bc7c0a0ed67e707171d4b7720ec5125c9ed9bfcd80d3c2aaf766a073dc4a9122

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 16:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
Size 1.9MB
Sample261022-tlt9davy8p
SHA256 bc7c0a0ed67e707171d4b7720ec5125c9ed9bfcd80d3c2aaf766a073dc4a9122
MD5 9981d768810e03aac9238c8a424d1488
SHA1 e64cadedcb41b182cd3da9ebc6a525719f3bced6
SHA512 a03a8cd69d7f0c7411a1e5c016d568a8c2b9aedf0109aab9d33ea72838643fff9e0d1f1d5e7f47f217f054a920fc0eec3aaf387d126852819cf3237756c24abe
SSDEEP 49152:5LkI7zBxJ+N7602Q+7JlF2HI3OpnPhJgkKPw7Q:RkI7zBxi76G+HF2HZtPh+fY8
TLSH
T13595F1163DFDC23BE3D26670CB6D7B95B0F9BA284E32884723841A2D1A35951D317A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery macro spyware stealer upx

Malware Config

Signatures

Suspicious Office macro 2 IoCs

Office document equipped with macros.

macro

resource
behavioral2/files/0x000300000001a332-394.dat
behavioral2/files/0x000300000001a331-395.dat

Executes dropped EXE 11 IoCs

pid	Process
4928	elevation_service.exe
4140	elevation_service.exe
2840	maintenanceservice.exe
2080	OSE.EXE
620	PerceptionSimulationService.exe
3368	perfhost.exe
1808	ReFsDedupSvc.exe
5284	SensorDataService.exe
2440	ssh-agent.exe
5232	AgentService.exe
5044	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3206c8e7b68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0001000000006211-182.dat	upx
behavioral2/files/0x00010000000093b2-361.dat	upx
behavioral2/files/0x0001000000009323-360.dat	upx
behavioral2/files/0x000100000001b987-363.dat	upx
behavioral2/files/0x0001000000009cfa-365.dat	upx
behavioral2/files/0x0001000000009b8e-367.dat	upx
behavioral2/files/0x000100000000a0ca-371.dat	upx
behavioral2/files/0x000100000000a2bd-374.dat	upx
behavioral2/files/0x000100000000621f-377.dat	upx
behavioral2/files/0x0001000000006276-379.dat	upx
behavioral2/files/0x000100000000bd4b-378.dat	upx
behavioral2/files/0x000100000000a315-376.dat	upx
behavioral2/files/0x0001000000009369-373.dat	upx
behavioral2/files/0x000100000000a1d0-372.dat	upx
behavioral2/files/0x000100000000a300-375.dat	upx
behavioral2/files/0x000100000000ba3b-370.dat	upx
behavioral2/files/0x0001000000009cd2-364.dat	upx
behavioral2/files/0x000100000000994e-362.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e8784c23f62dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f25042c43f62dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000051a3f4d13f62dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000050c246fc3f62dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000323d39c53f62dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001fea8dfc3f62dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
4928	elevation_service.exe
4928	elevation_service.exe
4928	elevation_service.exe
4928	elevation_service.exe
4928	elevation_service.exe
4928	elevation_service.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
Token: SeBackupPrivilege	1808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
Token: 35	3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
Token: SeAssignPrimaryTokenPrivilege	5232	AgentService.exe
Token: 33	5044	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeDebugPrivilege	3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
Token: SeDebugPrivilege	3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
Token: SeDebugPrivilege	3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
Token: SeDebugPrivilege	3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
Token: SeDebugPrivilege	4928	elevation_service.exe
Token: SeDebugPrivilege	3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
Token: SeDebugPrivilege	3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
Token: SeDebugPrivilege	3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
Token: SeDebugPrivilege	3328	2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 5620	5044	SearchIndexer.exe	100
PID 5044 wrote to memory of 3816	5044	SearchIndexer.exe	101
PID 5044 wrote to memory of 2884	5044	SearchIndexer.exe	103
PID 5044 wrote to memory of 704	5044	SearchIndexer.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-21_9981d768810e03aac9238c8a424d1488_amadey_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3328

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4140

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2840

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2080

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:620

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3368

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1808

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5284

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2440

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5232

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5620
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3816
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2892 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2884
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2740 2736 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 2.6MB
SHA256 1298e5a28cfa82fae4baab6b84952a9c0ab79c499a6b0447a3f13313158a6d23
MD5 50db3b0b763867521ad4dd7cf67f72d0
SHA1 d611313cae1c4db2545ac23258cc55d04d543171
SHA512 1f7811efbc2248ff393fad9843cba9ce68c68209ec04ef066aacf4f403fd4eee0940d3352c7203156b3807c928573dbb215634e3371d55ce82544b5e7ab14857
SSDEEP 49152:STAGOmehCig6wN2YpX6AsgluOjJ+7JlF2HI3OpnP:STAGgxg6m2YpXN1J+HF2HZtP
TLSH
T186C5021073D08135F1B329328BBF9724552DB9B15F6881CFA7C82B6E5E306E1A935B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaureg.exe

