Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/10/2026, 22:37
Behavioral task
behavioral1
Sample
2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
20 signatures
150 seconds
General
- Target 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe
- Size 784KB
- Sample261026-2jrpgacb45
- SHA256 af982e050357f079cd13ecc5c546dea7cdc61f5c5c3e73902b919c5ba078048b
- MD5 7dba81f5bf189f21c8c29b8fac0e58d4
- SHA1 97b24bc03cf13bc02e94b5628056e403a07d689d
- SHA512 a2f44c847f38befd29d4eef2b628b7e3bc4734935dfbc34df87c22023117257515594d3f1ce19e0af4923f486ac1bf593b74da5a7cfb1269155edc8fa611473d
- SSDEEP 12288:n035VM341vjGr/1wOeZzgYU3C3xKLKV0E7SagEBy81tDUCOTnWk/s+q:035VVd696sYUVGV0kSaguyatDJTb+
- TLSH T11C05335143BE1AB8F5EF8974EE1425E3C4B922A9DE51482B1313F00D9FD623D45ABB83
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 20 IoCs
description ioc Process File opened for modification C:\Windows\system32\vssvc.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Windows\System32\alg.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Windows\System32\vds.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Windows\system32\locator.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe -
resource yara_rule behavioral2/memory/2396-0-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral2/memory/2396-13-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral2/files/0x0001000000009326-218.dat upx behavioral2/files/0x000100000000939a-222.dat upx behavioral2/files/0x000100000000994f-226.dat upx behavioral2/files/0x000100000001b974-238.dat upx behavioral2/files/0x0001000000009cd3-242.dat upx behavioral2/files/0x0001000000009cfb-246.dat upx behavioral2/files/0x000300000001a1ee-250.dat upx behavioral2/files/0x000100000000b973-254.dat upx behavioral2/files/0x000100000000df16-258.dat upx behavioral2/files/0x0001000000009fd1-262.dat upx behavioral2/files/0x0001000000009b8f-266.dat upx behavioral2/files/0x0001000000006211-270.dat upx behavioral2/files/0x000100000000a04d-274.dat upx behavioral2/files/0x000100000000ba3c-278.dat upx behavioral2/files/0x000100000000a0cb-282.dat upx behavioral2/files/0x000100000000b94d-286.dat upx behavioral2/files/0x000100000000a1d1-290.dat upx behavioral2/files/0x0001000000009354-294.dat upx behavioral2/files/0x000100000000a2be-298.dat upx behavioral2/files/0x000100000000a301-302.dat upx behavioral2/files/0x000100000000a316-306.dat upx behavioral2/files/0x000100000000621f-310.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe Token: SeDebugPrivilege 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe Token: SeDebugPrivilege 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe Token: SeDebugPrivilege 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe Token: SeDebugPrivilege 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe 2396 2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-25_7dba81f5bf189f21c8c29b8fac0e58d4_elex_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2396
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.9MB
- SHA256 1f785d8d8950444ae0c1a89b60a5e473548e3e42a105593fc7030ce8d4aa324a
