Analysis
- max time kernel
150s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/10/2026, 10:45
Behavioral task
behavioral1
Sample
2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe
- Size 780KB
- Sample261027-mtfbvsct2w
- SHA256 595903b0eab64014f7ff5a00a488b7930eb070916007b977d1a362a7a0bd6bea
- MD5 9d7524f5dde34488c1e2032e18ed1899
- SHA1 885540a41908d0638eb5ed56c2a174bf83e9d9bd
- SHA512 a89cf1afbd2afde3057b660105c7edfd060cd707662efbc3d2deeb6378d26171f1d6a52fd0652c60002b906e5b9138a231f786dbef951851062b85a9bdf2cb05
- SSDEEP 24576:96HDMEsOOAntFaBUnXHuc+Yb3bqXfgbr1:9nEsAn/aBUnXHX+YbLgs
- TLSH T1E90523627737D7EDD180B97397BCDC69E9BB1884639D10093211E3796FA20CC9AD3982
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 21 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Windows\system32\locator.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Windows\System32\vds.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe -
resource yara_rule behavioral1/memory/2380-0-0x0000000000400000-0x00000000004CE000-memory.dmp upx behavioral1/memory/2380-13-0x0000000000400000-0x00000000004CE000-memory.dmp upx behavioral1/files/0x000100000001700e-205.dat upx behavioral1/files/0x000100000001704d-209.dat upx behavioral1/files/0x0001000000017bd4-213.dat upx behavioral1/files/0x0001000000017431-217.dat upx behavioral1/files/0x0001000000023365-229.dat upx behavioral1/files/0x000100000000c513-233.dat upx behavioral1/files/0x000100000000c534-237.dat upx behavioral1/files/0x0002000000021b53-241.dat upx behavioral1/files/0x0001000000017ec8-245.dat upx behavioral1/files/0x000100000000fa69-249.dat upx behavioral1/files/0x000100000000c3fb-253.dat upx behavioral1/files/0x00010000000177f0-257.dat upx behavioral1/files/0x0001000000017816-261.dat upx behavioral1/files/0x000100000000c8dc-265.dat upx behavioral1/files/0x0001000000017854-269.dat upx behavioral1/files/0x0001000000017ec2-273.dat upx behavioral1/files/0x00010000000178ce-277.dat upx behavioral1/files/0x0001000000017039-281.dat upx behavioral1/files/0x000100000001797d-285.dat upx behavioral1/files/0x000100000001799c-289.dat upx behavioral1/files/0x00010000000179a2-293.dat upx behavioral1/files/0x00010000000180b2-297.dat upx behavioral1/files/0x0001000000016795-301.dat upx behavioral1/files/0x00010000000177ca-305.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105406\javaws.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105406\java.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105406\javaw.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe Token: SeDebugPrivilege 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe Token: SeDebugPrivilege 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe Token: SeDebugPrivilege 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe Token: SeDebugPrivilege 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe Token: SeDebugPrivilege 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe 2380 2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_9d7524f5dde34488c1e2032e18ed1899_elex_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2380