Path C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe
Size 2.7MB
SHA256 cfd477fb2d04a6860a8a807ee4d5382317aff80de2c49db383dbf317843269c1
MD5 4c39d31231b8e5382b4fe98edeb0472f
SHA1 36f797c66cce8156219424db1b6f5a6f38433e4f
SHA512 3ed6f6eee29fc68b80600aa05a75aff46744af31d9a158b06779bf00c77cd4883e7e506b3fdf39f486d387ff525b0e7eb31780c4e47d1c9d7cadc4156a10df20
SSDEEP 49152:BrjiPDrbCig6wN2YpX6AsgluOjs+7JlF2HI3OpnP:BrjiLfxg6m2YpXN1s+HF2HZtP
TLSH
T158D5121474A0C032D23311314E69E794963EF6704A6249D77BD8BFBE7E345C1EB28AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
Size 2.4MB
SHA256 aadf76ad95ad704ba9b16f8bd98fd81dbf7c644cb117d479266b384d0a98fd8f
MD5 17c45d5fedf94feab9d725213cc8df41
SHA1 c0a8566e21e984ad0fd8f2522c5dbeea4d8bcfc9
SHA512 26fcc58bf2b2694045ace8e76f2cb214bf8dcc04291a2bcdf6085b6c11ab9b39021ff499576bbd3b6e07e2a26d29e765fe5bfde798f8691857fd2a261fe17fc3
SSDEEP 49152:MZMRzfUCig6wN2YpX6AsgluOjK+7JlF2HI3OpnP:HzfUxg6m2YpXN1K+HF2HZtP
TLSH
T11EC52244A39008F4EE274539CD654906D2B2BC6A0A60CA1F1BF8376B6F373625C7EF95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
Size 2.4MB
SHA256 fee2ddf1b3cb0b886dab3805c3ff468deed0d687d34db4fa24c9dca2e3597471
MD5 764a26b2fbd90ddd74ad5ceda72e3306
SHA1 4b3549447f05df8923126ba934abd6bb7f0714e9
SHA512 8ce96a0f2fd9f3c403437f843ee568a3c1dca3c72432aa3f291e129db4bd809e9c5cc9aac47a75a099302d286e81d61cce4b8afd00d9dd4c9cecf79d31575f6a
SSDEEP 49152:fTuLljpCig6wN2YpX6AsgluOjF+7JlF2HI3OpnP:yLtpxg6m2YpXN1F+HF2HZtP
TLSH
T1D6C51254A3A008F4EE27453ACD654906C2B2BC6A0660CA1F1BF8376B6F373625C7DF95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe
Size 1.9MB
SHA256 d3afa3ec3d7d818fb65a548d8cb04676928d043357f7b6176de7f0f5d99971dc
MD5 47185b6c81307614a94a45b91fcea636
SHA1 81a8db4afd729d387b0c5abd0e7ef733beb6f957
SHA512 838e37fb6497044e7f36463175388309b29a4e40fca55b943354fad168fbc6309db97823da82c17fff176545a5872f300b55dba357459ad96d63fae15822682a
SSDEEP 24576:O3vd9CHKy7GZuC4Bgn67pGN2CF7NX6AgJfYpvzH03Oj+t:Qvd9CHKyaUCig6wN2YpX6AsgluOj
TLSH
T14E95CF90F3E410E4F1B79A35C9764511DA76BCAA1B71CE8F03A8265A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

