Analysis
- max time kernel
150s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/10/2026, 04:30
Behavioral task
behavioral1
Sample
2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe
- Size 784KB
- Sample261024-e4519ssvdv
- SHA256 225285a27e6b7f7f8717ee13ac6b24e18bce070b077ada74223eec139bae521f
- MD5 92d04752d96babf4069de75443878e95
- SHA1 6a3c4a7eb6e98a8e7987d14a99a5786d6d75ae99
- SHA512 1bcf3ca5f4da29c7298874a5d614c18e91c7e301c57d3157a53860b4fa379c2ddf69c9d4222ccdaa8c9bc460fa1f713fd49836d87ea3cf1a2f03721b653403ad
- SSDEEP 24576:Zr78zEFWel1sjtF3erbkKg2XU6KzSU3/:pAaWelCjn3eXAH6Kzb3
- TLSH T11605235441BEC712F865ADBB16AAF53F4E4BFA539D911A2E212B1F9FD03DB8818D0408
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 21 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Windows\System32\vds.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Windows\system32\locator.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Windows\System32\alg.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe -
resource yara_rule behavioral1/memory/4868-0-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral1/memory/4868-13-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral1/files/0x0001000000017010-211.dat upx behavioral1/files/0x0001000000017066-215.dat upx behavioral1/files/0x0001000000017bd3-219.dat upx behavioral1/files/0x0001000000017430-223.dat upx behavioral1/files/0x0001000000023463-234.dat upx behavioral1/files/0x000100000000c517-239.dat upx behavioral1/files/0x000100000000c538-243.dat upx behavioral1/files/0x0002000000021cbc-247.dat upx behavioral1/files/0x0001000000017ec7-251.dat upx behavioral1/files/0x000100000000fa67-255.dat upx behavioral1/files/0x000100000000c3ff-259.dat upx behavioral1/files/0x00010000000177ef-263.dat upx behavioral1/files/0x0001000000017815-267.dat upx behavioral1/files/0x000100000000c8e0-271.dat upx behavioral1/files/0x0001000000017853-275.dat upx behavioral1/files/0x0001000000017ec1-279.dat upx behavioral1/files/0x00010000000178cd-283.dat upx behavioral1/files/0x000100000001704b-287.dat upx behavioral1/files/0x000100000001797c-291.dat upx behavioral1/files/0x000100000001799b-295.dat upx behavioral1/files/0x00010000000179a1-299.dat upx behavioral1/files/0x00010000000180b1-303.dat upx behavioral1/files/0x0001000000016794-307.dat upx behavioral1/files/0x00010000000177c9-311.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_141359\java.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe Token: SeDebugPrivilege 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe Token: SeDebugPrivilege 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe Token: SeDebugPrivilege 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe Token: SeDebugPrivilege 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe Token: SeDebugPrivilege 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe 4868 2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_92d04752d96babf4069de75443878e95_elex_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4868
