad061e0353c9d74b3de21486c504899a160ab6bb01bd390db483d
SSDEEP 12288:fgTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:f4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AC5523D2558955F1F6BC0039867A4428F5881E2DDB6619E3E2483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 13059cfa65aa1f6287aa75f0428c601fd2b07b878ae61d9c43041b2149e77233
MD5 823bada0a2b87596a3305a14fcb1bc34
SHA1 e405583b79e4ec29adcfa55aceee1f393e4c2874
SHA512 82dbdf9a94e60c16a12f380c36dfc2a411f3605f907001059e4001b2575fc7080abf6fc256750a6273d9419bb78ff1122b3403f60e962ef73b96ec2c4253d998
SSDEEP 12288:hjTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1165523D3548955B1EAFC0039C6754428F5882E2DEB5658E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 e797fe21d06aaaa9694f6556690037d76cd629baacfd3ba34b9088c36b9a8461
MD5 35360d215df5ed093be351c5dbcc1de6
SHA1 2022db88fbbd175801029aa32b076756080f666b
SHA512 856b9e603f3f16553a12f31af1a6fb06394a75ef790a34387a6dad559cc96fc4f02c130aba700e30a71e0b4948cf2b723eeb60a6f71afec3310a7658ac4a7c52
SSDEEP 12288:6psfxTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:TZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15F65F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 6bcd45f2655c44d54715bfa7c1ef5618395f3009f34aa1e8af7abe2f18b4b717
MD5 7d6c61b491ab77c8f586d5b4191bcda0
SHA1 dd72b9d7e397aee02ff263df007268881b8bdd4a
SHA512 72660f2572d3f32c9ede0bb8ea7534d0b0a3c701acdaaebcb82c4770d0e90a089f5d6f6a43509244795d31e10bbf5f9e6a576f30fb8f937a6403cd49d03c4372
SSDEEP 12288:ctiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T152552393528C55A2FAFD103985398438B5497E3C9F5598D3E2043A1EA278FEBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 fcf8fa5dc721c1b4fcbf3bc40ac7517f69dcbc63657974f79f8971f9e594ad4c
MD5 e4885707477615581fdf278a204e6e67
SHA1 1ff500d91b4689efba0445052713515b06610a56
SHA512 bcd39892e7003ececbdfefc0c7ca0a5f4aa66da0fddf3b05b39e0c572e732cb634a04dc930a7b13f31e6433f68101a84bebfd09fc485d53799b6dfba556c438e
SSDEEP 49152:ma0h2GEkuAe73q3pp46zwwQPLNiXicJFFRGNzj3:ma0hNYG4Jw47wRGpj3
TLSH
T13085AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 30c3b2cb6ec02ebeb5636c94e96b00e8932ceb03c6b09d2e3a5ca079eee8fc77
MD5 8d0dacaf73baae08f6777f97f4e294ec
SHA1 20237be429ba99cc83c6e635172e793a6b19c3e4
SHA512 8e0aa68fbea29acebc6fc28538e2feb101a323a0c1a6a6c4a435b1b84b466929fb2727cb60ba17d5f19ff8cdf90f1c9f2705797d57450ac73a0609c4c8d7b080
SSDEEP 24576:RhbHjPV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RhbHj9LNiXicJFFRGNzj3
TLSH
T1215512BE129C20E5F6B5903D85668409E370BC29172197EF6381523E4F3BFE94E38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 5c2e682b6dc05268cd358f2c5549c3427e8f0cdf40c41c7c9ad4f89b74f94037
MD5 6ddbb10b63cf0f8d544e09aec68f9ad2
SHA1 a372fa055027d0f3427c2a9857b57551d9bca65c
SHA512 604a86315ad0f6258e96bb302158a2a79610edb87a8aac20b4cf6d5e1a5fd397a515741fa2315998454cc62affc4d070700dc9335e77cafef7bc99b9b9d193ab
SSDEEP 12288:ShiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E95523D2518955B1EAFD003D867A4428B5882F2C9B2619E3E1543D1EA27CFEFCF38563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 a8993b036abf1ddd817fbdf269eb90174582b7af49a689383cf61101311e359c
MD5 2e23eb30b2e0585c8c5f5440310e77a3
SHA1 6e80616288c5efe37a58cc88b39c31ace70c6241
SHA512 b44977bf2b58cf3f7527b9fdeac1f4806e06969610d94a471b8104786cdd2265eb604be407a12597ba7072005d315dd57c9ff4c605cbd77123baa13869bcb4fb
SSDEEP 24576:yAL3UTy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yAL3UuLNiXicJFFRGNzj3
TLSH
T12E750155E79400F5E97B813CC9728916E2B2785D0364E7DB03A84B6A1F237E68F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 a59f47bc6bd2dfa384a0123021badc9ea2999e2af797c008831bdda223bc9ad3
MD5 f5c9cb58c7d651b44bc8be6b0c040a54
SHA1 1b29d28f04878dc43c585028cfb6ddaa7df06771
SHA512 1a95c9771c7cdd10f775d8af34d01d38c7b26b6629d92d7d38112d3e57ac972255b57e35e2fca291db6e8dfb8720d561557f91155056b7bb57b332f634eeff21