- MD5 ee10e7e8e8b9848f4b298990c3651610
- SHA1 7841a4f0bd5e2f44708a097ccbe16916af72fbe7
- SHA512 4f66301e30de25738f9fa21c40e661c3e251cf1ca402ed836d19f4d681fa6c10aae57980aaed595d12a7b68e89c6fd07d0b4c87ecfa07a14ed9480401d7cd81e
- SSDEEP 49152:5Qh6C9BuPkFKRrdE6oh7stBhuXjfS4LWxnTs9CBvyaXTb:BCX6gjBZYhZ
- TLSH T1F8E59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1017KB
- SHA256 4cd5189e6b6d97870858bf8cb3548b3f40487489e2dd5cf79ebb089fd704d8b2
- MD5 82382dc4ed936b460c848de18e411583
- SHA1 a2358029400046b54bfe8ed2a024e26854f4a8f2
- SHA512 afa6a379b54525e8f55096fd06a0f11121805ead29f351108e46620217d2f21938064c2fadf323af34376983e755f26a9cb3df3f4069109b0f6c8801b7b63694
- SSDEEP 24576:JXYWiqczAR35VVd696sYUVGV0kSaguyatDJTb+:Sqc4s9CBvyaXTb
- TLSH T17925022873E409F8FDAB817CCDA18502DA7378554760EB9B03A4D5251F633E85E3EB92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 998KB
- SHA256 df271f6d6ad9334b8b1ef6c13b7f662d11a550274e40227a895ee78b7af02125
- MD5 ad1e89d6ffc790887fee4b1b988973bc
- SHA1 6f7520c72861db69b164f10e45677c24f05125d0
- SHA512 a7c0bfdf5e00f3df725f2b5886b2d2c795f38684a5d3eb274549297ec1e9b95a3717745863f03ee025599f810ba0b631573c77cc7e8962315a33bbdc203886a1
- SSDEEP 24576:ZwutOW935VVd696sYUVGV0kSaguyatDJTb+:Zw2Oes9CBvyaXTb
- TLSH T13F25024633E81CF8F9AB8138CA578536E7F278152A21DB1F0360C65B5F67361AD2EB50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 3.0MB
- SHA256 f832641948652a8ae523965d9baeed9d0887aecda6878921d83a521c339ee182
- MD5 53e642526596e9eec82db1f3fbb98823
- SHA1 2a106e77bd6152981d721506fb4a6fd1b8116a46
- SHA512 ca399719bb2b0d92f600c243262bd197dd35cd87bc220b11e1d26518f71f396e9031807d3564aa090d8a4fff291a46ae65d7e39c601ca96eeb4a2ca9b54fbf60
- SSDEEP 49152:CnNtaZ3usBWOBr4tEGp0bqx0z+n217aau1glLs9CBvyaXTb:Lu6JmTxd2dQYhZ
- TLSH T1FBE5AE13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.2MB
- SHA256 9aec432ae9151f7bbdd38d2e47779ff5f6c250635fa1f874c6c4cd7906d0a58c
- MD5 b90c1bd9243f4655f8d12806ecb3ff8b
- SHA1 2e9569902a529429a6a55e79a91a78c18d020d33
- SHA512 b6cde516343bcc373010e48d0e029133ea5d9f8376d4685d8d956443a1e9e7c4dab6d070b25c54abcd2b2882a5ba045cb94c44d004329eebdac82657cf1f2f8f
- SSDEEP 24576:W8wvtk9RX6wkyAIN35VVd696sYUVGV0kSaguyatDJTb+:WMnYIXs9CBvyaXTb
- TLSH T12A45E029EBDC04E5E1BB923C9DA3460AF6B178691B31C6CF025A536D0E37EE45D3A710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 318KB
- SHA256 d062031728c485d2100bea7dc7c8eeebb79880558d6c865541ab738e41d1b7e2
- MD5 3e54fe3352c9ccd823ec995f61d3ff5b
- SHA1 1d242246b3fcaf2e743434857b6d819cfc70a32f
- SHA512 f60d4e6bf17a5925a42e644907737309a4166a3bd90b8f7958176626564ddb02b4c41488d4364ea11c4ffb78ef710d6994c4819a5ee5e7b04d51a8d79cd5fa96
- SSDEEP 3072:D4SY6+Iom0kGBt/I8ZaQ8mx1liacNy0y8jECVD2pk4iRhgtY+Y8gqT/5dHOKh0wt:t+Pm0RT/Id46A3ktRatdYAfv73ZCR8
- TLSH T154645C67A1EC41EAC079E0FD8E43991AF6F234564332AAD707EA44451F3BAE0653F721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 779KB
- SHA256 f26da8cb264fc9db7670bb275b9c2a9669d2a3596715c2f63fa630380bae41d3
- MD5 dd9170c7cce5537818ac2f658ae88fca
- SHA1 c1404803c23590a702a582fee80f0a88b093e9b1