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.9MB
- SHA256 d1231e8f6e3ee1602ccf1417bb1cfb48f27386f2708e15a4186882f06b1dd258
- MD5 198f0ecdfd927211a14317ece8709f09
- SHA1 7216b7ece4846b5008a92d7b8a2008f06bd2eee0
- SHA512 022939d17f1be56bbe73265b569ca988a462931f226b1f6cd55c5e54294d681e3be92bdc678223a565952687442776d35de1ea7acc778e3c7ff6ce6c57a06fe5
- SSDEEP 49152:POV632BuPkFKRrdE6oh7stBhuXjfS4LWxnnAaWelCjn3eXAH6Kzb3:h3q6gjByAaWeGTtb3
- TLSH T19FE59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1017KB
- SHA256 217d0580c29fae82f1ab1ce9c60910d0f8b0505c10ead861b8cd91c69db9941a
- MD5 6fa42d46fe46e27a84a2f28a05242173
- SHA1 03f2b28e9fe40fba2b28a88e21f5d9c8f70d8e10
- SHA512 18e991899c198ec4eab9d0dcc798f2a2896d8cb30fea495d6b2e2611806bd882fc47522016d5b0bd000338caac9c12d751aeb1cf15150b08a93ab3717e0d7c83
- SSDEEP 24576:pXYPDYczAOr78zEFWel1sjtF3erbkKg2XU6KzSU3/:oYcXAaWelCjn3eXAH6Kzb3
- TLSH T14F25022863E509F9EC67817DC8A2C516DB33B8524BA0E75F03A44A664F337D85E3EB41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 998KB
- SHA256 c8304b2ce1af0ba39401242465dd6f9c0344daabfad187fa32936d21e4a778e5
- MD5 0a3e04f631bb4ab42d24792a9883465c
- SHA1 2073bed061a711a6c1f653244c9e5cfedd9e225a
- SHA512 da658f2c8260664a1caf3db6f23ce219e5d3fcae311f2aee6eef96dfde9b12e5de829a4c0ad7bbe0f97661d01e113a520a81614611d23f5c6b96c368f6ebbece
- SSDEEP 24576:ZwutOWyer78zEFWel1sjtF3erbkKg2XU6KzSU3/:Zw2OgAaWelCjn3eXAH6Kzb3
- TLSH T1D825014572E80CF9E96786398597D13AEBB3BC022A21DB1F1360C75B5F37361AD29B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.8MB
- SHA256 649ab6078fc80b0baf4e4f3ad3c551708e78c90ba8556886f4f66c8d50acf533
- MD5 74383f3fa88cd6e1ae1d2141e84991b5
- SHA1 8af1ab04196cc11d0561786374b8b40aff8ed36e
- SHA512 880ddd8392f0fecb52dd8dbe706d8e629443e2c1faaedc93be6c0c16f13ff74bd077d0bca03e42a9c48d45b11185febfc09ecebb2cc8393aa88dba0a27209d69
- SSDEEP 98304:tQRQyi36YOcP8Lvw2gAf+PN3dAaWeGTtb3:EQyiKa+X+PN6aWea
- TLSH T1C1667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 3.0MB
- SHA256 3dab64df3c0e86fd84619208a3c2da47875ed136c418e4f8f82e7a20e488a509
- MD5 e4c9e837e8dd0d9a305a8f5b32fdf9d5
- SHA1 66de1f862979aa0cb551f8d39ba19251a13f7d40
- SHA512 7045b9ed24b81996153596334bf2a8141f200a36be73cb9a6794d96a350f244171259c8366bc1c82a0759ccb48ebb2dd1c025bea6a1766af5a2856c29a020b7d
- SSDEEP 49152:zU+taZ3usBWOBr4tEGp0bqx0z+n217aau1glbAaWelCjn3eXAH6Kzb3:Uu6JmTxd2dbAaWeGTtb3
- TLSH T151E5AE13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.7MB
- SHA256 78847190b20f9b565064c2813d55b0aeed306ea7d40c76d25728429a459a066e
- MD5 6fecc2122699704b369efc15572f69cc