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.9MB
- SHA256 43fd4c399fec27656d2286b7474832fbce0049c18f9d78bd4fbbc7553840c1a6
- MD5 4f158cee40e24250ce0a7457ce6d7677
- SHA1 921f0b38f5ef124254f697c543054e73bae49916
- SHA512 c796f528da94538c3ff51792c16f30ddd4c1484706c2583759371c7d225649dbe2ec50b621ff147cb0a7f5f7552ea6816671d97136030e65511b0f28371a27e7
- SSDEEP 49152:Wb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnRnEsAn/aBUnXHX+YbLgs:I3q6gjBeEsma6Xd/gs
- TLSH T1E9E59D03F29900E9E06AD178D74A9133E9A2BC890B34B6DF0790B6552F7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1017KB
- SHA256 a5072931967dae307ae3da3047f99a6e63fe83ce9ed273b763646db8c29fb85e
- MD5 09a192594820227f18c01dcda37d39e3
- SHA1 336e02258fdc108181fdbbdf952d46f81d882826
- SHA512 4fd4a0cab6fabcca6d9e817892754c880dfc55076b087663554b924df686a9355477cec9f6009f49dfa1190ae6f8234a12ae5f4192e770941cacd7cc31853ded
- SSDEEP 24576:eXYGKtczAo6HDMEsOOAntFaBUnXHuc+Yb3bqXfgbr1:rtcRnEsAn/aBUnXHX+YbLgs
- TLSH T1AF25022873A149FDEDA3917DC9B5C811EA73788143A4E68B03A4D6751F232C85E3FB91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 997KB
- SHA256 ba0e2808a58995c04461dc44eeadf6a8ba278a3a085c9c9eeb21e8a242926f16
- MD5 eb05192412f79680c35d246f4d61136e
- SHA1 10bfd84663d2a443b3d7d4401ba8b6a8b714fcd2
- SHA512 bb9e696f9baeabb0fe6d42d5e7c314e0b83539eccac4e3de949f7c786d1852ac2e19475612002058eaf294932ff59cb0f903001abd5aaf1432e1f717021ae4eb
- SSDEEP 24576:dwu7OWKA6HDMEsOOAntFaBUnXHuc+Yb3bqXfgbr:dwIOLAnEsAn/aBUnXHX+YbLg
- TLSH T1B325014673A55CF9E5A39139C6ABC436F7F3B8012625D71F1360C36B6F23250AD2AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 3.0MB
- SHA256 a2b9a511f3ccca0e6d8fde5e506710f969c61c79361ae5435470bacae9f04faa
- MD5 c26019d8139d7649eacc3f7226cfbc4a
- SHA1 c27344202b8b560c657a486a2b7b74aff2efe2b3
- SHA512 589c558ba5e0d3996f599a1c3685b87c2ed60ab25499850f471ca46cfc8c90a6e73e706ec5f7c0148770d2db1128c1454a03b644174f9be0c92cb7c89a686598
- SSDEEP 49152:yB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glKnEsAn/aBUnXHX+YbLgs:Au6JmTxd2dKEsma6Xd/gs
- TLSH T199E5AD13F2DA01E8D05AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.7MB
- SHA256 752ebdb0940395bc4ee03fbc19e028b21532c989b098c4517ce2123352c19730
- MD5 d58861dd11e5930faf78d15b75715ec1
- SHA1 e5d7aa1fcbd448e9aaa6d145e17720bf5ccd443f
- SHA512 84e98355a5cedfe0c823cba689821a9cf1ce4ced02284972dd02412f7a624eec6158f1ebef0b073fbb2bf9d489a61fcbc5d92263f5873fff880d242e52908bb0