- SHA512 592ace85aa28f87b0bb21e314e059bda7dda063d5535fe0deea0242bcc336c7ad8ad5ff31466999b278e86e129ba694363ca5468c960dbcf5d69fd0845c54d73
- SSDEEP 12288:xi7r035VM341vjGr/1wOeZzgYU3C3xKLKV0E7SagEBy81tDUCOTnWk/s+q:gY35VVd696sYUVGV0kSaguyatDJTb+
- TLSH T1D405231243BD1EA8F8FF4578DE181192856E36B8DF1088E76203A1455FA52FD8DFA783
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.6MB
- SHA256 4bc7b81eb23c523b682c7af337ecad68c8313646e29a40f0d961fba66c0678cf
- MD5 326286a52c58aa746dbdd3c79b6acaa2
- SHA1 1a7f812d46cb38a43f712b8021300f5edb5d7806
- SHA512 828c4a5431ec6b0f508fec2d5b51d00bf32ecc4bfc4a584dd2f22934349a6c20752d94581fadf751c0a26c6db74a7930b8741932e05bc6fdb2244bf56f740afa
- SSDEEP 24576:zgb6bmBIi49WNNFpg1rSvFv7bYy35VVd696sYUVGV0kSaguyatDJTb+:zgb4mBIBhGF/s9CBvyaXTb
- TLSH T1B275BF1E22EC02F5E0FAD2B8DDA64417D6B278164731D2DF1251422D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AppVClient.exe
- Size 1.5MB
- SHA256 dad693f2c1ee5682f92ebfe5411618dbeab1871958e18116560b4c5afd41832d
- MD5 02c5cf6b3b017dd7b74d20335e447027
- SHA1 f8d6f7d9f670eaabe4c34c49823820ccb3bb50fe
- SHA512 976f9325e7bf3b5a6d26b603eff69f14299f2adb890570394ffea3bc5d420bd416fc7ec700a4eaf2cc63699a2848bf2b805771050acc9f8ee12c8abe0b68b809
- SSDEEP 24576:OTkNvNnaFeYhJNtmZBmX835VVd696sYUVGV0kSaguyatDJTb+:OTMwBtOmws9CBvyaXTb
- TLSH T1B275B06EA6F806E4E1FEC6B4CD238512E6727461173292CB5390C13F0E679D89D7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 832KB
- SHA256 c35d15c5d82d0b5a3aa1d936463d88371d86c87cd9892b9a2c5608d0cf304660
- MD5 9dc4f21e577f7770e5c62bb031afeb54
- SHA1 d6017214abaf880f1f059d7493f7ad1163cee7ff
- SHA512 b0c17c06e8adebff276a34848cfdcb0bc7496e8bc6ac585957665aca48204d563fcecd7ea467ae04653953cfc3b731f2b7ac1f2d49c66398898c153184bd6ff7
- SSDEEP 12288:+2G4035VM341vjGr/1wOeZzgYU3C3xKLKV0E7SagEBy81tDUCOTnWk/s+q:hGH35VVd696sYUVGV0kSaguyatDJTb+
- TLSH T1BE05232912F935E8E8BF8678DD241593F8B132B49B1058FF0192E1358F952F8667DF82
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 796KB
- SHA256 8a4f315b9f8a05e2c1c8291fc10ab5d597da1b6d573b5f35c827d3f917bd1956
- MD5 7a721dcba5c8c1a5cc49da90e7f06920
- SHA1 02b3335c996133553a4fac2b8254dfb82552aa9e
- SHA512 8799d23fd81a17899e19f2ae5b1d4d7cfd373b8552fd29aeec74fe56b7088b58771dd6a311a0c2adf13fefd7a604c2e80dc29856c1d4900ded1e19deb40696f2
- SSDEEP 12288:Us035VM341vjGr/1wOeZzgYU3C3xKLKV0E7SagEBy81tDUCOTnWk/s+q:UL35VVd696sYUVGV0kSaguyatDJTb+
- TLSH T1FB05235503BD5AE8F9EF4578EE102583C5A922A8EF5148F71213A1014FCA2FD46BA7C3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.3MB
- SHA256 1c813c85436ccbc95d542a44ded4d93a5fb77c0bc258dfd38723b85cd10062bc
- MD5 121e44da3daf0e80a510a40414ff9d3e
- SHA1 920a6c4c206ffbd5d68e2471cc8526bcffb8172d
- SHA512 c7a5dff6d834671cfd8ab984d26c6c08497c86e0bab44c2d9421fcded123ac96b630e0d73f9647d13ef27d441e14d3b5eb531306da3257f8c4c4fd484fcb2f05
- SSDEEP 24576:B6d8Z8FKJqH12zria7/m635VVd696sYUVGV0kSaguyatDJTb+:QSCFmqVBa7/Ls9CBvyaXTb
- TLSH T14155016567E501F0E4BBD138CA4246A3F6B2B4250364EFEF07A88B511F236E54B7EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1000KB
- SHA256 dd6881c6d05a1d8e6fc2a8cba5ed7603efbd0bd513a586ed591b1ef2df423605
- MD5 edb3d17cbbbaf8637f1c2989d1fb4a5b
- SHA1 1721388aabae6be1dd5f363cca37b342a3ec73cf
- SHA512 c5bb43a4ace450a798e27bbc5965442d6f3eb47fab04718619b9cef2b2d7ebc4660763aba678a208d9f02b9c46843dfda47343b540d85bc216ed4ce5c081e997
- SSDEEP 24576:HPUr+NQX35VVd696sYUVGV0kSaguyatDJTb+:HJQZs9CBvyaXTb
- TLSH T1B225022F22EC1CE4F6BAE17CC9414609E7717462171296DF02A1817E4F67AE8BD3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.8MB
- SHA256 104e34cac68d1eb451ef8f5b68397efd13abe0774f9d79407ec8d34662bbad44
- MD5 bf25f84a1ab362b0c9913e5c00123fd2
- SHA1 b4657eae44948249b1b5fe028e1eda5d8137eaee
- SHA512 94bd20f03f1960f19599c3c2dc80a723a1f8bf618947498c7668c959df02ed22efbc1516389f9b9a794184161cc0f00a84e909c433289ca8059a48b47f20f818
- SSDEEP 49152:PBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjks9CBvyaXTb:AG05lO43bMYhZ
- TLSH T126D5C06A62EC11F9D1BBC17CDAC6460BEBB23425033556CF02A486A91F27FF4957E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.9MB
- SHA256 954ad3e3d055b277eb1c7312face85b7b8497fa6824b8e43163c3c9c198381d9
- MD5 b1846fdd78428e1c7a05d83acdb39575
- SHA1 5faf942d9e93a35eed3c5008029192d6b5c621ef
- SHA512 7fd86fad965f30a592479c2716e82ac6faac0dc6eb9ce19a485c44beb0d3ad07a1ea90f2ee4c2e99819ca237ae0d66857d6ab3c5e6f8faca3c8cb4d365d92e61
- SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7FkD35VVd696sYUVGV0kSaguyatDJTb+:HNc/zEOVHFws9CBvyaXTb
- TLSH T109959C1623E901E4F1BBE1BE89679546FAB1786557308ACF0291811B1F73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Sgrm\SgrmBroker.exe
- Size 1.1MB
- SHA256 fb177dd5d6cfe967a05f1d09fb99fd36a27787efdc43d5362e9b8696b0f5e354
- MD5 1ce846efb043c58eb8dc05e2b2fbc475
- SHA1 f6716a527a6652996763c4ffdbbfdca8b94a9182
- SHA512 1dc632b67d6a779dd73693bb8f95c989d9d617aba8f8592a49f754e1611b85499939d369cd956fbd93ab04f2beb062e5f1063d02e092ab2252c29576cb986526
- SSDEEP 24576:XD3FHshBIYQgAx35VVd696sYUVGV0kSaguyatDJTb+:XDVHeBIAArs9CBvyaXTb
- TLSH T12B45F13EE7AC04E4E57BC1BCDA634A07E67138A9032259DB0295C1B61F5BEE46D39F40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.1MB
- SHA256 a9a889177db1e6e4e691798de260309b35e85e4ef8d4ae1e67182e86f84a2c89
- MD5 2930dd1a2a7aabf556d7e0d172e74154
- SHA1 17719e7e78590e7cafeb7a451e2153ecb6361d60
- SHA512 12603547f3b1453f5e609c37dc99f6250b3089c2ae124d4e9cb74eb79f6c56983d0e9257ab55e3d5fc99696e0292e892622a80731fab6733685629de81e1ec2a
- SSDEEP 24576:PJnJPbzB4ST35VVd696sYUVGV0kSaguyatDJTb+:PJnJv6Sls9CBvyaXTb
- TLSH T18535E13DD2A810E8E4B7C2B4811A179AFE71387D2F2169C715B4D5343F52EE0AA79F18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.2MB
- SHA256 0fcae3dbe3af971370d08b35768706db628f4101bc96950c632a2ffe340bff8a
- MD5 5f9d540c883b6da75404149d50c1e79e
- SHA1 2ce0f46205f92c33df3615f14177e0a1082336bb
- SHA512 bf23cb27acda41d0aebc543dccf2053884a43585d731d09185cb105ac114a3325e34db62c471e36fa682c223201a9e46821d2563abf26f10e2814bd57149731c
- SSDEEP 24576:sCLHGL0MoeVtFumTijCmlKQWDkM35VVd696sYUVGV0kSaguyatDJTb+:sCLHGeeV5ijCmlDWDkws9CBvyaXTb
- TLSH T103A57C05E7EB5184F8F3CAF4CA2694168A327C549B34F7EF4A80C96A1E32BD5D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 948KB