SSDEEP 24576:LOO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LOOLNiXicJFFRGNzj3
TLSH
T10355125A32DC10F4E579503D8AA2820CE3B1BC29072257EF4290557E5F77FF89D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 31b87383da38aaadda76158042d2f3bd79d797d8f6c2ddba692253eff64f4265
MD5 8b7a32addced99b02b2238ce180fbb47
SHA1 b42e6e50f9c0996450c28e88e8343f962dcbc55e
SHA512 989be6b136fbe46cbf7ee02f237725ef841991f55059b7c84b76f09b2643064903d4c310d108640a469240c6f68c2c4a5ab6917b5765c5aaa159035e4041b95b
SSDEEP 24576:h7NM9YqZqmWMUkPjZM48Mv6bEhsh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:h7cBWMpPjN8DbEhkLNiXicJFFRGNzj3
TLSH
T1B565AE2E6BEC81E5D577D13DC9A28205F2F1B8611B318ACB5162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 90ab3c417e27751d6bf4c38bb8518d96970a3d8c77b993b425db5cdc6d817eb0
MD5 0792cea08a6bac7cdea92f5d2f6c151a
SHA1 3071a9df236abbb8dcfdacc019b0328b4adbe571
SHA512 3172b612290e158ce6723b7543ea96da1b34c8e768d86b2b20867c16dc6d145fdaa3b09757154b863159416470dba0094250789611d69ccfd77a45b05f713f47
SSDEEP 49152:DF2YuHNETovAvNYf8kmBLNiXicJFFRGNzj3:y6BCf8kO7wRGpj3
TLSH
T18E858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 1df00d05274ee1a9ca0ae779c0b21f91a24ef949679dde40f1d3febe0ee508f5
MD5 ffaa80fd33ee8b3392004170a9af4507
SHA1 0db20d71119d3a4254f2f8d8d9f384dcd2e22a0b
SHA512 027e8837e762260314a1a57ce6a836e330605f21dc1561df2c764e313aa6fa1a14178f6e658bf7669f563ba35082aac09e7c73abcf9840318a3ef3929a5148a5
SSDEEP 24576:IAFs06+Omlf8NXEbToa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NFs060loXuvLNiXicJFFRGNzj3
TLSH
T13865BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 72ee475e5c8cce2e92fac4ac61b6f4c770ed8480ec478b8b6a3e99a56d561b27
MD5 1b444b7df129675ff39a3c0cb4f2bc7e
SHA1 88599b496bc2eea6f325bebaccb8b814512c2ea6
SHA512 d559543e48ec9e187bd4699409d52e3b80b3fdec890c782bcefe6c1e7d81b7ec7d840444e550cddf674e8daf6466b52a399cc39dec810651ab0f89f66542c8b8
SSDEEP 24576:4JnJ5D3WXv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4JnJ5DGXvLNiXicJFFRGNzj3
TLSH
T19C75D02DD29810F8E4B7C274825A1A55FE72383D2F2269C724B4E5357F22FE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 497d7f7917f077f8e834cb6216d9a5c11266db70670f46c0b4c4c9c38d80cd53
MD5 8583c8b738e046c52da0cca7b55800e4
SHA1 a3f89cad3dbca3e2e05e51f5eb4cf532f993f21b
SHA512 4b270408e3d531000085a37a4fa55b0fd5faafc85df3b64b009a25de67c71d2a8fd63928e414797d294bfaf2e17ce5edc891b7b5ebd754bf37dd6ed067a109a6
SSDEEP 49152:kg06DIKdwc+eQnSt65aV1LNiXicJFFRGNzj3:VD7wRGpj3
TLSH
T115956C16B7EA5294E8B3CAB1C962A5159B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 10a8ee04f6889bab57042abb20fa9347a43be2a156d8dae1a03344fd718de947
MD5 e8908f8cf61ce4a1e06db1b3eb0b0c4c
SHA1 cc72971a6c921efe24be108aa68a640cd7c251e3
SHA512 34dcc9249544b9c79829e576e9b611837e5bacc58e939074bf5c7bef6bb63edf3f5a27b3af80ea8ebf59c21f1dc82640fe6f2cb5fd4c50dd1e7955962b73971f
SSDEEP 24576:9n+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9n+LNiXicJFFRGNzj3
TLSH
T14D5512AE278C70E5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 dfea36d7b87cda3daf64753e3678eee09760d0ec288d18775ae13b128bef6a5f
MD5 092f8d0cb4b0244353418b4c8a752a01
SHA1 efddd5d577bbd88ecea063e18dcdbaae68fcac26
SHA512 c418a70d80a7ad83dc63490c204a4acb70cce3e6beef0aedb1f433f0c9ce3a3c6b8902b260bfebea78d834a8311aa4fddd8e51b18401b89f908e4db0bb8ad3af
SSDEEP 24576:0IyU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0IfLNiXicJFFRGNzj3
TLSH
T1AE65124553C860E5EAB9013CCA774064AA74BC349F2156EF9180BA3FAF36FD59E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 a8f857c63d3a3967f5cf97f6177f6010eaa6ca3c26b21c11906946d56e5c2e7a
MD5 229062befd8f34632a243df79edf482c
SHA1 ed804b9f85a41bf1e8f19d33a01884b364c3c070
SHA512 eb0bc0b84cf76ea96c32043a5fafacfdb6e541698e13dfea420eca3a531f2af4aa99253a3bc8e0ede7cb98e441c7545bb9870d6f4a2ffef43b4953ea80917ccb