- SSDEEP 49152:iP4m4IpOO6768KjnEsAn/aBUnXHX+YbLgs:qppOODBEsma6Xd/gs
- TLSH T1F385BF2DABDC0096D0BA917486658A49FAB1742A2F3286CF1160933D3F77ED54F36F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 778KB
- SHA256 2f9e2dbe656f3a4fb5b18bfbf316ec41db0670e9fbce24b543425bd7f1603470
- MD5 cd06e0cb248d2181139ca3957fa85c94
- SHA1 05be2a0157cc588e56a3d1a4f7a9a75271081360
- SHA512 ee1a899e8baaca1a60fd02b609f4ba9a34110ac388c2740a33797632b085a02fbff3f10de865f83e4dbd46194077f73ec108c0b648ea13c7db6c28565bd8a10b
- SSDEEP 24576:Dx6HDMEsOOAntFaBUnXHuc+Yb3bqXfgbr:DxnEsAn/aBUnXHX+YbLg
- TLSH T134052322B726E79AE1D175729A7CDC65FA7F2494674D900B3200E3702FA24C8DEB7582
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.9MB
- SHA256 e734295c44217dc183f6c4a0761d27b3e24d1567aefb6ac7eed0a3c4835cbd51
- MD5 a339161b948b6e3b00ece28cc5a17564
- SHA1 4e7763ea42079b3490ea640fbacee896f86e5f46
- SHA512 0f700f3c45f27f6dc987f49c9a4624917724b4b3d95f03a1e7ed760b4b76e32f17486d649eb459e2a79a5f00d72c73bef49fca99a41355171800f67e440061ef
- SSDEEP 49152:ea0h2GEkuAe73q3ppt6zwwQ5nEsAn/aBUnXHX+YbLgs:ea0hNYGtJwiEsma6Xd/gs
- TLSH T16A95BF1E67EC82B5D0B6D278C9A6854BE6B2B4261B3156CF1150813D3F37DE84E3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AppVClient.exe
- Size 1.5MB
- SHA256 3b83561cf995f59dc321083e641dcdf6d4075f59f4926392bb8debf9edf3dba7
- MD5 ae532d70fcb2cc3d77dd2d75714b5456
- SHA1 208bbad53f482bfee7ec5a764e0661c8c273108e
- SHA512 937da7b59300a10839bad92b08a252423ce83a02c721eb5ab9ff074d7db29910747627f0bfd19d4a3e59b2ada81094c6f4c10a862daa90e5262019710ebb1bd7
- SSDEEP 24576:J1QT7EcpfxR+N5AWAz3ooiYhjMqbf6HDMEsOOAntFaBUnXHuc+Yb3bqXfgbr1:cTDxR+N5YzTTjM6nEsAn/aBUnXHX+YbJ
- TLSH T14875C02EA7F955E9D1BE85798B23C502FA727821033193CB42A0C17E1F679D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 848KB
- SHA256 f4837b3e030adcef9c005821ce3aa749c6f020c2c35454e72cc54cb3c6ac1bd1
- MD5 c06e51588b3018fd74267d4cdd1d22c4
- SHA1 921b759dce080ee20903a2eefe24a49430ff9919
- SHA512 35fd3256245f578186c4ab47c4b8d507010fb6a0683e34367ab2c0b1fc5ab2cec13f5056c9a0380ed330258a4ce6d18bd0c08cb0d0879c8abdd630b781380c1a
- SSDEEP 24576:QhbHjPH6HDMEsOOAntFaBUnXHuc+Yb3bqXfgbr1:QhbHjfnEsAn/aBUnXHX+YbLgs
- TLSH T1A605127E276D22D9E1B1B17D86AC884AD7727854231993EF3380C2790F279C85D76F82
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.4MB
- SHA256 bc909bb9a9045dfd0b63a75d4dba58b119dedd2ef1e43f0e9f383310fbba3b4b
- MD5 14b1e24ea638d444c28cff6f22230071
- SHA1 9e6e019aa1c3ec865c9914a629f4948ee157563f
- SHA512 27ad1245984aa054be5d557b88af94c4e50a8035f39f9bbe281ad53b4d293d27832eac448517ae9c27918513d968b3b1f1ae76026766dac384364f0e6df3f636
- SSDEEP 24576:xKYgnJcRTk4yti+R5dUR/36HDMEsOOAntFaBUnXHuc+Yb3bqXfgbr1:xpgnaTk46pUR/3nEsAn/aBUnXHX+YbL9
- TLSH T16165CF2EF3B910B9D8A6D136450547B5FB71782D1F209ACB0170C238AF1AED89E35F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 767KB