disabledupdater.exe

Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe
Size 6.2MB
SHA256 097d098a84d1fc0dec0bd9edf174b7c3dd8f7a06c203f03b0773fb79e037853b
MD5 269305b4cc6e2e74562aa1f8d0ca642a
SHA1 68ad45d0d2573f0bf6a01177b85024df15655ad4
SHA512 b6a1f833e98e75bbf3d41c235e7b2b79bc34ecf2c530ccf518d67958367b5beda2b4f2ca3408272795db7eb871a8e92c0f1ddc4dae18d92a11f754e09c5fd4d6
SSDEEP 196608:iog1P9fIlOug6IgF+I3m2MXP6HG8QzkjY1:iognqOz6IgF+qbM/6HG8QAjY
TLSH
T1C6668C23A4E04034E5F732756D2CA7395A327BA29F3145CB86946C946FB83D3293936F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.2MB
SHA256 3f7f4b3863fccfc810059d64ff450699e1aedc6e07504f570d0b5bed7c7ac82f
MD5 2bbbc26d0fec6494bad1f4aaad3dd7a4
SHA1 a7b5440a904ab596bcab5510eddf19cf1b986663
SHA512 7f1a0297c0e9f368d169fd4f274bc37521cd14cf91c521bdf1878e4ee60417f2d819b1752791848a6d74b2f2f16b4accdf79141f1f4e296d9a01fead6eebb880
SSDEEP 196608:Hog1P9fIlOug6IgF+I3m2MXP6HG8QzkjY1:HognqOz6IgF+qbM/6HG8QAjY
TLSH
T1F1668C23A4E04034E5F732756D2CA7395A327BA29F3145CB86946C946FB83D3293936F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a2768b40ef9ec56ae4580efaf9a807f9bb502154c0fac1a6759e32189046405d
MD5 9fb64b6d3ee9d2577550e9ae30a7336b
SHA1 bd2ea82cb8a6b536eb5f8b5f8343ceb1b76df4fd
SHA512 c21e733081451c39f97cefb0faac34c3481378a93d59b3b968a65032da687686b5af5a5307b336a9b7f701152641fae5dbb73f58c78a71b9ec8b3e5bada2d30b
SSDEEP 49152:9b+632BuPkFKRrdE6ohvstBhuXjfS4LWxn1JgkKPw7Q:D3q6sjBs+fY8
TLSH
T185D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.4MB
SHA256 661f415d194876d82b41cb8956f2184eff216ab223d5fd411a9299538716f5c2
MD5 7e277b414f29ec3435f08e63166fbe2f
SHA1 f85c6ec413444b1cad3a87511b07f4d00b8178d5
SHA512 cd2cd4af72121a1c2f75fc5737636708322c7b6152cf8d4160d30d4f7a6a11d2b5e2d5f913e81de6f3dd5c0ff31c43f541092287cbff84e8be515d0e44cfbe20
SSDEEP 24576:4XYfDtczAYJf6nU7+fR7bwYbAQRTM9D7x3fRPF2HIH5SPXkOpv/joW5JF:vtcHJgkKPw7Qx+7JlF2HI3OpnP
TLSH
T112C51228A3E408F9FD674278C9B18515E77278954394DACB03B4A93A2F333E45D7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.4MB
SHA256 31ae580c4d38b3fec60bcda26741fa4d0ea86f6171974bb4b2f3191f9f217055
MD5 226444510eedc0f5d466188370dcbad0
SHA1 3aef94fdd25eca7f8b3e257940c86a9b9864dade
SHA512 fb789aa824cbad920956cc21dbe3f8b3fc13152aed60d9c2ba3a6bdeaebc98c743e83dbf737103a63e075f881cf45ad1c3d77ec20101090158630714c7e2857b
SSDEEP 24576:6XYWzOczAYJf6nU7+fR7bwYbAQRTM9D7x3fRPF2HIH5SPXkOpv/joW5JF:eOcHJgkKPw7Qx+7JlF2HI3OpnP
TLSH
T15AC51228A3E408F9FD674278C9B28515E77278914794DA8F03F4A93A2F333A45D7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 b945aea98da0031a362add8e90a196ed089fd84ac03f4e8a74263cc7e40e0b04
MD5 40b472b9707bd19b560f1b24b6faefdf
SHA1 069092db5eb513c7d1346740b4dabc7271fda504
SHA512 6335ec312e9b8031ec058e34a96fafcfb52af84c89440fcf4b7932007e2f0a14f7a205e6ef3f09141c6cab54dcb1f204ac45689488eea20b1fa08f4124496380
SSDEEP 12288:S1XLsswWkxy2lRq2czAQLUo8DdSv6oOyTFBn+JB6CF7GiwyyjeHzbWlbU9:4XYfDtczAYJf6nU7+fR7bwYbAQ
TLSH
T16785F12863E508F9FD67827CC9A28515EA737C9147A0EACF03A499261F333D45E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 ec6b27e4364cbe05692903dc06a4be6d93aa5d1ae080725607ee3e2fa18b268c
MD5 0791cf0ba5c09567c8f2a69276001232
SHA1 716775668f1b27686e69f55124141c4663c6c50b
SHA512 d47adf10f4805ba3a7e0ee68cb0e659b6494e38c1b40205c1832e25bc57723902de042d975e38f4c4e0be3bfb07e81c34c5e7063c79fd51c8d4080d737df988d
SSDEEP 12288:hmw5HEjsChNVBFgl0WDm+CbLUo8DdSv6oOyTFBn+JB6CF7GiwyyjeHzbWlbU9:8wu4OWqJf6nU7+fR7bwYbAQ
TLSH
T18585F14562E51CF9F9A782388697C136F7F2BC112A65CB0F0760C65B6F37361AD2AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 edd6ba87c356f7b13cb7ef5e569ee3761160ea4f3620140645e964e714b23b29
MD5 cd9c745801f6c99da097e51817a71a31
SHA1 a9caee84c4b87e9777c9d2ebce1e86a21b40b51f