- SHA256 cc6d22f84d1ba2d5f69d4fcbdbb30692c0f7b26de8afd8b2b012883b2ed4c0f5
- MD5 6e85830ae035b88bcd723127c37648f9
- SHA1 584379d4dbbec27ad394f48e030b0438b6e4c2b2
- SHA512 209a30bd3a68b887d6548410150356942c41047242f18be8b32c200710b8be40dfdde584603939a3c62428d78024f009b9e4d71767aec99ef9e9b8fdeda2263d
- SSDEEP 24576:7WDI935VVd696sYUVGV0kSaguyatDJTb+:7WDIHs9CBvyaXTb
- TLSH T12B25015D23BA11F9E0ABC03DCA820542D2B271B5971259DF0795C1794FA3EECB93DE82
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 932KB
- SHA256 b37e485337460109e4a57c815ed00ea6fbf72e6aefcc62c8be3cf16d82c1a56e
- MD5 01aa61e24fc32b7e970b5565fb53df97
- SHA1 43615cbf3f4aa3df70bfeb2d6eee63a9a5bd80a3
- SHA512 bdb70523dc99375834470cad927e471e6d76a4a823cb35e57de0eaf00a6d38af34da7b81ae85cd1556f636d64a62e0a0c8d2db48b91cfb13e2b819030ad1fa53
- SSDEEP 24576:5ty4y35VVd696sYUVGV0kSaguyatDJTb+:5tfms9CBvyaXTb
- TLSH T1E215230553E865E8F9FF4138DE220192CE757C249F2146EF1292E22E1F763F8A975B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msiexec.exe
- Size 940KB
- SHA256 77d3be50d32d9e885463b7f4602b4fdd89e1e37c82996278c82506233c49b764
- MD5 a8bd46f772bf109724c84db20fe522f2
- SHA1 679c35f9e5f61fcafc9ff1ee8e2ce4a2a8cddafd
- SHA512 0fc24a829a847587e6828c34f2a3df6b307c9c0aa68e5c66dcd7c1af3d686cf5bb7ea255c9479bd66d093fc1fd217af18577f3e8481d488609c43c23c46d844d
- SSDEEP 24576:i6Uqjp835VVd696sYUVGV0kSaguyatDJTb+:i6U/s9CBvyaXTb
- TLSH T19625224E13E828F8F4BE4234ED20415281B579765B6159FF3295E23A8F366E8853FF12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 804KB
- SHA256 b24fb21427a1dc85508b8fd39425bce7a3da3dfee1325f889ef08628fdfe9d83
- MD5 14cbc1210af211f6ee73e0a48ae99571
- SHA1 8254b2649220658a2f6a4333aa706a3d89a35a13
- SHA512 e5294a48e2594e3a436519e20faee4f2296fd7c594110671160ca70cd4976fb7c56f297283999a52c6dcf0f44d943b16b96100a8887380f6a17f1a77b1496609
- SSDEEP 12288:8v6035VM341vjGr/1wOeZzgYU3C3xKLKV0E7SagEBy81tDUCOTnWk/s+q:0N35VVd696sYUVGV0kSaguyatDJTb+
- TLSH T11905235903BD2AE8F8EF4578DE141683C1B532B89F1148FF2252E1218FD61F955BAF82
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.4MB
- SHA256 6fc3fa6a685774689921f2063e35b2b752871d2f4ca49d63d2f1e853175e52e7
- MD5 a1f02f43f6fab61c1e575f43ee0efb7b
- SHA1 3c6d067b0aaefd7f65248cbf0ccfcc857f53a309
- SHA512 81f0656d71f515576ff48daec53b04e15ff0ec087a7d29e058bd0e94cdf54e7bd258d1c6dce921b78668fced3c7732c76935ecd72677793a0bc68da548bad39f
- SSDEEP 24576:ergPgoTfaidZM35VVd696sYUVGV0kSaguyatDJTb+:4gNTrZws9CBvyaXTb
- TLSH T1AB65AD1D63EA05DAE2B2D279D9221493D633B4315772C6DF2448C03A4DABEECAE74F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.2MB
- SHA256 72e53480e93143ab17c3ea0fdb47a82e28c2ba6d54dea9156cb7e174269287df
- MD5 4797c359ddd00c24fd2381c9bf29b3fb
- SHA1 b6955de35e0b8b6b80c524f212b51683ddf84002
- SHA512 c825479a710704ed6f3c6684504beb6ba662fe5db9c90f9a8ed7bebf9680e149138bdf08d12cf0619ad0f70233b379072229e79b1dff2178dd055f78ab36af69
- SSDEEP 49152:wDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3Rs9CBvyaXTb:d3Upow8sBFYhZ
- TLSH T1C8B59D3DA2E810A8D9AAC379C54213A6EA71742D3F3015DB0174C178BF1BEF19A39F56
- MD5 SHA1 SHA512 SSDEEP TLSH