- SHA256 006fc47b034dabd50ac5b02c458def13decb8bc9bc8d73e7da82840d3fe68659
- MD5 3801e034588c93c0c5d2ffc15dff3d27
- SHA1 0cfddafb2ecb2d2251310eda509d895cd0d909f7
- SHA512 76e446c31d6f38b841bb4050b93f87864d8d65cde08879e72b67a23c18cd40993177e523857391f965c7ad2683fee79856a0b75af0af2394da04618a7b8d3509
- SSDEEP 12288:jrtd6ieptGgLMESli28lOAnpvTF+frTdUfpZ/P0Cqhbrc+Yrf3b5ktlamtgbeRWD:jL6HDMEsOOAntFaBUnXHuc+Yb3bqXfgF
- TLSH T101F423667323E7EED28175B69BBCDC99E9BB1880335E10193114E3716F924CC9AE74C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 94392847a13ce202ee05f6e47495992c88b17111b68f937393257f8dfa2cb728
- MD5 e65e5a25c1b454161ce212376e34d3ee
- SHA1 5299fa2d5bd2d09dc1db3d9c219158d2b30548c6
- SHA512 d38f11a652f63aed1c92a734117d23ce6e8fb0fe55e78cf12c961bffaa6693a6fb71c77e1e87f03811b605efe84d049399854a864ab1b09d16a08771c57dba89
- SSDEEP 24576:8HL3UTr6HDMEsOOAntFaBUnXHuc+Yb3bqXfgbr1:8HL3U3nEsAn/aBUnXHX+YbLgs
- TLSH T194350115F7A500F9E867913CC9BA8916E6B2749C0368E2DF13688B651F133E58E3FB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 860KB
- SHA256 258602a6f9e9cef0c8301ecac159aba4ba9af6b3f967f86c469fe1e1a4317892
- MD5 d8c36638c1a4ab93597a01606d16571d
- SHA1 026e320e348e12d61048a70c039fecb845b04c60
- SHA512 f2e2a35cc91ccadc3d8e40be91fdd6629f77b220321f16521fe4a532558f7a41ea468cb0fcf84a5a6addac330ecb7d59045b8e58b3f35a6bb933a80c26162c25
- SSDEEP 24576:eOS6HDMEsOOAntFaBUnXHuc+Yb3bqXfgbr1:eOSnEsAn/aBUnXHX+YbLgs
- TLSH T12415222A33AD11E8D171B13D8AAD860DD7B27851131653DF1290C27E1FA3EDCAC7BA91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.6MB
- SHA256 ea19328ae747db95d8d7cfedae006b1cc52e6baaadc10f390cadef4f45ebaf5c
- MD5 c44b4c7df6ef3615ff8a3eb4dc0dd2c8
- SHA1 8f45142d2e02426bb6c640542d135d2a5079d3e1
- SHA512 94a28472c687f0c617d75ee4502995eeef71c007a75e8aacbaf16e7a7f865a9fee7cfd1d7e47334ec4377fc385dc4f837a69a98ac9af4b427bf72de2a8bb0e77
- SSDEEP 49152:97cBWMpPjN8DbEhRnEsAn/aBUnXHX+YbLgs:qNEsma6Xd/gs
- TLSH T19185BF2E6BAC81E5D477D13DC9A28605F6F2B4611B318ACF1152833E6F37AE44E36721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.9MB
- SHA256 ba7db41d63c8ab6ad1c17a0e135d5ea6306a55a8eb5bb7317488131944cf2429
- MD5 990eccef78ab1b0e6394b7f4ab641f19
- SHA1 9f56376aabee7ab8269b9de7688939daca0773fd
- SHA512 6b325fa35bdb3c73495c22754e4974840b46b8683ca5fbb3059aeb7024983d3ac6f42afcb50e6d5bf4893a12245724a24b3a8f0270d9fabf5315d9d993c64613
- SSDEEP 49152:3F2YuHNETovIvNYf8kmbnEsAn/aBUnXHX+YbLgs:O6ZCf8kkEsma6Xd/gs
- TLSH T11C959F6A27EDC0A4E0BBD27D85B6D146FAB2B8511B3055CF0255862E1F33AF44D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SgrmBroker.exe
- Size 1.0MB
- SHA256 7d10bed90f284f45fa8d3254624e498039739058e6e069099f85f204d90a2d44
- MD5 9f51fbe518c2a576d516fd08fdd232df
- SHA1 f3ff0762093ab1dc1967ef9ae12882212cbe971b
- SHA512 692fd5179f376d0b5fec091500b2d937b76c4b99d3005b302beb02b128b2335e89235a85c2dfaf54862364a54b0b2177add9dd4af203f7617e370ef1b15e3a4d
- SSDEEP 24576:7TMdOz0FFS+HmSLb6HDMEsOOAntFaBUnXHuc+Yb3bqXfgbr1:p0K+HmSLbnEsAn/aBUnXHX+YbLgs
- TLSH T1BC35013EA36D14E9E07AD27DDA56CD06FA733461032266DB0290C1793F97ED47A3AB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.6MB
- SHA256 32928aded56b7aba8ac3e39c0c627639195c3f99114cf151f55bc63c23532470
- MD5 d9072acf2d3ec0bafcc7c02ae65c0178
- SHA1 6c3f6162d1cdae10f1f73dc1dbe7f29087c93a35
- SHA512 501cea24a5d2fd0fed5e09385916239bd08572e8e9827f45cde1c668d961ab43fecb164be5784fdfdb733949d2367fafb7b4f01d0a37e4447dcf385a6189579c
- SSDEEP 24576:oAFs06+OmlfzNXEbToS6HDMEsOOAntFaBUnXHuc+Yb3bqXfgbr1:tFs060lBXuDnEsAn/aBUnXHX+YbLgs
- TLSH T15575B02F63AC00D5D07ED17E8A96C91AF6B1746307255ACB0160C63E7F6BEE85E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.0MB
- SHA256 ff3a3a04689745e0600da04a124f625266c2e728d0159349acd2669d85fd5d38
- MD5 8ba719f4bc040236c15c3c1cd32c4059
- SHA1 51b5b515582cd59c1c3c3d67da5e583cc22fa345
- SHA512 7497a7c37d8df4101385949c32f90b52697ce7ca44c1b8e26956e46d93642e09165d51ff6dab162ca4956586d1c4b4cdf6c52353c7bae48daaa4311cbdf4255a
- SSDEEP 24576:cJnJ5D3W2V6HDMEsOOAntFaBUnXHuc+Yb3bqXfgbr1:cJnJ5DG2VnEsAn/aBUnXHX+YbLgs
- TLSH T1CB35F13DD2A810F8D0B3D2B4829D5A96FF72386D2B2669CB2474D5353F12ED09A79F04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.1MB
- SHA256 5f7888b82ffd71f88dcc95d21181076cd747518471734fe74fb29f5d9f2babff
- MD5 3d85792d5dfbb04a8089989e85d50321
- SHA1 b00b713d4f017b719eb1c653f4e60865a86233cd
- SHA512 5be4b5513a285646ffa1227816fc56e9cb30750185e41cdd33ae49ded09af24673d2b3035ebe43916bf80cc7eb051d2dbfa61f83c5d4b5f8688b7329cc805eb6
- SSDEEP 49152:4F06DIKdwc+eQnSt65aVnnEsAn/aBUnXHX+YbLgs:sJEsma6Xd/gs
- TLSH T12FA57D05B7EA5294E8B3CAB1CA6295169B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 850KB
- SHA256 d59f10cd6e5ec92a3e809edaac9d91b3d4bcc35c5199a4940ae1c117e02dd399
- MD5 ea129fde2570c9bfcee3ea73e0c2fb9b
- SHA1 6564fe28f9d6f3ba36e4e011cf2642c63f5a5377
- SHA512 f20e3b1a430fd18d19328f1c9c8886bf7d58abe5fc97638372310060bad0ac5884f0a4eee2ed75aa0f002df8807f60aca72107ed53a3ba12962093fff4017ef1
- SSDEEP 24576:/ih6HDMEsOOAntFaBUnXHuc+Yb3bqXfgbr1:/ihnEsAn/aBUnXHX+YbLgs
- TLSH T1B605236E376DB1E9D152B07D86A8C945D7B3F060275A23EF2290C23D4F739C85E3AA41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 901KB
- SHA256 995aaf50a3a1861d3b631eaca450e376a297cc4aa6cbd6579e3368b56f23d2f0
- MD5 5882291f1324611daccbeb4e81c23d8b
- SHA1 9fda3073e6e24a9e65b38df2a7ab55403bd7c2d3
- SHA512 0ffe283beac33b12925be926dd3770482c3d6226f2dd3b6eee305d33101cc2905035e395519d208371f2f25549420db65a84699ae5f868256f70e11d42165b0a
- SSDEEP 24576:jIy66HDMEsOOAntFaBUnXHuc+Yb3bqXfgbr1:jIBnEsAn/aBUnXHX+YbLgs
- TLSH T13E1523057365A2D8D2E16139CABD8894EE767C206B2952DF3140F33E6F736C4AD72B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msiexec.exe
- Size 824KB
- SHA256 e5ee38f7f8bc709859ccbc5036bb58bc8b92e83866778ed751cdb660d55c1150
- MD5 0caafdb2f28e09d208aa5f50f4e55eb8
- SHA1 9dd779db4f3f56266df2fff6c9d2b1bae2b1d526
- SHA512 48b1e20884e6f62d23c02a9a7671a24633999f03c40b09bd18651946f498aa6c3ad7b783231fe9dd1c0f467bdb205cb32c4dd270d5aa289b99a172833b175e78
- SSDEEP 24576:Yc6HDMEsOOAntFaBUnXHuc+Yb3bqXfgbr1:YcnEsAn/aBUnXHX+YbLgs
- TLSH T14D05221D33A971E8E0A2B275CB7C8845D6B27861232D21FF3190D2765F735C8DAB6B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 773KB
- SHA256 2c25d204ca0741e06bed60fe68929c083b5ceb4759724746aba4baecaee5461c
- MD5 20fb69dca34079d58b1567e8f599c786
- SHA1 f1464be32a4d4e8df880e96041c4395757b1f151
- SHA512 5d4f6581a03f95ac1736b778a4f2d0f1b806c960001e95970bb2b18d2567711e07d40293708faffeb1b85b2994297457304b3aa0ec56894995f4eff197b9c636
- SSDEEP 24576:Ql6HDMEsOOAntFaBUnXHuc+Yb3bqXfgbr1:QlnEsAn/aBUnXHX+YbLgs
- TLSH T1B1F423297333F7EDD18171B6977C9C95EABA2494335D206F3150E3719FA24C89AE3882
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.4MB
- SHA256 f3ab7cb5d7d1d1bab6e111f2f34e3fc375b2e7d095da97330037eec106058442
- MD5 8b6e44469c17a8175f4188613e7df45d
- SHA1 26859b1b1f17e4fb34ee2cbe6ca5f2ba44aa8384
- SHA512 c2c196603d95ca0f937f31746d4643c28c4bde2f25b52ff27a4e88014322082e6a053b9d17483bd03fa884276cda916fdae3b66c9282dcc4d589615bc661116c
- SSDEEP 24576:cQ9MxZKdcz9ew3aZ6HDMEsOOAntFaBUnXHuc+Yb3bqXfgbr1:cVKi0nEsAn/aBUnXHX+YbLgs
- TLSH T18B659D2DABE9059AE173D23595A640C3A673B4301B35D6CF2448D03D4E7BEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 961KB
- SHA256 fc4eb2d74226eb6dc46c1fe6e744dc47367e5c6370a62f31077280b70d015017
- MD5 01a541530053e11e44c7c6f2387b68e1
- SHA1 84e48555b3497e60e188aeca05523e8c0d34300b
- SHA512 d5071a0f453aa8724d32a44dabae95a52e2e266b88c3764e4326ca7ff3b2baff4461c10527da5f2f0d63a4b857b49b882dd0242d2028516d96b455ab2602f6ee
- SSDEEP 24576:Byoc8Apk6HDMEsOOAntFaBUnXHuc+Yb3bqXfgbr1:soc8ApknEsAn/aBUnXHX+YbLgs
- TLSH T18C25F11FBB6A40E2E162913C89988645F7B3B0706B6253CB6191C33D4F639ECBD35B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.3MB
- SHA256 2a3529378c98b1e83d6db37282a6895b780a063bbf5275fe6c034af53a017139
- MD5 32fb91e191f49e8d8a7d22134a7845fc
- SHA1 bcb9304217a2e92849864e998a3dbcf492b1c7da
- SHA512 8730440bf72ad6bf5c33b11438dd58df14d3eb5c132bb250ce2c8672b3d12bb1afa0961a6f283644df73fc798d0f661eca4a780c8685e5cbb6ed70e4dc3faad1
- SSDEEP 49152:CCcnPqQUGpuphwC0DNLDpaRFXrLuWGMK2IKZnEsAn/aBUnXHX+YbLgs:E0zuNIZEsma6Xd/gs
- TLSH T123B58C3DA2B800ACD8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A39F55
- MD5 SHA1 SHA512 SSDEEP TLSH