56565fd996c05fd48689d4597b564f592ae7b97b1728c0d65615dc363ce1a5de

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_4db8dce75a0eb7d4744ee20d4254f7e9_elex_wannacry.exe
Size 2.6MB
Sample260816-wpbmjstyg1
SHA256 56565fd996c05fd48689d4597b564f592ae7b97b1728c0d65615dc363ce1a5de
MD5 4db8dce75a0eb7d4744ee20d4254f7e9
SHA1 bddbc256a99c6a301ee2db23279ed52ec8afc6f6
SHA512 08504fb9a82b44c05e8b5ae3bca8d9c742c9643ee54a5272fa27030f35654ad9fcb101c2e3732f4728bdd3b7f7e30a25c8b47f907d8d558cb478e0e9575ce453
SSDEEP 24576:WS/Ya7Taz/Zu+1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ozR5LNiXicJFFRGNzj3
TLSH
T115D5E181E58185B2EE61403645A65B76CA70DD593F339AA3E394FE39AC33321EF1530E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4100	elevation_service.exe
4784	elevation_service.exe
4820	maintenanceservice.exe
3528	OSE.EXE
2532	PerceptionSimulationService.exe
3696	perfhost.exe
2972	ReFsDedupSvc.exe
4612	SensorDataService.exe
3772	ssh-agent.exe
2108	AgentService.exe
1108	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-16_4db8dce75a0eb7d4744ee20d4254f7e9_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-16_4db8dce75a0eb7d4744ee20d4254f7e9_elex_wannacry.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-16_4db8dce75a0eb7d4744ee20d4254f7e9_elex_wannacry.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-16_4db8dce75a0eb7d4744ee20d4254f7e9_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\592070a9238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-16_4db8dce75a0eb7d4744ee20d4254f7e9_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-16_4db8dce75a0eb7d4744ee20d4254f7e9_elex_wannacry.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4912	3288	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_4db8dce75a0eb7d4744ee20d4254f7e9_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e974fd9a92ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab58eb1baa2ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074cdc5d8a92ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd22a5d8a92ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000038e7b81baa2ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000843dbdd9a92ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4100	elevation_service.exe
4100	elevation_service.exe
4100	elevation_service.exe
4100	elevation_service.exe
4100	elevation_service.exe
4100	elevation_service.exe
4100	elevation_service.exe
4784	elevation_service.exe
4784	elevation_service.exe
4784	elevation_service.exe
4784	elevation_service.exe
4784	elevation_service.exe
4784	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3288	2026-08-16_4db8dce75a0eb7d4744ee20d4254f7e9_elex_wannacry.exe
Token: SeTakeOwnershipPrivilege	4100	elevation_service.exe
Token: SeBackupPrivilege	2972	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2972	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2972	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2972	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2972	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2972	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2972	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2972	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2972	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2972	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2108	AgentService.exe
Token: 33	1108	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1108	SearchIndexer.exe
Token: SeDebugPrivilege	4100	elevation_service.exe
Token: SeDebugPrivilege	4784	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 1620	1108	SearchIndexer.exe	102
PID 1108 wrote to memory of 3704	1108	SearchIndexer.exe	103
PID 1108 wrote to memory of 1556	1108	SearchIndexer.exe	104
PID 1108 wrote to memory of 2096	1108	SearchIndexer.exe	105
PID 1108 wrote to memory of 4876	1108	SearchIndexer.exe	107
PID 1108 wrote to memory of 992	1108	SearchIndexer.exe	108
PID 1108 wrote to memory of 3048	1108	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-16_4db8dce75a0eb7d4744ee20d4254f7e9_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_4db8dce75a0eb7d4744ee20d4254f7e9_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 588
  2⤵
  - Program crash
  PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 236 -p 3288 -ip 3288
1⤵
PID:2432