SHA512 bd82f777f13e55485981e7d052ff877553f432fc41ed25a738546e96e58ab97dcea3fdbd95f1a78c034bd1b454ac2a58011ecf152a9b19447e3b81ebece1e911
SSDEEP 49152:XB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gloJgkKPw7Q:5u6Jmdxd2do+fY8
TLSH
T173D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.6MB
SHA256 e3b211f7ccd76a2328d88b7f6680eb93ffd5933361d9cce1d359e3b723a241e9
MD5 4bbbeff3184eae6eef60d1f171f01a30
SHA1 98829e45814a64b0ca297556abceae2763a38278
SHA512 9520698c7baafb139e44736f8513685016091f78e168221a17e71816a006ddfd4ca7b258439b0467c0aac6395041f932c1fd96693e5ba4c514f06f3d2f5a21a1
SSDEEP 24576:D0wvwk9RX6wkyAIBJf6nU7+fR7bwYbAQqTM9D7x3fRPF2HIH5SPXkOpv/joW5JF:MMnYIBJgkKPw7Qy+7JlF2HI3OpnP
TLSH
T160D50129DADC04E1E177923C99F7460AF2B178691B31C6CF12A9536E1E37EE09D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7677da7ae7c06b7af6ad1b4e56fdf5f706095a5a68b95a625aedc6c6c9e47173
MD5 7349c529575b874a89fab1aed4b771bc
SHA1 de15b86ba267ec06406827ea8849d90f88334318
SHA512 b4cd979d0c7c54e7b24d9d7960a13293b11aa17b3aa6631d221bc1811fee21d978cc26a09b848a374ad8eda2ac709beef11ace3910ddb358d1f62772c6b82cc7
SSDEEP 49152:OYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK04JgkKPw7Q:9ySzPg+fY8
TLSH
T191066C56A1A801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 33986f5d0fe2241dcabb2b5f7f06db93d00753f0b8ad21338c69efaf4f2e304d
MD5 4aec6194caa721a2a3a80552b57e750b
SHA1 139dfdb7d7c6567b9c82fb3fa40868ffc2bdd337
SHA512 eb4395c7c3634db89b031bf3f7ef4bd59b1acdefeeb72a9828f84430411998b5fe2c919cab8e91b05826d80d4564b4ed0bfbc61fe6a5f72b7e08387cd3808842
SSDEEP 49152:TYtlNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK04JgkKPw7Qa+7q:MySzPg+fY8a+HF2HZtP
TLSH
T193269D56A1A801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 31b9ecf3c8b5e94ff51f59a734ca90d3ef03c490642d1fc9aa98dd2b3cb440ef
MD5 3164ae84314b34316f0387895fca8e7b
SHA1 c972a9f1e43bb7c83ad169d98f34eb747d8253c8
SHA512 d05aae0cd1962872a83cc12f54807432b55497243f5fdae5e2e36bde8e82e435fc32b46fdb528afe6edcfedc53722da3f2d57b6690f21613f96a69e65da68a82
SSDEEP 24576:w47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYyJf6nU7+fR7bwYbAQ:w47JUQjTirIhCnDHUPfF/oJgkKPw7Q
TLSH
T1B565AE1EA3EC01E5E1BA927885554A5AEA71782E1F31CACF1270837D6F23ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 80173df802e119520806e4375cdaf7b454aacad18c4273153af09ef09f646c98
MD5 63d38e0df8b9fb8ce77da49ed5c3c6b5
SHA1 e63fd5d5f98e408349744323b3d2427817b43df0
SHA512 b678d7a72611118ae477453e8be902622f01cb1a7d43b26d6b4b53b92f0f29e4f37da4dcee57b1a756cbea97381454fa02dea80ab8ac97c0282637852a384fa6
SSDEEP 49152:697JUQjdirIhCnDHUPfF/oJgkKPw7QG+7JlF2HI3OpnP:cJnglD0Pq+fY8G+HF2HZtP
TLSH
T1DCB5D01DA3EC01E5E1BA927886554A5AEA71742D1B31CACF2270837D6F23ED48F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 5a6cd576451ef255f8d32113246253822f282ef98533ee94a7098dd5f349dd1e
MD5 d366e590b923d5355332b3fc7a598a46
SHA1 658fd18ca06c46ca81095da17a08f7850aded1a1
SHA512 2a33b106c57a26fe06e464d21635291f50b40972ee9fe16ef79707e73fb28462cc616b45a03e65e68dc1bb26b7846b52cca4c652d6b74ea9b044376860f4cca0
SSDEEP 12288:qQZk8YKXSB3IHU/mkxqqoBfZKYzeAptR:hls48m4o/xqW
TLSH
T12F2517107666DB4FC66984321E33D1CCAB707D11EE05AB0772C9873FC57A659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 342KB
SHA256 0c40ff349554bf7a56526e783fc6cb274276c9def05ff333b57ff26b5454e9ae
MD5 1098d1bc39ed700b5a7befdeb32da2d0
SHA1 1f7ef9fe0ceede2c3e5f0189fe3ca8d5bdd45d25
SHA512 ec6b5a49371c12e43279e641e6581131456639999f08cf7d393110663ccc0b66285f243a8fe3f84c509d7f3b98b51b9a8a15466f4a966272836f67f9c588eda0
SSDEEP 1536:uatlpug499pN9pz0iSK6vGeDUoOgf7YU3PzSJp/41M4:bHp74RhzVKDYgMU/zSJ94b
TLSH
T19074E721F754B22AC8F680778871C59B9B39B423DF2257023FC819A9CCB621A7737B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RemoveGroup.docm

Path C:\Users\Admin\Desktop\RemoveGroup.docm
Size 774KB
SHA256 b632528c0364feaa23b2f86119e840d3a8a89985aa5715b9a7adb3c02b1c33f2
MD5 3c9f46b6402158c8758bf7da5d988ffa
SHA1 f9b20015e94ca0ce4a8d2bc5d6d1ccd66eb607f1
SHA512 ff3888fc5ee97e172a0da7be72c6fc31a1335f2a98f82e4d05c62e2a062d9b635042bbd66f9c38580a5f56be1d3ebc3c13556d53bd745766202728682af2bdef
SSDEEP 24576:TPLTmWY8qG6o/Zu0o0aUshWzoX3CqXzFAf:TPLi8w+Zxo3hWzg5Xz8
TLSH
T184F423AC4BB344E4F6CD9B3DE4FAC5B380E4A4A34E5F905B94D4231E1E8A96B1131DE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResumeOptimize.docm

Path C:\Users\Admin\Documents\ResumeOptimize.docm
Size 777KB
SHA256 b94c6df011ef092a834b981afc849dbd28da7cbfbdc2652984dc93211d839fea
MD5 bc0e63db1cbef24cb69e2ed2b43a8f09
SHA1 d2c1f605ed6591e164f258c2435622caa1cb2d27
SHA512 3a0406159afc670ea496f7dc7326e7a351f75ea8fe1682904c9b80a2633df3b6f7ca30dc5d92cd172f1cb9a6c10971dd6b07269422a202c7ec0ca4fdbc1e855b
SSDEEP 24576:F094UTcK+5oM7/Sx6wFR/XnVgUg1NbZ6mgE8:FqYj5oMWx/XfnVWb6m18
TLSH
T13F052320C7AAC5C3FA621AF750C9DDE18904D98681FF89B1949310BBC2C19A6DF1B57F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.9MB
SHA256 cab287005de52c05d7403056d07086b5638cc14bb691941dcd3e2af2b2cf837d
MD5 baacd9fefe3c668518c2a0a9626a790a
SHA1 7f8218a0cfe0583a1c7f65a46fa0678803c30ad9
SHA512 21482b495cef2e45c21c37f9a30ed918c1538e670e90acfa26920409732db37f494af24ed3d30fe52f95f473bc2ad4c2a95dca2bc9b7d341f3f33247d1cd12fc
SSDEEP 24576:83nVi63idC4Bgn67pGN2CF7NX6AgJfYpvzH03Oj+t:8XViMwCig6wN2YpX6AsgluOj
TLSH
T12F95BF0277E99135F6F31B31AEB592615A7ABC729D35C20F23C42A0D0DB0990EA75B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 c9a47d7a13092214d3b4e88db2c7052164292f1bf5bb192b5fa69f007ca9f362
MD5 4a300299530610f5a8b300812571f20d
SHA1 1f4c54c75d67c178cf44ffaf97e0785c2abdbc0e
SHA512 80f884cc752a9be73c0a13b0873618d759b6cb2a01e073e7677dbecada541a0eda872c1b91037014fbd42d4c65ff289e8ce5f32d8ddd005af4d03ac8e76d38a4
SSDEEP 12288:c07FLUo8DdSv6oOyTFBn+JB6CF7GiwyyjeHzbWlbU9:h9Jf6nU7+fR7bwYbAQ
TLSH
T177652331819AA861F5BB57B812ED8334A72E3FE09FC4C8CFCB18795728755E14DB2909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c1afe1e0a197ff503f4cb821b10eec34c9d18f8e3d62256a9543dc9db6dc9c10
MD5 944c90813e753f11fb339b115d0bd6f6
SHA1 1bbc585e884d75cb789bfce275205dc96ae6d0a4
SHA512 fbbe7028c9dcaae7e16aadddd69360e434f22d27d01fbebd7f2282d7ec815e33baeee18c4323dd8adfb6b767c5601e7d05ccaffeaf6c2b6d72e91da5690fc61d
SSDEEP 24576:agb6bmBIi49WNNFpg1rSvFv7bY3Jf6nU7+fR7bwYbAQ:agb4mBIBhGFyJgkKPw7Q
TLSH
T14A65AE1E22EC02F5E0FAD3B89DAA4417D6B278161731D6CF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 1.3MB
SHA256 80d6e5b0357e94da42e7dbca95598743ccce58a46ad3d395d4e1a5acae194198
MD5 3b2e23c7329bae373899a36b1a593cae
SHA1 ba4ab1d2bdf73bb26d0bcc645a342df63b277465
SHA512 39d90152c2cc3d1f2e87c33529342d5f9efac2fa17579af1fce20fca2ff83f92d4a957537fce9bc50784cdfe93253db7122a0ed56248863344d4db4b1667814d
SSDEEP 24576:VTkNvNnaFeYhJNtmZBmUJf6nU7+fR7bwYbAQ:VTMwBtOmUJgkKPw7Q
TLSH
T1ED55AF6EA6F846E4E1FEC6B48D238512E6727861173292CF4390C13F0E679D89D76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 e067da38b6b050a1c6fea5aee453871fdfe17c7f6a9b562072dd9e4351393936
MD5 b37a035dd5c30cec5f73a6769f8d3757
SHA1 701936a07f60c3ae0d6c6edce4d4f7a3dbaa1d3b
SHA512 d4cb1bb2675db482875b125d0a428c593d755c45468a282b1c7a7511ce21fc3e5e0c234e506047b86ce180aca1ac3a0cb8be71598f79f1cdd584c62ca8887b67
SSDEEP 24576:nGI5TM9D7x3fRPF2HIH5SPXkOpv/joW5JF:nGIJ+7JlF2HI3OpnP
TLSH
T14A05231DC0F42494D63A06719679254736B0B264670849EF28F4F63EAB387F1E9BCED8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 b319fe252a46331914988fac45add5d8a0a93c41f6d563f499cab3146a6cf69e
MD5 09a13448453f549a7f94cff02065b2da
SHA1 adcce50004b9543ff9e68a10f998ad5c4faae5bf
SHA512 603a5093acd6d86701e4bc3f4c7c67f18bb20dc46394a28a5577efeb7c49c73b674096e8a8c3e605d656ad7abca81236e4fc0e58a88adbe062e653251bc35360
SSDEEP 24576:jG88u8FpJqH1bzria7/mCJf6nU7+fR7bwYbAQ:S7ZFPqVea7/vJgkKPw7Q
TLSH
T16595F16566E101F1E477D2388A864663F6B2B8211364EFCF07AC8A551F33AE14B7FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 606ef1496ca076abd5f6dd6084000c2d1b4cd4e7bf661102710873ab0594de33
MD5 e41af2e799caee52558ed8e7309abe3e
SHA1 caeb24d0b6d4b95daefbd6b819a4c5f171426980
SHA512 46c5c11f90fac80f8e771994079350cf4334968e04022a1425bb73a8290bddf879898c09934c8c15d004a47dc53a9655fb0bcd1feb0ef28beaed0ebd52e77ee2
SSDEEP 12288:tHvUrBFrEjwaQaLUo8DdSv6oOyTFBn+JB6CF7GiwyyjeHzbWlbU9:tPUr+NQGJf6nU7+fR7bwYbAQ
TLSH
T1C385E12F22ED18E5F676E27C85828719F77178621351D2CF02A0817E5E77EE4AD3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a88439c079ad6866def2cc96f1fae6a0113e36515e14183a0f3e64b4992e07a1
MD5 0efce6411b653adb969b6d45096e566d
SHA1 257590bfce3ad3b2702a898f47a6f135b1007e2a
SHA512 548510a1607ab259330a14c50a972a5d2cfe63ec33a0f88227690ce4798a1fc0f551cbecbd7cc84b26f01e398fe7d5a92e6fd022a6e6e3d9fed92c5e5ddcf31f
SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjWJgkKPw7Q:nG05lO43b5+fY8
TLSH
T127D5CF6A62EC11F9D1BBC17CDAC6860BEBB23815033556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 93e0371a98c594f8a11e4ba7cba5e3f99850cebee47119d0f682eb2b74559f3d
MD5 8e3b6fc513eeb469ddb4f6ff8f6a667e
SHA1 4e7c3b6023cab6989a64d1c9b29c45497320f354
SHA512 8122c571705604fa0154e6c9f9146482a661a46e17b151c8b56f95bc5e9e58cd91e23390dcfdc1ea6f2160298f5314a12e133132901ff0dbf0b0f39095b3cf25
SSDEEP 24576:Ofa5POZ3dpuWVM50JicR2hG0lasx2+47eidn4Jf6nU7+fR7bwYbAQ:Wa5POZ3BJt2pasx2+m+JgkKPw7Q
TLSH
T15165AF5EA6FC01D5E5B9D17CC583861AF5B1346153319ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ceaa505f7a2004f98db7b57831ec8b4fa16e81c949bee81460e942a1405bba5f
MD5 0601121d9ab4646dce63c5b0e5da6eae
SHA1 006330160924f4164b35635baf64e691ad195c38
SHA512 95ec6ee257714a40cbb0578719b1b9a59227ebd97d5c53140a56f8bf37b72df30dd0301ae9d06ebe3ec7991da2ee067390745dad40364c18b2f6e931b21b75b2
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7FkKJf6nU7+fR7bwYbAQ:VNc/zEOVHFPJgkKPw7Q
TLSH
T1D4857B2622E901E4F1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\System32\Sgrm\SgrmBroker.exe
Size 2.6MB
SHA256 d40bc05e80cd56864c97074f2c1196944e78b5434f43d1f070dd78b5be8665d3
MD5 0db751d5d31ced4e61b2e1c435b4579c
SHA1 ccc769ea9af7ee89b97df319e76c039a4da7b766
SHA512 d3eb87120be725383cfac77dd15800e445757cee16385750dd31e86df76f2cf259a1f6f509df8e8ff2474a739cec3595e43516e1efc506e94c2a139ef0f08893
SSDEEP 49152:yDVHeBIAApJgkKPw7Qx+7JlF2HI3OpnP:o+fY8x+HF2HZtP
TLSH
T16DC5123DD6AC04E4E57BC2BC96A34606E77138A9032159CB06D491BA2F3BFE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 59d74ba9f576af0980145e6b4ff1e954c2c3aaa7d6af03a87b4af1aca1b4dd8c
MD5 b4f45a7d7d7f1900accffed9cac6d85e
SHA1 404ec3649463f67753559e9d5b02e3e3fdf42df8
SHA512 46f672b22038896e7687928d6bee2bd384cc4e3d975713e88ebe96af65169d1988db7522086ae6873a445e9797d2d8d12c47bdfd9ca8a51b25354be6384c00ae
SSDEEP 24576:I6DI+TM9D7x3fRPF2HIH5SPXkOpv/joW5JF:I6DI2+7JlF2HI3OpnP
TLSH
T17125121D637A00F5D16B903AD6A30102D2B2B17593124ADF1AE4D57E9F63FE9B83CE90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 932KB
SHA256 072a23d70d654c301da5a9a6c57fd4e9f57659011dfc6baf3045837dd2057429
MD5 5224b213c001f46dae12f1e8f467e36c
SHA1 eafa6eb69254317bdfda016115e32d110fcfee39
SHA512 4954136f0004f90e3022ecf778f184f85c5cba60c3e131a636c71cd7981c5dbd7d5292ebd75d58cfd3528ae42c8a0ba15997f58e623b5336d2142b7383d7bde5
SSDEEP 24576:0ty/TM9D7x3fRPF2HIH5SPXkOpv/joW5JF:0te+7JlF2HI3OpnP
TLSH
T16015220583B81095E62A0670ABB641954B34B920AB1546DF28F0F73F7F367E5ECB4FA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 804KB
SHA256 e73fe73d8a0e67bf113a817cb9d105d61e76b456bdc2cd5002227542c0f389a4
MD5 e50b57aadea50508c3fbd42f0cd02762
SHA1 bda3471d07909383d9f266de742dc16cdf637dfb
SHA512 88d6f5824db7ddea86b3d882e8acc224b3cc4b5bb297316a004b49862002413ecb19f9eaf956697eadff2951aa22442acb82cb8ad5b332fa41e2269390a6a522
SSDEEP 24576:V7TM9D7x3fRPF2HIH5SPXkOpv/joW5JF:V3+7JlF2HI3OpnP
TLSH
T158052309C1741556E70A19B1A77926460270B329670A09EF3CF4B63EB6393F7D8F8EE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 1a80a4d221b73aa87a7fec290619ce321742fed30a5170e40421dc0b51a50030
MD5 50ae4a2150fa5447b5c5fbda7cd85068
SHA1 48267a3314ccbed555ac1163ba78fdca07df0e0d
SHA512 810a68d6bdcb330e6b5d17d7b202fca8242c83092fbccec773cf786333603c1b0d8839aede421b311b5d964e8b167aa9a45ffe2b3298a59b518fd31576f9de7d
SSDEEP 24576:thgU4oTfaidZiTM9D7x3fRPF2HIH5SPXkOpv/joW5JF:XguTrZ6+7JlF2HI3OpnP
TLSH
T15E65AD1DA3EA05CAE2B2D275D9721493D633B4315772C6CF2458C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 df911f336b8f59516ebd669c39ae2f37bc3a761c631532b6c6ac84ae0a8a9af1
MD5 cec9b53d5d3b77eaa0888c241a729f44
SHA1 7efc15fed33d7f930a78eaf1cb1158c2472c0331
SHA512 da5dadadf3120f89eb55b84fa4aaf039cbf8b182612bd4e7ec83e8c165eff7ae3724cdc5f330600bcb29b92eaf6507aa981e5015ade3bc7de2f76bc465d63c7e
SSDEEP 49152:Wgb4mBIBhGFyJgkKPw7QG+7JlF2HI3OpnP:Wtf+fY8G+HF2HZtP
TLSH
T1B6A5D01E22EC02F5E1FAD2B89DAA4417D6B278161731D6CF1250423D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 b56e890be7fe473133d1de686fa09690ada8cfcf82bf7b0733b03a393031be7c
MD5 a11e5a383c89b7a4502aa9a39a98d061
SHA1 dfef7dd630644513289a6a5866b067ce3712c14f
SHA512 51dfce5b35eab049679655dac053ad770425812971d59805d3e7f2cce13777b59c7d496f631b05678ebae69eb6060ba2abeae25b2365dfd5ed45638868ef21f4
SSDEEP 24576:3AkNvNnaFeYhJNtmZBmUJf6nU7+fR7bwYbAQfTM9D7x3fRPF2HIH5SPXkOpv/joY:3AMwBtOmUJgkKPw7Qb+7JlF2HI3OpnP
TLSH
T165A5E12EA6F806E4E1FEC6B49E238512E6727461173292CF5390C13F1E279D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 2.6MB
SHA256 f79bceefbf2341dcb6a48e9ba3680e3869dccc22c8c8abbc1aec4502c8b6c78a
MD5 303c107a8bf7ae3a62a905a8a09eb222
SHA1 32040058e4b8e450c389a741d68955864b126cda
SHA512 5d7b59c358a094de38c57a242ba146da6dffffb6f9df5a79c4b248c921f26603494c67f1e1f6d6fe2ab0c3313a49ea55593660999120aa3593cb121330da445f
SSDEEP 49152:mDVHeBIAApJgkKPw7Qx+7JlF2HI3OpnP:s+fY8x+HF2HZtP
TLSH
T13DC5123DD6AC04E4E57BC2BC96A34606E77138A9032159CB06D491BA2F3BFE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 07f622413960d544ba3508d978f7df77fda7da55b3441905608f1b7957293561
MD5 1a23ea34ced2bb5c3effebe41b3f29cd
SHA1 80897b4d913c392463cc1937497d38440285f77e
SHA512 b32701fd2a9db9f2782556c708d0ccc039e010e99386c077bdbdbb7376472d91de5994e3debdb26eca8cefeb44cd0664ef4cc4221c5480a49cde948ebc102833
SSDEEP 24576:FJnJPbzB4S3cTM9D7x3fRPF2HIH5SPXkOpv/joW5JF:FJnJv6S3Y+7JlF2HI3OpnP
TLSH
T1B435E12DC2A810E8E4B7C2B4815A175AFF31347D2B2569CB29B4D5353F12FE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 796KB
SHA256 f9e4f431bc043f4b0c5d287217b207fc9a4511997a797d25cc4af88204ef7ec0
MD5 527d4a636c8e57c5df2c66c43dec563d
SHA1 3f4379dba0b92c62e4c5907414fd3a266ce4e68d
SHA512 8645e3127fb4ec6b6cc51809082bae356f326e6450857026e6b566a0b268505529c780c54e8d331fe608a44b9738c485f9dbe330c96c734401831b91fd1b9760
SSDEEP 24576:g5TM9D7x3fRPF2HIH5SPXkOpv/joW5JF:gJ+7JlF2HI3OpnP
TLSH
T166052305C1780956F70A1971A7BA254602A4E319B30949DB38F4763FB6293F7E8FCEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 940KB
SHA256 3bfa4664e2a8fc42460500745bc2619fb6fa6825105318156dfff388699bde0a
MD5 0adda5f2df2ec0b5400da9d192d85600
SHA1 a973927c33feeee952f36a3d797591049fd95b11
SHA512 f0c4e6f519d8fb84e9830d75e0486dd9c845fe7077a81a7b366d1c2c7b4bc8cfdf66b790391ed0a3e1d0b2cf63c076fd4901239e47ec0a9090193496e6ffb538
SSDEEP 24576:p6UqjpBTM9D7x3fRPF2HIH5SPXkOpv/joW5JF:p6US+7JlF2HI3OpnP
TLSH
T16D25230E82F414E5F13A0270EA75411642B0B936236949EF35E8A73F9B35BE5D87EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.2MB
SHA256 bee1d7d11a5d90bc80065e73346a6bcae97452ff1c3b0c1b347fbeb0f6e1cdd5
MD5 224ba35843f704a3ac6dddf1438330b2
SHA1 ace2a85326928670823011b9d2882c6da227c256
SHA512 408361f5b6ee09f72d3928f0706626097edb0412ecc10b4b2cb3c780662ef5274a129e384067690c3f30dbaf8aa2d1c3bd9f3b55d99b752d99b61a61f0bff210
SSDEEP 49152:vCLHGeeV5ijCmlDWDkT+7JlF2HI3OpnP:6l+HF2HZtP
TLSH
T108A57C05E7EA4184F8F3CAF5CA2694169A327C549B34F7DF4E80CA6A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 964KB
SHA256 a72a8f97f85169188fbc996aafc2c11a8b5a079b12dce6edf9ac43fa6c7539e6
MD5 0f4cc9adec3c0b71bfd31f6af4f042d5
SHA1 3b9e237a3378060842348ade6dab10085a44a477
SHA512 b0e5546fc7034659200610a2a5294d6b9f923365aaf2992fc2b2d263b80d855ac59db5d2d3507c00a983744b259a98ca0ae36feaa7831251aed5a9d2b9f02891
SSDEEP 24576:3rcmRzTM9D7x3fRPF2HIH5SPXkOpv/joW5JF:bcmRf+7JlF2HI3OpnP
TLSH
T10325010EB2BE00E6E277817CC9954546E6B3B030631257DF15A0C77E5E27AEABD38B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 7eab5b7e4e892fde00d8d531d8d9cf407296f237814b6b6f617a0e49f8232d22
MD5 2fd4892f45507752ccb89419c2a945b2
SHA1 8b10f68e63c5bdb235f228b0e7ca17400bf7ab03
SHA512 704ef06d775a098b54f3e3aaf1c1fc2542bdc0f074f0e3729659acf729c87b8de77fd8d28a4208a26086a9ce229d1b54e1d5f5c6774ebfa4ed6edc02c4410241
SSDEEP 49152:7DL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3u+7JlF2HI3OpnP:w3Upow8sBR+HF2HZtP
TLSH
T136B59D3DA2E800A8D9AAC379C54213A6EA71742D3F3015DB0174C578BF1BEF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/620-83-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/620-77-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/620-75-0x0000000140000000-0x000000014028A000-memory.dmp

Download

memory/620-292-0x0000000140000000-0x000000014028A000-memory.dmp

Download

memory/1808-91-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1808-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1808-97-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1808-349-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1808-347-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1808-318-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2080-244-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/2080-65-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2080-64-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/2080-71-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2440-125-0x0000000140000000-0x00000001402FD000-memory.dmp

Download

memory/2440-337-0x0000000140000000-0x00000001402FD000-memory.dmp

Download

memory/2440-132-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2440-126-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2840-47-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/2840-59-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/2840-56-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/2840-61-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/2840-48-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/3328-16-0x00000000032F0000-0x00000000033C6000-memory.dmp

Download

memory/3328-1-0x0000000002A30000-0x0000000002A96000-memory.dmp

Download

memory/3328-7-0x0000000002A30000-0x0000000002A96000-memory.dmp

Download

memory/3328-0-0x0000000000400000-0x00000000005E7000-memory.dmp

Download

memory/3328-63-0x0000000000400000-0x00000000005E7000-memory.dmp

Download

memory/3328-6-0x0000000002A30000-0x0000000002A96000-memory.dmp

Download

memory/3328-9-0x0000000003550000-0x00000000035D5000-memory.dmp

Download

memory/3328-17-0x0000000003550000-0x00000000035D5000-memory.dmp

Download

memory/3368-87-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/3368-309-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/4140-44-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4140-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4140-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4140-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4928-102-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4928-23-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4928-30-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4928-29-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4928-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5044-155-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5044-162-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5044-156-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5044-344-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5232-137-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5232-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5232-143-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5232-145-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5232-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5284-331-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5284-104-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5284-110-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5284-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5284-333-0x0000000140000000-0x00000001401BA000-memory.dmp

Download