- SHA1 92c3dff81321cc5e09a0e4c3c404e14842ee2978
- SHA512 e1bc172c2f3bae52a97c25ea585ebf47d2242d2733bcaf25070ad0a3128c9ccf803072e6ab1096adfcf211adf5329f9b73b024f96dd898622a79af58776e45e1
- SSDEEP 49152:lP4m4IpOO6768K1AaWelCjn3eXAH6Kzb3:LppOODHAaWeGTtb3
- TLSH T1E985BE2DABDC0096D0BA917885658A4AFAB1742A1F3286CF1160933D7F77EE54F35F02
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 778KB
- SHA256 c0704b20daedb98cce04a9c012d08542fc72f631d7e5ceb6099d18618d94e726
- MD5 8ecdd19607867fa3310109e3cf92f9d0
- SHA1 7a5c21902ff7711c92b92f2309d6801480615d23
- SHA512 0fe0dcbf7c0d7317009bed1a3e031fc9fce9ef05949ee8f29a39d84d9264b5833f12eb6096709cc0fa1be7b4c429eda7c6150b71106f4f06668b3eb16b00b074
- SSDEEP 24576:L3r78zEFWel1sjtF3erbkKg2XU6KzSU3/:LbAaWelCjn3eXAH6Kzb3
- TLSH T1F605232442FDC702F47A6AB915A9E43F0A0FFB239E915AAF701B179A803DFD45DE0509
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.9MB
- SHA256 350dc99e52d3ff98cb77839746607fc89e49e7822696e65177382b0b41bd33ee
- MD5 cab00a0749cfd668848dded4420f0a39
- SHA1 89166e2446125e4b87e8fdc71defd9131f7ae259
- SHA512 a48a2b26be43b0240b187bbada9a5527809547b1a2cae22aa5131470bd48e076084060ac97aa8b6db5e28ce1ebabf2cb29b1f30159aa8dab8702c08632423727
- SSDEEP 49152:xa0h2GEkuAe73q3ppt6zwwQSAaWelCjn3eXAH6Kzb3:xa0hNYGtJwnAaWeGTtb3
- TLSH T14D95BF1E67EC82B5D0BAD278C9A6814BE6B2B4221B3156CF1151853D3F37EE44E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AppVClient.exe
- Size 1.5MB
- SHA256 140b2c8da28e94690d3557c370736621a29be1af6ae8287aac5c09d576bab2ae
- MD5 5a961e32013f6ac25b891d2f4bf89f57
- SHA1 ab0e9635a9d024216ca9c14898d12096f50050ff
- SHA512 47389597b8c913b6268fe7a902cf616b499d72933504438c4294617844cd4c1d09b4211ce1a2b6f00cfae976d433ffb53f92f7b6cf878fb03d1e84866641e7dd
- SSDEEP 24576:b1QT7EcpfxR+N5AWAz3ooiYhjMqbnr78zEFWel1sjtF3erbkKg2XU6KzSU3/:mTDxR+N5YzTTjMoAaWelCjn3eXAH6Kz7
- TLSH T1CD75C12EA7F845E9D17E85799A23C516FB727821073193CF42A0C17E0E2B9D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 849KB
- SHA256 65e35fb5e3b2d33a130c6b4e31b9a376550d826f0b591a74d781fae1a30dfe35
- MD5 339a5aae71a23d0e22c4f6d65621e6f0
- SHA1 febcf9da16c4d62117ed5527b9ac9e42d92bccd8
- SHA512 be0aac354e61f6b4e744e697c00aa661bb9b4cf52d4ff03c2415154d25f6fd16e7b6467f3dddeaa14d62ef5c913831b559f6dcf307ec7bd4406388539dd1d5c7
- SSDEEP 24576:jhbHjPer78zEFWel1sjtF3erbkKg2XU6KzSU3/:jhbHjsAaWelCjn3eXAH6Kzb3
- TLSH T10005127D12BC1195F472E2BD45A6950BC722FD221F11A3EF229242BA8F3BEE41C75E41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.4MB
- SHA256 6a6ea18aa5c06d0a7ba22207203d931f45529d697e2faa23c9a2989c546b502b
- MD5 a0de2694279e7c71938c8269144c5f20
- SHA1 6e18f706104370e174e5888f632a9874c8a90aa3
- SHA512 ec4faf80a147f060ca97639a37d5b796d5af5e8f0e7bd73fc1d5881ccf25b9ebb13693e179ea43f587024cf9da4e35565c11fd561c3dac182774aac16fc5de2d