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4100

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4784

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4820

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3528

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2532

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3696

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2972

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4612

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3772

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2108

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1620
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3704
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1556
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2096
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4876
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:992
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 20fbd7ff7be3cb1a2163ff4f60c6b65c7777f6cc85ce993c71afa8cecb3f7010
MD5 52db3b850a9e77ea887195e2859e3269
SHA1 66a0dbb9298090ec610c2cdf188979d88612e93b
SHA512 6fe79c6c5e413be75451cae495b496b7db682b1449cb29b960b4f13dbd2f9156f5faba42b6f04660ea546193674c98106dbe33fa9e47f076e572cae1b0423435
SSDEEP 49152:nb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn7LNiXicJFFRGNzj3:V3q6mjBI7wRGpj3
TLSH
T1CFD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 6c433746b96e7172d231f00658a5bd361230db760e836a8ccd422e20ee2d327b
MD5 e12b3f108f7dc8e6f23ab4a3f469face
SHA1 46dcf445a23a491c56359f8a029c763fd262e99b
SHA512 71587b6a514bfc6a7f945917d075dc78cbf8df99bf221909fbd55d55f64e7957b4e0081f716c98994735663b4b5b5439fbee6739b15eff67ba588b63dc172fd0
SSDEEP 24576:dXYfDtczA0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ItctLNiXicJFFRGNzj3
TLSH
T12775012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 2c4343a8a9bbd8ec85cfdf864056b9c63e127ca8d48cc390dae6767b13fc9fce
MD5 cc72a054e8758e744639ccc53556deab
SHA1 5641b01f52bcb7bd7818e2dcb0588611d23c67bf
SHA512 24fae5494d423e422b71afc57209cf1016a25eb867c5878873d1f88ec8085c5c1b9f2624579068aeb6a08ad38c2ba12f819d1697ed8949fd9cd29cc88fe38e5a
SSDEEP 24576:b0Le5ji0hmxhrMg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bPji0AzlLNiXicJFFRGNzj3
TLSH
T13A85AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 68c1470259c3ad9d75cc3e086882fa5ab4b1dea55463e01e8f774c5f111b46db
MD5 52861eb97c7e04119580528415c55ba0
SHA1 0709d187be055704a03199b4193c576fda65aac4
SHA512 45cfc6f3016927b69a6c8df4cfbbe76ef9a1e782efd24a4f4fb6970ffa3094b7268fe4dcb8b70c93aa900222dc78891ed7a5ea10f9b0b17afc33c283cbbd11ed
SSDEEP 24576:va7/ezSC6vUyD/aqgrvWj6q8wyue/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:i/ezSC6vUzPv+HjyRLNiXicJFFRGNzj3
TLSH
T1E4756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8a9b4c361851652d554cc6a7fd8818d56bd10d7ec6c446b9577476c694e36307
MD5 25129d01bf95a3aaeeeec7ee073dff73
SHA1 a755196734ce928ae6217b4e85735822f904947c
SHA512 56b6995e48b574fca2fc4dd1e7e2bbe27b9f7ed928907e9470b9244256b2701ec4409f340c66f95baab07d4a759cd812aaa9d594e5f1e0c9853a14eee203c5a3
SSDEEP 24576:gVbqPb88hv/l+Bf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gVO88hXl+FLNiXicJFFRGNzj3
TLSH
T1A0559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 de80dff5cc31f8f6220fb82f9bbe7d8ce34e0c454f07b99099643f11fb009ee8
MD5 8a8166b110124429700a95c6ba0570fe
SHA1 6acaecea8dd6d1910fe07bf301962a29e792cd52
SHA512 ee6b25dff7ccac3c72dadbb8a4a5abfd68d852f270455d9fae3ed9fb76f58e92a90399dc3edc2a0891527760fbcc54c6a3b54d0005f1d9a42173899ef2bb446d
SSDEEP 24576:DGE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pLNiXicJFFRGNzj3
TLSH
T1325523D3468855F1FBFD0039867A5828B5845E2C8A595DE2D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 d227f71b338705bfeedba64d7aa63ebfda89465ba24344bc11b0975e75bfe450
MD5 7731ce71410a7129ae2885eb1d106a5a
SHA1 fac1254832fa9d055fca15b432fec4b6c1976096
SHA512 2fa0ed38b40e5b42bde0890079a75134b3193cde92a2a0355025f442f0a3f1998dec881a8312f8308ad10b7b677351a9764e23f271ec88b4610221d9ebb5955a
SSDEEP 24576:mJIU3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mJIU3LNiXicJFFRGNzj3
TLSH
T17775CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 61e7761f6daba4940c18fe0fabf6abca2d8bedb7410162b211a6a27e3ea92425
MD5 aa7e192d7e5ba39532b280dff7e01839
SHA1 1b14b641655316cbed3bb625e5e6e196271bb70b
SHA512 0511d67095b1e984920838b6dd667882c006e16e148c28aec92aab2df21031d3f3dc601d43f76dff86f3b1ad13c0cf299c4991112fb696d08837b0171dbd6228
SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THj:pQvGAdlCEL8c/WRNw5Cu7wRGpj3
TLSH
T18F266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 40b7e7fe92678b49f770bb8747725a9936754b8331205742ac98912d07ecbd52