SSDEEP 12288:Vy0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0e/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D15523DA118964B1EABD003D86364824B1943E3C9B1628F7A1947D3ED339FDBCF38852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 ac0b50edad89d2f970ec3132347ac5b55787b5fb4cc08b4628c7874d5227d181
MD5 51aa155dfabb92b7218534fe91a1659c
SHA1 2dfa14577070cdcb26716639954000795990cf9d
SHA512 1fd72a3c34e2a631cf79bf35f707d5e4608868cfeabe684496b5a89fb09c879ff5453692c94e0a3231f11d026a5a5234fc7c519ed5c4099783b4f12224ec17a3
SSDEEP 24576:gQ9MxZKdcz9dw3p/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gVKZpLNiXicJFFRGNzj3
TLSH
T142558C2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 141bfea3e142cd5427f31cfaacf8a6b2c570f516448b293f031d801b73222633
MD5 dfec9b10effc8336ef72c949aef477df
SHA1 f868b748c1d3251bcc80be033883f832c09a4786
SHA512 4be757c92da3625488e4c169730bfad03e5ec4b267f02ec8128315d0e1343d4b02ebdd207c58c1c47d09dc9e649cc4cd92daf0aecb86e274bbf94c78c75f22f3
SSDEEP 24576:CyocDApg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/ocDApgLNiXicJFFRGNzj3
TLSH
T1FC65E05FB76D40A2E176813C89858204E7B3B4345B6257DB6181C73D8F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 c995d0175810ae30cf3c744eaa9b7e0db35281067446280a5604ab5269f8991b
MD5 8d89908f90b5a8ea9bedac7df0d10cbb
SHA1 731789143836680a5bcab446a2b12aa7ed7d973d
SHA512 4793ef841604b9d865e94a8fc83df387ee15e1d7cd284bbaefacc7bf7dec693db7f616bf559391a7221370bbd1b9ad8a3fe473110cb1d630ed359f344c462ca9
SSDEEP 49152:lWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKgLNiXicJFFRGNzj3:V0zuNIy7wRGpj3
TLSH
T141A57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5b170b573721f6575eaa9d86ac1222b25910e840f8101b53f290e33f8de6b15f
MD5 1fb89b0df1d88c6fe06ad9fb61cf312e
SHA1 38956da9ea2a56b5f75aacff7a7f4431640b0889
SHA512 775adebb9af4af8c9c1494ba2fa7bf07e4f4847a0c90ba01b2f9015f1d5894e971844c9f320f7a1eb153793be6e6ac0e838318f80dff43ad8f0bfc944628d153
SSDEEP 24576:B1QT7EcpfxR+N5AWAz3ooiYzjMqb+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ETDxR+N5YzTBjM7LNiXicJFFRGNzj3
TLSH
T14E55B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 d6e2b7cdd564479d0ea0da990b77fc3a18621e555ce1b879dfac4e9b5ea8eca0
MD5 8e31c631cc4714b7df5428ee5bf79936
SHA1 e9ac7d16d956f7470f3a18a896be2c7983f73207
SHA512 0cf59eb0e620d1c7bdc1650a9dba0797f0d2a2b55d169742da7d78d6c21d739aab5389851f52c587b9ad66ee80178208eee2bad2c0a09f5ed4d0ec23af15a2c8
SSDEEP 24576:T3YgnJcRTk4yti+R5dBR/N/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TIgnaTk46pBR/NLNiXicJFFRGNzj3
TLSH
T1C045B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE89F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/396-275-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/396-328-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/396-406-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/548-198-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/548-12-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1276-67-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1276-34-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1640-407-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/1640-300-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/1640-294-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1640-301-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2244-446-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2244-321-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2400-58-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2400-64-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2400-66-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2400-82-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2400-78-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3000-263-0x0000000000780000-0x00000000007E6000-memory.dmp

Download

memory/3000-268-0x0000000000780000-0x00000000007E6000-memory.dmp

Download

memory/3000-262-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3000-319-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3016-316-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3016-445-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3040-309-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3040-427-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3256-234-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3256-44-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3256-36-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3256-42-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3264-0-0x0000000000400000-0x00000000006A7000-memory.dmp

Download

memory/3264-31-0x0000000000400000-0x00000000006A7000-memory.dmp

Download

memory/3264-8-0x0000000002440000-0x00000000024A6000-memory.dmp

Download

memory/3264-1-0x0000000002440000-0x00000000024A6000-memory.dmp

Download

memory/3284-325-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/3284-448-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/3656-414-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-440-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-458-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-455-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-457-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-456-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-454-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-453-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-452-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-447-0x000001FE2EDC0000-0x000001FE30C97000-memory.dmp

Download

memory/3656-435-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-436-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-437-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-439-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-442-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-443-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-441-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-438-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-434-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-428-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-429-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-430-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-431-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-432-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-433-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-418-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-422-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-424-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-425-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-426-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-416-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-415-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-423-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-413-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-412-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-411-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-417-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-419-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-420-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3656-421-0x000001FE31110000-0x000001FE31120000-memory.dmp

Download

memory/3812-378-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/3812-280-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/3960-77-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3960-71-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/3960-80-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/3960-236-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4160-283-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4160-289-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4160-405-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4160-288-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4300-444-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4300-312-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4380-272-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/4380-323-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/4448-235-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4448-56-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4448-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4448-47-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4632-329-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4632-339-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4632-449-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4632-355-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4632-408-0x000000000CA00000-0x000000000CA08000-memory.dmp

Download

memory/4632-371-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4660-305-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/4660-410-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/4908-311-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/4908-244-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/5008-258-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/5008-252-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/5008-315-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/5008-248-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/5064-22-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/5064-16-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/5064-25-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/5064-200-0x0000000140000000-0x0000000140200000-memory.dmp

Download