- SSDEEP 24576:utgg7ecRTk4yti+R5dUR/fr78zEFWel1sjtF3erbkKg2XU6KzSU3/:uKg7vTk46pUR/TAaWelCjn3eXAH6Kzb3
- TLSH T1B365C02DF2B910B9D8AAD136450147B5FB71782E1F209ACB0174C638AF1AEE85E35F4D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 768KB
- SHA256 8fefaec16e2c8a29a0af71d25a0c650760cd1acfaeef6f937e1716336a3d20e4
- MD5 d5b09bcb1e092c2a68f5ad7c9bc950fd
- SHA1 aeab2444702ea952118a826701007736a321dc57
- SHA512 0da08c461feb4ab7697c9c85aa3038ac537f9e790612be6fcd08939a746adae78330a57480a8c54b3ae10f44539769231380880e9e2710aef83bb6b5d284f3c5
- SSDEEP 12288:WCr7O8Xqz1j+FWf2N2iICxW7jttN0IP2qEB1nh/TpN4+j0KgYfXUMptXKzHyU3//:WCr78zEFWel1sjtF3erbkKg2XU6KzSUv
- TLSH T195F4335441FEC702F86A6ABE15AAA53F4A0FFF439D911B7E202B1797C03EF9919E0444
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 d570b56e09b25031d073ceef6e6e4f064cac68d4b84d1642013a6c8d5bc71ed5
- MD5 100e90ab39923898f60e217eeac05109
- SHA1 e0e58fbf9f712277626d2fa9be723ce781cff7c6
- SHA512 33f5d121290378709030dab7a116fb27143c95e59349daee4639dcaba89d2c43b18bf5f5260e3b6e9fcf7a0e62b8483bac1f614d8e7ab66c2519a7e84773ff51
- SSDEEP 24576:17nKUT7r78zEFWel1sjtF3erbkKg2XU6KzSU3/:17nKUDAaWelCjn3eXAH6Kzb3
- TLSH T1C8350254E7E400F5E87BD13C89B69927D672B85A0B60E7DF03694B661E237E14E3EB00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 861KB
- SHA256 d9d44684644ced44dcc70fbc97d67a6a220dc6bd3f1117f6f5c2cad931bfd3f7
- MD5 4ce83250bdd67ed2297d7b495e5059ac
- SHA1 e38fd36ef87ec54d924265d38937c5ea8b9e6c29
- SHA512 020bce3fa3b9e4e5ef9f4fb4f46628970374501e344113975c123e6a40e61cd84f5e60681627e9e2cd72bad42651939c184dab41e8c54208fbb8769434ac2c79
- SSDEEP 24576:kOzr78zEFWel1sjtF3erbkKg2XU6KzSU3/:kOvAaWelCjn3eXAH6Kzb3
- TLSH T18F15122932FD11E5F47AA17D4992921EC762B8630F2217EF029142BE4F67FF86C75A40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.6MB
- SHA256 631015460f154dd109522272fadcbf3fd7d257e0075ec68cd15c2582d001522a
- MD5 a299b99a8cba9f15830a4b5227cc39a4
- SHA1 e2d6644a4135d51fef8c5745aaac38902a930334
- SHA512 79a8f0e54dd08acd490207480a43012067fcb50f85d3c22f3881fac84d4267da81afefbb7dd676e5d8dd537c5388584288902e26e6c38eaa91f7c7fce172d090
- SSDEEP 49152:07cBWMpPjN8DbEhQAaWelCjn3eXAH6Kzb3:7UAaWeGTtb3
- TLSH T12485AF2E6BEC81D5D477D13DC9A28206F6B2B4611B318ADF1162833E6F37AE44E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.9MB
- SHA256 561625684348027b926828a67f00089dbdb3c454f426a1f3c18590321f4bdbea
- MD5 a7465d48bd0d0ed69f02fd331b502e0e
- SHA1 776950df57e882c0ddb63d63346492f5bce1d667
- SHA512 612784447c4b1421b8e1f94d9f5c81600e9634b0e12cb1dc0f52b6587e964c3137d90c540f125c50f7f9c22ad8aa51a90e655b2794bc2ff4103130c390abd456
- SSDEEP 49152:kF2YuHNETovIvNYf8km2AaWelCjn3eXAH6Kzb3:x6ZCf8krAaWeGTtb3
- TLSH T160958E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SgrmBroker.exe
- Size 1.0MB
- SHA256 fb10b8a84715cc56c0cf9a4a946c8cf02b3099a52ec52350ad419664783acf0e