MD5 1585b873a637b3f2e3b0c8a386b0371e
SHA1 5474996b8acee88bdc784ac63f9b66228ff70f44
SHA512 e00d4815d2c2929b8626f38eafa4ade59dd33f8fcc748ccafa85f2f56ce0056a7118408b41c7ccf4929e66383d15622f45270bff1ca2dbed30d6bade47e81c5b
SSDEEP 24576:1fewsAj1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Jlj1LNiXicJFFRGNzj3
TLSH
T1AA75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 49f0242f86cdd135ecf4833fa62db7535dddd8a6499432287311e999249c6a8d
MD5 19b26af4c7d7f8d1eea5ca7fd74ec5db
SHA1 304533376f807560c212488ad0c53b3826e8ab59
SHA512 72ac492b0ca8e15228c3541ef5810c3130cce229f946d666754611d816382f0eb53253e6ec58283912ce6ec399e65b698e5b3a55ad2eb3e1beb4893dad77ddda
SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHhF9:vUEtQevvqc2W1cpV20I3239
TLSH
T101474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 356ad4f6b8f51460da07ae5d0d5cc403303739e545f7d82e57a4553a3cd0289d
MD5 2101d158a9ccccc5a3830a159383856c
SHA1 e5efdc6e3b8a6de5b9cd93f19f28743ea61bf5da
SHA512 cb7011df125f926c1c3352a8138f8a3103450b134d807f6160cca68d3bde21aad280c7731463eda5e3af4e1cd41d0e59095aa1892c21bbde647f2a25b1d7aed1
SSDEEP 49152:gCbRquA/m2yL5zLfFiV+XenmE3/zVLNiXicJFFRGNzj3:poq2Vjnmq7wRGpj3
TLSH
T107D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6ede949e12061f84f7f33712ba5911ed6f1f8f086b7e0aea920939f1bb6cf379
MD5 8d58c52f1a2d95350ee8d076e4036b19
SHA1 ba97320767949329b314ac77c81d0a6104dbf0bf
SHA512 f6a588cd0d1965399786b35c97d6096b0abaf1245a27aad136e5ec3af3a4140d707aaf88c2ad40a95a6c78a1f941ca2433617d4fed35c7c4e9ebddf888c0ba5f
SSDEEP 24576:WAhGL6IFoiwtA5l7S53K/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WAM5Foiq56LNiXicJFFRGNzj3
TLSH
T1FC359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 2b7a3fe0ae44efe459a0b5781a3fb4ce58edc94bcc6bff4704aa5251105afaed
MD5 795b7f9596fef7cf77c415b36186b449
SHA1 0e0071effdf85fd06050cd9bd799eb2c77cc38df
SHA512 b4b9d02f5d74a281f9ad8d3b8504feb0fe691df3b80b04ed277a5d75e2ce0f4a5d8c2bed0b5439b169211b17a95905233be906af1d169fcd4b51e55939be1c81
SSDEEP 24576:xwuROWx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xwSO2LNiXicJFFRGNzj3
TLSH
T14865F18632940CF9E9BA41398657C035F7F2BC152A25DB5F4360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a378c4be445621d6d7f49ab1e26102880f92fec77d2edf83ec8cb90c770c522a
MD5 35ae53d511a49b50dcf339d6843ccfc6
SHA1 372137a0d4eee252da23570e44b0e84e5ef4cadb
SHA512 8fe0d3bf8778cc28601b7a1103d6779317efbe526711a603d74735ba601633752a951d877629bcb0a9de5c500b789fbb93a7539b5778fe5c9ab2b431f0b96d53
SSDEEP 24576:cZu4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SLNiXicJFFRGNzj3
TLSH
T13655129622C420F5E6BB403DC9F54504E7A17C2A673643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 48bd49b499d3124246d0f2801c66735e9e7b188b4360945be911db9167cb99c8
MD5 f6abe3c7f9ba98de7e7f3755d0158815
SHA1 c040e9e2bef98782a39ae2071ee73de6bdc71c78
SHA512 ba53e89e6368303d7563faa2002889b6b6323d054b7959feaef44cfacba358a5d78d0d89818052be388eb268a4388a06e86b0b4bbd9ec388b4d155418e999cd2
SSDEEP 98304:bQRQyi36YOcPDLvw2gAf+PN3T7wRGpj3:qQyiKanX+PN3F9
TLSH
T11F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1deac0394731fe3395543a85c9d0ecb53cc0a6469b7d36029c0068ff51a7a947
MD5 477c7f5cec2f209b3611d9841172c8cb
SHA1 06efe84797763d3887492e36fd4042679d2aa6dc
SHA512 33dfaa6ab50635715e6e709c20d34ee95b7766db61a5abc67794b05947ae7cb1118bc02af99b1ddda32de48181989ff98e90095a9a2cbfac6200325684da1ed1
SSDEEP 98304:nQRQyi36YOcPDLvw2gAf+PN3T7wRGpj3:2QyiKanX+PN3F9
TLSH
T174667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ab1732da94d3fdd7e7bcedc1e7821dac89b8d74fc98c53b471291561fe55afec
MD5 bbfd22dd33a8a8a46d884f9efa400ec7
SHA1 d67625868519d05478bceb78caed681bb38d1e3a
SHA512 7d34cd8f6fcf736da90c52b4ca0a12ef32db042ec597504701fd1ae84f19466c4910f6818f132325fb947060865bf9c356784610d11309a694d6a5e2aa48a4a6
SSDEEP 49152:v68Qg55nhkeWu7PNU3/lLNiXicJFFRGNzj3:pthTRc/l7wRGpj3
TLSH
T1A8B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ac8b99b161b0475be89aa6a3c0c34f8e6d35eb6b460e6494bc2072a49f4ca906
MD5 b57cafd629685d9c72db676d777f7559
SHA1 63c01f970bed96a6292255cc0bc048273d39d622
SHA512 be65cc3c2bac68db5189a47af2ba3fc6fb9507e322c7453b8df7617889ec60f62d85ae1d6163e8cb1868b46c7bbe0ce526804588be14a91a530205061be30923
SSDEEP 98304:Wy5112gYy5azzVvU69nLKnhZE7wRGpj3:HLIHRWhWF9
TLSH
T1E3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4f7251493e6e63887b76716e0f593c7996283b14e14f0d920ad65e70c2d69b8c
MD5 7b677a413d223ec0b8a170d43ceabde7
SHA1 34fbb4b75aa29247d7f1ab8c5d4e25f6fa02d2b2
SHA512 36974ff1fb423f8f6cb00e42ca9a1ef34063f6aa7982048f1e154c40dc93d316d7415c4d1be449526f94e641fb1224398350d3458411395c14a7fd3ad624df58
SSDEEP 49152:dB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glkLNiXicJFFRGNzj3:Du6JmIxd2dk7wRGpj3
TLSH
T171D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 542f80fdcb33da7a8ef49463b2cdae47514ded4b95c8947af6ee5a96a6fb6f66
MD5 b7d56297477804e788b682aa3401dccb
SHA1 0a0c807eb3615090c87b87cd91a7bfdbc9f52770
SHA512 f42b78ea5efd6f3656ca62e1d1c69b76696089c0114f0793beb409dab29dab1951621b9e67722866610a37c4e57f18bb4b9bbd5eab3f4d7915c5879495cdde59
SSDEEP 49152:s1hpsNoJpF1A67U44CwH7R4xXLNiXicJFFRGNzj3:smifPqRq7wRGpj3
TLSH
T147B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 82cfdcf35dbb797cfbec89b10931967e2eabc8f147e0fae70e52cd80563ad8ca
MD5 a70e45ec28589b5e71c530987f123767
SHA1 6dc7cb7b2ebc3b416f5cd0d5901a7890da8f3b59
SHA512 b1d9aebf6e6eee927ccd2b703a44d0222cf850a6701e9341b660264630205a85879c8f700436d9793e646df9c4918518ebef6decd168118958bdcfecb30e98c2
SSDEEP 49152:4SuZQIY0Be2KkRVtOnks6NMHq4LNiXicJFFRGNzj3:i5dKqi6147wRGpj3
TLSH
T129C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c20e04567ee8ddfbf6d55436d46a2b0646d5518763fb02141cd2a0d2415c4bbf
MD5 d63620b3e18969a15c5239816dd318f3
SHA1 925276b29689536b90c3a5fbcb90ecd26453d6ac
SHA512 dd1782a13e30bfef6b3a4dda0f40e8d0782f99feb01fd6baaab19fa26837f709c7418121b063187e9df04079169542f2be1a06c53c6ca524d2442aacff0214ef
SSDEEP 49152:mhtSn8EApI0figjgiDn0AP5wbLNiXicJFFRGNzj3:nX2iWphW7wRGpj3
TLSH
T1AB95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e279aac9508ae9df9ee55b1d90122a7a77d8f57513ac0512926ab11fbdbf6c45
MD5 a66b8ca8e64cb685b6af6ac7577acdc5
SHA1 424821bd8085cae2cfac7f45e10b8fbf8e8b7b10
SHA512 aa53e289f7a48625e16e41963cadf787b2b0d31025db691f80570e87bc63fdeeaa1841cdc0b449581d42ddd5a51e350ebc0fad647a8e16276d0eebebba274162
SSDEEP 12288:gaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z8:g8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14F5523D3558955B1FAFC0039C6794428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 0946d1c0b395ff667faf228ae27ab521e7587cc4a6a98e8872f0e193202839cf
MD5 af41760f5bdb40fa2bf7664d002fd040
SHA1 2f195fdcf5fc98375cf481b731e9dafc6a3e5138
SHA512 fda4b71809dc09d3f052afb77ed5900c3608b9cf4831b725141c86e5b9f7917bbf1454e4223704de48f67f7c070edd66e09e4e73a1fafcef19fa713a39636320
SSDEEP 12288:S1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z8:SZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18B5523D3558955B2EABC0039C6754428F5881E2DEB5618E3E3483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 95196cd3fd7fdbda79d6d4121f896637da6a78647cf40f3e7ecd7f9215d58cd5
MD5 2f3636e89a2c103ebcc3d959d7348347
SHA1 cdd1a9640fd0222a114a5ca67d9c4f95007fc364
SHA512 4cc901453cc6af9da3129f9bb86f5d5ea9246bf34d88685ba3bcb267ef44cd03cb25b4d928c402726dbd2463eccf11ae7dbbb4a887f8063bb5ee22ed998a692e
SSDEEP 12288:BbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:BP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1615523D3558955B1E6FC0039C67A4428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 5c6ed764f715efa7916401e76487f936631dbf3b888b3dc626b8e41daf9dc897
MD5 a7cb1953c33e77939a247349474c99d1
SHA1 146b3955162a4693a2600876ef721fec888e262f
SHA512 27293543c8ff7e7547d5e8a1ee6c78dc07cabb042cf9d4698cc0592de37e38d377f4c433e74c1883a12ab388f61273d418719fbceecddd3fa05c6c4928bf9cc7
SSDEEP 12288:7VYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Y/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T181552392168900E1E9FD803DC6764424F2A47D6CD7365AEBD3003D1E5A74FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 549e202d2a162d8ea87952a756510865fabcc7b554e30105c60b9529fd097ec5
MD5 f747f272cb6072e285ddb34abb95793d
SHA1 2d74da0556687affc2f85ceb5d81c40ab8b01e97
SHA512 7958ebd43102dbf4fb69f5ba546eb8279547bbd90d71a6aaa73f86a822ff13a894707046f2988eaae5a3ae7b81dec7e9b57cc850be59993e869a676e15ef3ea0
SSDEEP 12288:TgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ty/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FE5523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 83a73a713d152d78b9496ed2ad39183cee495e70934d5d4c959a636d6594d933
MD5 f1ce0a18d954fd8dfd8be31b12a10197
SHA1 2813cf06878219aa28b6e0bb59a623817bccbd02
SHA512 05c07d623eb54f9f3261187c6f7a82a239ac78e5c303a22f95c9d21ca56e4cd58e3705adf1fdc28c690c8ebc6cff74e4ca3e2ec2ef9eff149d131327a71243f8
SSDEEP 12288:VBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Vt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1075523D3558955B2EABC0039C6754428F5881E2DEB5618E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 7254a2277d0dc25cfd80e0f67d16313aafdc1d4f59a882838d038639a814704c
MD5 f94eba8ec611a5fe8b7486888081db73
SHA1 91b8b8474186e07e922cfeac8f68ab3240a991b5
SHA512 2b995b30d7f2ecc5743b2f371f0acbb5e63f6ac409895b3d68bce72180edf863d510fe4518a8871d4f28732865c4d226a0856343018cb4a82ecc4c15c7158923
SSDEEP 12288:39iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3h/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F05523D3558955B1EABC003986354428F5881E2DEB5659E3E3083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 15fe94bea656d2da446cfe3560521e685bee0c5d62e904691ed560aaf1e41a60
MD5 441e2af0200966a28f0f1495ff52c0b9
SHA1 50e89f414e0708b4a23199fe87a47d28ff18a198
SHA512 fd756b5cac9136b32de6201e3447cbf235db040ce5f4e76b8e266546bfd6d185ef6fb63e516ab75b49bc0737f350de9476795b70643aadd8dfb2fc8eac9fa79b
SSDEEP 24576:UZM3zFVSO5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UZM3zf9LNiXicJFFRGNzj3
TLSH
T167750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0424e6a54d010f8897aeaa06ef9c658f0d7719c664ebd355ed90726aea94bd61
MD5 3a8c45cb2d64ced6c6724dcd8027bbb7
SHA1 3c4eed81f79576cd9f6afbd1c26283a50391419e
SHA512 5a60e26beec2221163105e53365a9e9e23828a3a33f6efaa8acf525c8dff7d6fdb2c9f069f0026d9714145437b696d007611efb4d0aa9d155aa79ff4bcd9945c
SSDEEP 12288:R+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:RI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15D5523D3558955B1FAFC003D86794428F5881E2DEB5619E3E2483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 3df50b0aa73295e864d7d0061a9037f8f5c6d9c5ca94ebb487f238af696b38d2
MD5 95baa542d48582c22ac918c9a0c4b55d
SHA1 95fb18abb98ba7a4b00b15088320605c60c6dfb3
SHA512 ec3ba4feabc11bc41d2fa3b09ee84a8c49fb0f2ffa0c491680f601157c2effab3085fe0a3d6155446d2c15acb48707bd6d40f892aa2e27ca22599d1a835c61fc
SSDEEP 12288:JyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:JU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A55523D3558955B1EABC003986794428F5881E2DEB5659E3E3083D1EE23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 490bb2f839c58941bdbed87f5dba10ad5f69a353420bdeaacfff4cf4c2175bb1
MD5 305c94abd0647b6a73c73c5a3ae745ae
SHA1 1593b1db6a721fc21470e28dd57741541b41c813
SHA512 a026329e961bc6351b19a46acba547a1d4da498c3f2b8960875e7c130b33c8f2bc0291ef973351ca516633da20a5a7025e9bcb7de6fbee7afa0df6f7bc9135de
SSDEEP 24576:XzyF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XWLNiXicJFFRGNzj3
TLSH
T134650247629530F9E17A8139C9620911F3B17C3647208AEF53641A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b9514e644b0537d9be379126fb8632018f6d45518e8b526ff029427e2c834070
MD5 8654d43de0783e15a5cbb30c10647fac
SHA1 06e17604ba9227922c95df1c3751c219e9f48881
SHA512 b9bdfe89aff869e496eb911d1e64760519e8f2f215f453872d2988b442c6dd2b2e3e60bf4d6f4f21eccffaf889c4e2fdead4f434defba8ab3b26f042af281c09
SSDEEP 12288:2+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2I/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D05523D3558955B1EAFC003986794428F5881E2DEB5619E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c44204aa1ed1b72f30b1f5b51f2167ec0b1b34906b2255b7f54ac54fddb87111
MD5 7b0301d79e6c1289e3c8df5c796eab7c
SHA1 0394a9da0f04125eed0d2ef7795ee8f5ea72f9fa
SHA512 7f2ffc5208c07c276d83a0f3329a5faebce8653377823eb80fd74800d0fca5174ebf271abe09974441b5c6ddba89487c77b82e822afe9d4d4dbe16cce3699a21
SSDEEP 12288:i+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:iI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D95523D3558955F1EAFC003D86794428F5881E2DEB5619E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 850be511a98dd8565fbb209be84db76b20248178dccc12530c5d249e64e78e36
MD5 6ae98a6ed71eda98915dd0f62fea95c6
SHA1 1c5d1232e2bef92d2c44462e1045f9b4dbc510f0
SHA512 77027e5a0dffda26611cd260e3b07ea4bed510b3f80faab91a8fbef7b84c6bd00c7797d6c5bbff7858608e334b0510e1cf74e814b71a8bb2c60acf400dd68c1d
SSDEEP 24576:AzyF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AWLNiXicJFFRGNzj3
TLSH
T16C650257629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 9935a558ed60e110765f8d0aa034d604b4f602db7744f2ed34b428525e9467ad
MD5 f299e5b60b0c080eab781b769e4ebe82
SHA1 c5496c879b935ef76cea76008523f9ecf332223f
SHA512 baa16c65033c2e4a777330d2bbae23a185d5038949bfe83dfad0e11e66e6b321cfc17f97ce134a9dcc21afff36bb78150770f53a59bd6b0bdad7e82208f393b1
SSDEEP 24576:PT8aLl3z0zD//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PT7LljeLNiXicJFFRGNzj3
TLSH
T10B7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 fb0fc4eee1569cf7b9b7f47b5b971ef0c8fe862667d1708ae6c9fa5fc0b4c985
MD5 ce09d27147added5298be7c597fe46de
SHA1 adafd161c91b6a5e62d2ced96338841b6de0d409
SHA512 e31b1a3148c860f9f38a48649764f52f7393a09749876952c4a76624df45f25f604b90bc39988307ea2e09a48066aa3c78dcb6f2bbc559072f92b90bff129d79
SSDEEP 24576:f3rd9CHKy7GZz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vrd9CHKya9LNiXicJFFRGNzj3
TLSH
T14385CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 f7fc6693a6025f46d064078a41c8d2afac6c626887fa754c4b1b070484adb0e8
MD5 2024f51c985e993e009d94caaf53432c
SHA1 259f2799917bbcbed75f8711f13e9e6fcdaaaa54
SHA512 b406720690e0b73db293a019ee07f386d5e7ecb3a1cafa24954f26b4c0fab56a1c16e56fe5666f95ecbb04e59969b8f0806ea9db7fd1e7cd7cfc2c6c81ab69e0
SSDEEP 12288:V7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Vv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1385523D3558955B1FAFC0039C6794428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 5dcc6f7d2434a8dc7ca670673b0ad7181c262c5f671091fe2b1ee7a815c5ed83
MD5 cc73e7bafbeb72c137e2a0510b016e6b
SHA1 bd35a93338910c750e36fd853485b28911858679
SHA512 5c8bd9e5e8522a47e1d85d30c3b60035ce99e7e4ec74b0b15967749c36ac2a4fef6e8f5ee6d2e2a1b6033c6516852a776f5a68d96d5b50709bf9016445de37e7
SSDEEP 12288:55iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5l/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A45523D2558955F1F6BC003986794428F5881E2DEB6619E3E3483D1EA27CFEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 c248d101378a6fdfca4b416d31d5d37d24a358720db883991fee605f5c4cbe8d
MD5 1ef34046796540835ac230ac0ddb9a0b
SHA1 99d483759646d785371b6de9bb243aed76a55ecc
SHA512 215a8fc71af765954b3513b486bcd18f45fa3d01972f0b6699ef12993c3fe6372440ca0789e59dae84b17c9f7580697c2f6301ef58bc33bf3a8fb1ccc2783067
SSDEEP 12288:VciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Vm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18F5523D3558955B1EAFC003DC6794428F5881E2DEB5658E3E2483D1EA23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 9c9828d8b14d980f7093abf6ec3d6e77a5a1a0849f9b1695c324f40265f87248
MD5 bc42705294faf14f30ce93fbe26d49f2
SHA1 b9e3391c2ce922416f2fec1e524cf33a85595f99
SHA512 1c5a45a0f70519980708837092127dd2bf90309bfc133fe5395bdb4d470e4f6acc73d363fe1ede8ebecbe7c799f18bbc67743d0ab4b911d0b99ec929df379c60
SSDEEP 12288:J+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:JI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10F5523D3558955B1EAFC003D86794428F5881E2DEB5619E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 737693d7a0ada85bf75d2eef8ec754e4e2e97d6a33996482e46570e13398dafb
MD5 6bc65c25c462788031692da2eca3994e
SHA1 8e58a7e8e215f478e294d2f1d91d2299ce855c61
SHA512 8dc338a3d6af94ea9f3bb6ac858a33aa04cc8ba4f18a03dc440e0228b7b83ac952f83032e15e5c456007268ce450ff7c68136537eb4e42bd5cd29e7e65028ccf
SSDEEP 12288:/7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/v/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1645523D3558955B2E6FC0039C6764428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 89af7993b80f8799d90840e9fc0dc2c9f81bc4745cec53756139e4dc9d907e88
MD5 c5d70d74ec7162d227d2d2cb41b1ce4b
SHA1 57eb8a4e903314beecbd2411f769391798f35aeb
SHA512 67b0aab82348c03bb6a41d75e3b9655206e4d69f67bc9f47784e890b2babb9d8c815201a9488fd371070e54459f192a808c040e65f12ef81405fafd9e53b918d
SSDEEP 12288:YmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:YQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1075523D2558955F1EABC003AC6754428F5881E2DEB5619E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 047823e984e23ce27049983147b3d818c0a0ee6f08c6e35ee5dcc2469d48f523
MD5 2d2ed73ce6168e5243d76710109bd539
SHA1 1268245254f6805b8aeb1ffe4b5db86b1be9d616
SHA512 f72ce7a9e1bafdf3b7417586c6441f4a575504b737f1d44021cbec3c29d50870f5a29da1f8337b87c3942a069ad5ae961ebec25c9e8968076bc65178fa2c8320
SSDEEP 12288:igiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:iy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D65523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 957bc0419861a6d2c838916415746a09646a0dfa5ff3206e50a85224b219e8a1
MD5 8f6f3d62a2e13a76a88db9e8d9f0680c
SHA1 089c40a10ea5119ac2f030604ef96b270a9f507e
SHA512 77eabae323bf41d601503eac3918d1db3637d57d4554ff02b8bc1c4933c9b28f6ccb52102e7f274a0d74d885fa17c8fa3829eaa59742d4d957ca514912cc0cf5
SSDEEP 24576:3fwvzk9RX6wkyAIk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yMnYIkLNiXicJFFRGNzj3
TLSH
T16085D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9e7460865a69b4086376a3a0362554cb89f2b9475a218ff9a23e5a99a32dc3ec
MD5 63e28d6bda1462aace5d04e4aa707eab
SHA1 64d722dfc6a29af56b39a6edb949926bbbaf6fbd
SHA512 0a88aa0322939e449c342c4fa70412e8b389bd3d6d1c646013c550df0ca85822895a07dba24bf5bccdf798007d836bcf4e0c581a894d516288f3714ebaab6879
SSDEEP 49152:1YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK07LNiXicJFFRGN:kySzPz7wRGpj3
TLSH
T192066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a5f2bb54f56da807ee98156e83e6de5097a80b54ccebd3db2cf5188a61db761d
MD5 84f9b7eeb944e1befbe048a8ce698bc4
SHA1 04dbce8cad2f4500e01a4be500840ba2fe67aa9c
SHA512 eb7f234ccc865c1bd52e7f88648c0542b227bc19de891047df2370d5b8b523e7164cd15a9c635383a11020d6ab0acb183a34f5617b6bbf91370a382f5d6b9c8c
SSDEEP 24576:a47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:a47JUQjqirIhCnDHUPfF/LLNiXicJFFS
TLSH
T1D065AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 ba47403762487a85453bd60ee475fdb7f3aef204a54ac35c6bade3f0795c80d5
MD5 6e3c372a7101cb011f837ecc24ea31c9
SHA1 387dc099920302e13bf001fe469e6096935ebcda
SHA512 4cfd8c8fcb908b01372c31e19631cee553e7f2b6915d4b0396850a0c876d39eb50ea0d41d9357b134101651ad5f6fd689a8746f41a44a279c26cc57906800c25
SSDEEP 12288:HpsfOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:o4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F465F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 2374575a474c6884c857d35fc4542b2e3981fd7cc585c99ef9eb4a5e279bd997
MD5 0ccb8e611c842f3ebb3657e82f3cf15f
SHA1 972d7e4654e315241b110e65dd43e430710a1db8
SHA512 8d0d26287adc35795915c50d0dc7fe7521258e615250ea874c18439dfa4a86ceeebb8e602f8734912e203c8a60cfb904d4f69eba5b375923985ad8f10bf472fd
SSDEEP 12288:XjEThy5qzcbJjzGdoKx32LKO2YBX8qoLBkTARM9GDfa6z:XWh52J2S0vO22X1oLWTARMg+
TLSH
T1EE553850762BC75FC6A940325E73D2CDAB707D05EE056F0373C8873F9576668BAA2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 d94f11f5f22fdc61d24ad79a431a5f118f48ef9318c69021ef4311730cdfd69a
MD5 53d491e532dd8c13e1dc170632a20fd4
SHA1 dfd443ccc0db01908bf401f77db67ddf1d6a63d2
SHA512 d60f374e5fa71f512e6928de821222d7deb96c3f38f6307c7655d4b4137aee9937484f04e2a3786d1c97515f4f699f685cc1ed33682c52a005986d36f49fd27d
SSDEEP 12288:ycYck+qcXacgHbc36LC7cFtC/bDVcQBFncR33M1q+1ojL0J+8CmFO7uFcRkcj9c9:eqciD/4+f1
TLSH
T158650A819037A39FC1FB60320739AB4DA774EC06B7056E26B3C8453AD86A715B5F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f474994fc193db147ad4a7d2851e6655c0831eadd43ead4cf0577ab7136e0fd5
MD5 6a0b71b0a86ba79484f2c9e2c629d24b
SHA1 91ad582208a8caac8aad6b278fcdf27bcbea4c0a
SHA512 ce0c1de2c49aa6332334f956ca782072b5d129ef94d87550ba5378fbf309588b3606431b7e46bd15f73447f32f0d7a684c7e04cc87bdcb889a85033fa8897f66
SSDEEP 12288:pF72iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3A/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1135523A3568C59B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 457b16567c4027520366f6b696d6190e33282596e5da078a03ac7b43fbbce3bc
MD5 16d7b349e39cbefdfa6cc5fe8ef5e575
SHA1 a38d3dbbba19fed8eb697afda6537b2832f22ea4
SHA512 3a870a2fe6ff4441432dbf257bfeb6715ebaff3278c9bbe4972dbe38d1543dacf8dcf2471d2e3a76be165a78be0f83700d49ebae806005ab376f64b60674f576
SSDEEP 24576:Agb6bmBIi49WNNFpg1rSvFv7bYe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Agb4mBIBhGFJLNiXicJFFRGNzj3
TLSH
T18D65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 2c5f088e4470575debdfa2f988859575652aec13f1fd9135bb4b3b4df0943007
MD5 6187888a25d955fa9391600688f28859
SHA1 975818925cea58643d0a59fe6775a584e6194f56
SHA512 0a6ec1782993badaabf91761aa83e95d0318119b6f6526aa83b5a49ed3f80e005d34c39665836c0427db5448c3ccfc430176ce349075cbfcec1fd178ef8e69f0
SSDEEP 24576:uG88u8FpJqH1vzria7/m5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:l7ZFPqVya7/GLNiXicJFFRGNzj3
TLSH
T1D185F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2bb28fc14224aae1525fda339381a4cea3a126a8c63b80661a8e5b613663c24a
MD5 002c558a9eff7f79326be7f3958b2bd0
SHA1 18970dfbf1d38a7b5f7d159d149ada84d36704c1
SHA512 3ae6218c130ae3161a68bcf4183eeac4a2a6ff9ee9421b6e5a66a33f6d3d83d3a66f5e4c8cf2ddd9a27e09b62a6752200faec2a3b0ad56a73388f6b7de5ce9c5
SSDEEP 49152:9BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjtLNiXicJFFRGNzj3:GG05lO43bM7wRGpj3
TLSH
T148D5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 92d4b86c114fe95b0535ca2d452cc04f1bf90b8343fdcf3aade472a38e9ce34c
MD5 e52541ebd6fbcdefadb8c61e291677ca
SHA1 d46df2ceaa8ec873f624c8ea1fcf123c9d543cf9
SHA512 64cf1a9373ec3d1fb7c8be8236e19f4809cad319ea810cea7e3c3c2df457aba3cb19bdb15b275e55ac52bcd48d64e386f6a9dfb740e293681b2e63c7637ec37f
SSDEEP 24576:Tfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn7/TwSfVcYG3K/cJHlnFR+IGNe8jg:ra5POZ3lJt2pasx2+mlLNiXicJFFRGNf
TLSH
T1E065BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 44b09e1f79f04cc5a4e19d7df72697fc50c8dfbc31bc85250154557fb4620a11
MD5 ecf70f040da513206d09efab638f1e58
SHA1 c6ecab7678819971abfcfdd1d240e00861ae3919
SHA512 0a20955a82d4fefed98bbf073b1caa19b06ad6298fa4cbc8a47185cd69cc3589e8bdf5849bba9c303bb32dcd2d70943bf1fba48099bc162622018acd8ebd82f7
SSDEEP 24576:wNcwHdjbyQ4nLC18lb/EOjowL7FkR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wNc/zEOVHFmLNiXicJFFRGNzj3
TLSH
T146858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0b11a84e64b5a1bda31d451a709e28a94c3a8d649a16aa0f54876ddbfb15f1f3
MD5 af675a2eb976df9dd774113c6d75964e
SHA1 a760089cbb0482fb469e2d5aac405718aa704881
SHA512 fc5cdf9ecb9a7ac0fbe187cfb4beaf2c8322ad4d49452a7d941ff3b78b13d00cb236723fd711385507ac4b3f78efbe09e5189af5a416b5a6eae307778d51d580
SSDEEP 24576:zzkNvNnaFeYhJNtmZBmA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zzMwBtOmALNiXicJFFRGNzj3
TLSH
T15E55AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 d3d0fc19d8575617e8d0b032d689b5dff4faa14f91edce232058ec15c6f1f692
MD5 11e0693b5a0a6432e27e5f2b1f97d834
SHA1 14a450e1762d18977b5c27f63ce305f1b462c213
SHA512 5932bbd5704449f9a1715183f7c29503ce74cfeddd321b949212e176b651d00db3f4bbc8d8a72e6c3d164d10a2b3c0ce5e791e5e030533f60e9735e6800aee0c
SSDEEP 24576:OPUr+NQ9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OJQ9LNiXicJFFRGNzj3
TLSH
T16365F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 d2c7a17365b8df3edde0083b8f7f9f0234a035f665d8f12576bfe655b70c1908
MD5 b3f7105f16545ed65fcef6bcbe24ae46
SHA1 dbd3c2c75c18f7dec641fa495bc6830f2bd7af84
SHA512 e60c707d49a7c9f1ab43d8eca2d7066da79a3b81513d7320a5b8c67b31f6fe32e2e6dec28555f47752ff128e1114730ac2262c1768292dd96522e7da0c468615
SSDEEP 24576:hD3FHshBIYQgAc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hDVHeBIAAcLNiXicJFFRGNzj3
TLSH
T13375E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1108-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1108-147-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1108-153-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1108-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2108-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2108-140-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2108-136-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2108-130-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2108-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2532-77-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2532-71-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2532-312-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2532-69-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2972-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2972-92-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2972-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2972-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2972-98-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2972-333-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3288-40-0x0000000000400000-0x00000000006A7000-memory.dmp

Download

memory/3288-0-0x0000000000400000-0x00000000006A7000-memory.dmp

Download

memory/3288-6-0x0000000002620000-0x0000000002686000-memory.dmp

Download

memory/3288-7-0x0000000002620000-0x0000000002686000-memory.dmp

Download

memory/3288-1-0x0000000002620000-0x0000000002686000-memory.dmp

Download

memory/3528-58-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3528-65-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3528-59-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3528-297-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3696-82-0x00000000009B0000-0x0000000000A16000-memory.dmp

Download

memory/3696-87-0x00000000009B0000-0x0000000000A16000-memory.dmp

Download

memory/3696-81-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3696-313-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3772-119-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3772-316-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3772-118-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3772-125-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4100-15-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4100-22-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4100-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4100-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4612-105-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4612-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4612-317-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4612-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4612-111-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4612-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4784-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4784-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4784-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4784-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4784-117-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4820-43-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4820-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4820-56-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4820-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4820-52-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download