- MD5 5776ef7e61e5b08390476aaa0b4d39e7
- SHA1 e48fff6cce47c3e8f6ce8f08d01d6155d2b6d2a9
- SHA512 a440580b2699f4506a0385d87e1b87985cfd6fecb8456250280bbc844a7dfa4d07a965b9b1d294037f2beb49daf63c2d4a1b2dcf07f6799e7d228031749fc512
- SSDEEP 24576:tTMdOz0FFS+HmSL7r78zEFWel1sjtF3erbkKg2XU6KzSU3/:X0K+HmSLnAaWelCjn3eXAH6Kzb3
- TLSH T14C35023EA3AD04E5F47BC27D9653890BE6737462072166DB0290C1BA2F5BFE43979B40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.6MB
- SHA256 b2c60eae00616e777270cb7732e1dca4df6f7ae17fcaccee9f9d9c12e4b8531b
- MD5 13b91073f8e20c7ad9634d5114d3558f
- SHA1 6679d822cdfb6655f1541ccb6d018c136d9bc2ec
- SHA512 4e0dbd8e8af6af405b80369b50b4314cb28bc0b3f86e48df8cc1cac2eee54328c82178e0c8624d2172e2ecaad33f4b0214f870145f9d7f7e4d2801f47f156a36
- SSDEEP 24576:kAFs06+OmlfzNXEbTo0Sr78zEFWel1sjtF3erbkKg2XU6KzSU3/:pFs060lBXuNgAaWelCjn3eXAH6Kzb3
- TLSH T19F75B02F62EC00D5E07ED17E8997C91AF6B1746307255ACB0160867E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.1MB
- SHA256 bc93c547716e387bdc6f3d6ea7bd3001ec3c8678d964635fe02efc642256af56
- MD5 fd7379676dcd68376190876d448f68e3
- SHA1 7cc02c1d838e2080fbcf72fd4784c4e4c587d4ec
- SHA512 c06fbc619067def5ac6fd350c30d396223a54fb1eaff7e30ae4917fd551b5f1b04c9bbc539ea14e1ccb269e3729807d807eb6bf7656001eed566cfa34265fda7
- SSDEEP 24576:PJnJ5D3W2zr78zEFWel1sjtF3erbkKg2XU6KzSU3/:PJnJ5DG2vAaWelCjn3eXAH6Kzb3
- TLSH T1F435E12DD2A810E4E4B7C2B4815A2756FF72382E2F226ACB2474D5357F16FE09979F04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.1MB
- SHA256 f7189feafb2c13f4167429950862544edf2f4afe90bd7284f99647e646720399
- MD5 9c71e4d74ef41d5be1562042670ea746
- SHA1 c39e76ce0bc16b8c731f4d44cde5aa0bd6dcac49
- SHA512 906dc33953f015191e80126b05872e0f20e7079bf1cf51a12b2730c313848baab5139b063592546512d9b4de9214ec30d1eee7af86cf0e660ce693d7eb58e1d5
- SSDEEP 49152:BF06DIKdwc+eQnSt65aV5AaWelCjn3eXAH6Kzb3:zzAaWeGTtb3
- TLSH T116A57D16B7EA5294E8B3CAB1C962A5169B327C509B34F7DF0AC0C92E1D33BD1D934B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 850KB
- SHA256 f2a41a86f390b6d43cc9052d8814978810be0d2e5789aff4301f018613e53b82
- MD5 7211005f6c294fafbe8f2d99f8a4d63e
- SHA1 27610fc61e9e043e3d21e69d09957f47a5b71b27
- SHA512 e02d79501de173ba2b8d23fc5412e2490e00450aa2f990fdd6c50cc240e5cd69588ac27f6e70b1ae4620cc274c78fe6ee25143dc4b75053a71c9ae8c955fcbde
- SSDEEP 24576:eior78zEFWel1sjtF3erbkKg2XU6KzSU3/:eiqAaWelCjn3eXAH6Kzb3
- TLSH T10C05236D23ADA0D5E43A917D4591C51EC367F0726F5227FF11A6827E8E3BAE81D38A00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 902KB
- SHA256 54e4ef45ef5538185b8532a211b4144463a8b78f2262b58010d94a75d44dfb7a
- MD5 788aa25c6913a0f46f529f4a963fc972
- SHA1 a1f50b908b10dde319724c9159c0e5aee245f530
- SHA512 4be2c9bf7b62ee5abe42d3934e292e736e22df1ab5782e371c0d1ea887eb28bbaeada45fd8ae567e31c578b8e6be16303cb4a138dfcc45c89c6da47e32848caf
- SSDEEP 24576:RIy7Er78zEFWel1sjtF3erbkKg2XU6KzSU3/:RITAaWelCjn3eXAH6Kzb3
- TLSH T13615230453EC9141F8BA467D4AB391698F2AFC225F2157EF6091A73F9E3ABD46C70B01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msiexec.exe
- Size 825KB
- SHA256 ec7ecfecc76f25dea8de51389c48a6d80650496c3f55b62f4ed5d4d8b4866619
- MD5 e9ed628ad16050e99111154fd687f506
- SHA1 0df1099e3b82846a635bced7471ccd6f5e002d29
- SHA512 e12c253ee00309b62d1ec6a907cf87e79f157a8bcdc5680c6668c0f7e9347d9ae07e5d05a85e563f35ace6ef3f8c64c52b39d3202209f77a9d4191c28f938804
- SSDEEP 24576:nRr78zEFWel1sjtF3erbkKg2XU6KzSU3/:nRAaWelCjn3eXAH6Kzb3
- TLSH T1F505231C13FC6190F47296794A76512E8612FC231F512AFF30E68ABB8B3BBD49974B01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 773KB
- SHA256 ccd5504f3325441d473b460ac066ad3c809a0e584d1db196c3805c5e92d4a6ad
- MD5 e860443060dfbd81d7dfa64756b865de
- SHA1 21c55585a10945f803accca0bcfba05830fb01fd
- SHA512 6e170b60451c900c81e6f2925753b3885140df93886ac1b65f37cccc602e79d05a130bbeb0017ac41362ed68429bb6cfd00138b319e88506523ac49f6b12cf54
- SSDEEP 24576:iar78zEFWel1sjtF3erbkKg2XU6KzSU3/:iYAaWelCjn3eXAH6Kzb3
- TLSH T154F4331C01FED701F86A59BE0575A93F4A4BFA236E51297F20AB1BB7C13EB9419E0C44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.4MB
- SHA256 20e4c208deef259387504818cdf4193696b14c2a3728ce5daa4e217caeac63fc
- MD5 4a630ec1775063816b08a45503eeb3c3
- SHA1 ce895cae61040dac612c0f1eea30a40237cf8010
- SHA512 cd07722fb4c64d1934cf79ecba8ed7afa0053320c8929843b342f8067cd4b6be7a0091ae3790f5a456799375cd6e4c968ace1d1f44120442da6d828f59a97cd2
- SSDEEP 24576:JQ9MxZKdcz9ew3Xr78zEFWel1sjtF3erbkKg2XU6KzSU3/:JVKi7AaWelCjn3eXAH6Kzb3
- TLSH T179659D2DABE9058AE177D27995A250C3A633B4311B31D6CF2049D03D4D7BEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 962KB
- SHA256 81f9600e8bb6253a11a79e0c11a4ea20de9934098271b81b475d47fc5391845b
- MD5 b31b2d46805294e04ee741f093db39b4
- SHA1 57b581b62a21406d40be8759ea3f9367f135797f
- SHA512 115d5ca3648412e5422deff29e8c73ba673d4bae389e1fd0e28d1de4e94497b71296c060ec6afe9ad727883532a0908127bd5991287cec999daeb1d3f476ea8f
- SSDEEP 24576:Ryoc8Apkr78zEFWel1sjtF3erbkKg2XU6KzSU3/:8oc8Ap+AaWelCjn3eXAH6Kzb3
- TLSH T1CC25F11FB7AE40A2E076813C89858759E773B0315F6257DB6192C33E8E27AE87D34B41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.3MB
- SHA256 e0adf69b830d1fa89518e689c89b348410e5acec66c1fc0303553eee7dde7b6e
- MD5 16e1171b8cb80b49552e2487f42ce647
- SHA1 6e6357ef1c18b117353678b6f8d5d2e3e3227638
- SHA512 771dfbf6b8259653ad301adcbafadc907833d939b53fe6ab2700f4fd6eb7b569b37650d3a10a84f2817fbf803418ab171ae0ea667d4d68cc53e3fcabda4b0402
- SSDEEP 49152:nCcnPqQUGpuphwC0DNLDpaRFXrLuWGMK2IKKaAaWelCjn3eXAH6Kzb3:D0zuNIKaAaWeGTtb3
- TLSH T161B58C3DA2BC00A9D8AAC379C5451366EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH