Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/10/2026, 22:27
Behavioral task
behavioral1
Sample
2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe
- Size 780KB
- Sample261029-2dlahatthw
- SHA256 216dae05269701acea6b7eca145eb05da8e435d911bb678dbe03482bb86fc3ca
- MD5 9ed804e461253abbfdfec8042ff87545
- SHA1 b136eca46ec86ccb7fb4de5ffa5d35887ce9b118
- SHA512 a3ced9d46439774ed583a689f9899171191b7b8614374ed99fb15861f85ae2d2f1950b58379018a6b5b62f6ffd8e7ad3ee0aafd8023be8fa63e8c7a2d96c1c29
- SSDEEP 24576:BGsqKKvFsmb4jc55o+O3dyeHiu+aZ2tdgeFr5:BGn9puQ+/1UtdgeFt
- TLSH T1FC05232553D8CB3CF154B5F24D9BB6F6E73A91438F10D402D982BEEDAF82990069B709
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 20 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Windows\system32\locator.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Windows\System32\alg.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Windows\System32\vds.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe -
resource yara_rule behavioral2/memory/6076-0-0x0000000000400000-0x00000000004CE000-memory.dmp upx behavioral2/memory/6076-13-0x0000000000400000-0x00000000004CE000-memory.dmp upx behavioral2/files/0x0001000000009344-215.dat upx behavioral2/files/0x00010000000093d3-219.dat upx behavioral2/files/0x000100000000994d-223.dat upx behavioral2/files/0x000100000001b990-234.dat upx behavioral2/files/0x0001000000009cd1-239.dat upx behavioral2/files/0x0001000000009cf9-243.dat upx behavioral2/files/0x000100000000b96f-251.dat upx behavioral2/files/0x000100000000df1c-255.dat upx behavioral2/files/0x0001000000009fcf-259.dat upx behavioral2/files/0x0001000000009b8d-263.dat upx behavioral2/files/0x0001000000006215-267.dat upx behavioral2/files/0x000100000000a04b-271.dat upx behavioral2/files/0x000100000000ba38-275.dat upx behavioral2/files/0x000100000000a0c9-279.dat upx behavioral2/files/0x000100000000b949-283.dat upx behavioral2/files/0x000100000000a1cf-287.dat upx behavioral2/files/0x0001000000009384-291.dat upx behavioral2/files/0x000100000000a2bc-295.dat upx behavioral2/files/0x000100000000a2ff-299.dat upx behavioral2/files/0x000100000000a314-303.dat upx behavioral2/files/0x0001000000006223-307.dat upx behavioral2/files/0x000100000000bd49-311.dat upx behavioral2/files/0x000100000000627a-314.dat upx behavioral2/files/0x000100000000a027-319.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107515\java.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe Token: SeDebugPrivilege 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe Token: SeDebugPrivilege 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe Token: SeDebugPrivilege 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe Token: SeDebugPrivilege 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe 6076 2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-28_9ed804e461253abbfdfec8042ff87545_elex_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6076
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.9MB
- SHA256 4a6c714f968448209ef9da53c1cf69cfe4084e6ce25b053330bfc98b4488da6a
- MD5 713a02871f448aafc0944f0994621abf
- SHA1 177ee26c558505f8a2533deedd8fd30694202efb
- SHA512 457a2354067e957c309a34f3bcb387e62723e4ca331610f5add139455da4977797d93e7e6df5e5460ac3b41ad5fc4a39ec2caba3d7092c9f3220b7717b85c4dc
- SSDEEP 49152:mb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnTGn9puQ+/1UtdgeFt:Y3q6gjBOSDuLIKit
- TLSH T140E59D03F2D901E9E069D178D7469133EAA2BC890B34B6DF0780B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1017KB
- SHA256 dfe8bc7b4760098a895db36b503fe540868f032741d2bb0f64689026c41920fb
- MD5 fa5375b37dcac6fe42fef3bdf95d7f6b
- SHA1 27e0d93d4a1b2b47b9a202912b3d4723c9c0e8f6
- SHA512 a9412168742c5e0e10b731af6339399f7bb3c8710d4eb6a80feef0bd358cbdcd0c5ff32eb893ce0b82a4d518591fd5620714a2696f06236d995334fa3c3376ff
- SSDEEP 24576:5XYVDtczAcGsqKKvFsmb4jc55o+O3dyeHiu+aZ2tdgeFr5:OtcDGn9puQ+/1UtdgeFt
- TLSH T10A25022873E40AFCFD679179CCA2D552E73378414B60E68B43E0AA691F232D45E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 996KB
- SHA256 59b6b80db9f97cf95f5861513ba1c66b7692c283380e00abaf2b0045b9e4468e
- MD5 f9764af8ea0def052f89b3540e6edcb8
- SHA1 139a45caf59e0d1f102d603428b2264e5ea215b5
- SHA512 4d215415eea10da5d2b5ca42d6eaef7b1f3d83705ae4430a679393671e4b7bae50f57229d040bcd8ce16dfee4d23bc7b023d9c9903f90ac7c0bb458b7458c684
- SSDEEP 24576:pwuROWFGsqKKvFsmb4jc55o+O3dyeHiu+aZ2tdgeFr5:pwGOQGn9puQ+/1UtdgeFt
- TLSH T14D25015933E40DF8F5A69139C997D176F7B2B8022B20DB1F47A0C65B5F632606D2EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 3.0MB
- SHA256 92f682d75de5e19152888c738377d53e6e55c06c9d9186c0357d08e20fc437ad
- MD5 5594718d226847e907f8afb12f5cce60
- SHA1 9dec762553406487e02840a0e11f875dd9c17f1d
- SHA512 a6dde421687bd4acce2cf23b23abee42a812a95df1edcf4995f57b0a17dd292ae38762b4c182b92c8c9fcf47770819157d46ba51ea0f019044950b2aabea6efa
- SSDEEP 49152:hB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glfGn9puQ+/1UtdgeFt:3u6JmTxd2dfSDuLIKit
- TLSH T1A7E5AE13F2D901E8D05ED578974AA233EA62BC490B34B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.2MB
- SHA256 c15ba2bad5d4604634c7f14d830fd6c8319cfd21d5a34855104c21ba932d9b33
- MD5 7bdb0cd50f8940b54eab6c54a6fc5cca
- SHA1 50c7f53d7b13238d99e5880a49b2c2f29ec8d393
- SHA512 9d9d1ede821695e373f4535f56b42eee765e1189e2f1d187f99888077a823bef1e4296180253460ae918b6e63ae7620d27be525b49640e0186dd16efaa65b00e
- SSDEEP 24576:Qlwvtk9RX6wkyAI6GsqKKvFsmb4jc55o+O3dyeHiu+aZ2tdgeFr5:nMnYI6Gn9puQ+/1UtdgeFt
- TLSH T14F45E029EBD845E5E1B7913C8DB7464AF2B178591B31C6CF029A53AD0E33ED05E3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.7MB
- SHA256 0df2d87cf9c8bef4accb99344dd9d59b1a729dd32b543c11e7d2bb97988caf50
- MD5 f6a7808a30b4da677bcedf759f3d9960
- SHA1 95f7d70f8378d09317407126abaa2809c57ff7f2
- SHA512 873d1be2763539fcc8da5038a1f207f0f4876032f1efe43924c8b3fb9bc99b140b24fc4120e47d3a39df1c54d21f2544130ee67070c641fe04e3808a5ca6f84e
- SSDEEP 49152:eYe3Npsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0HGn9puQ+/1UtZ:0ySzPfSDuLIKit
- TLSH T144067D56A1A841D9C1B9C1B98F1BCC1BFB7134090335ABEB02E556935F6BAF09E3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.6MB
- SHA256 3fa267d9a3aa300b023bd21a49c74497d762b68a45cdcd396f620d0616167af6
- MD5 dad3b03b7bd029d2dadd2a1d49a84946
- SHA1 e619ea0f17178b80c550e7c1d931b59668f3c933
- SHA512 4cf71275d7553e4f7cc63f35fe60ba4ac230536dacb92b9722fab51b6ec98fe36f76bd79bcfe2d588c587ac57c43383aab518ac2de9a92d31d74cab1a462c8dd
- SSDEEP 49152:Yo7JUQjXirIhCnDHUPfF/ZGn9puQ+/1UtdgeFt:XJtglD0PzSDuLIKit
- TLSH T1F675BF1DA3EC02E5E1BA927885159A5AEA71742E1F31CACF12B0437D6F23ED44F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 778KB
- SHA256 94d0b8b6a6cc1ca677a48716897f563354050f0b0e44ab9b141d6aa85dab9f22
- MD5 085f83f6aa411b93a7e8e89b8439613e
- SHA1 d72dcee4651476589c2cd45514678dab6d0938da
- SHA512 e54f95ebb4f7825103bce633f70fe9f732ee6c97cf153ae0300a96efa1d74fc3fe06900de6752ad503b277da735a431fc853ac37cbdbeec5fb2d7cc6a91f9b7e
- SSDEEP 24576:7ChGsqKKvFsmb4jc55o+O3dyeHiu+aZ2tdgeFr5:7CGn9puQ+/1UtdgeFt
- TLSH T12F05233553D88B3CF1A471B18D9FB1F6E72EA2528F10D443E9413AED5F829D04EAA709
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.6MB
- SHA256 3dc2ddfde41f144f3115bd020128fda516e3fc0b5faa99ce9c87034cf46e9cd2
- MD5 c49a5391c26ced5c4dbdb1f16ed5a805
- SHA1 bdd5bfc93695ff2e407e9ce503d56905a0cd7d7f
- SHA512 21ff4e354d5ac0c491a5a9dc7eb812ae852512cd6074d4cb8b38618ccad838a1a33563ab30d9ce2191535c25db8335aa5f2e37a79418fbc43a08ba992eebfcb9
- SSDEEP 24576:7gb6bmBIi49WNNFpg1rSvFv7bYtGsqKKvFsmb4jc55o+O3dyeHiu+aZ2tdgeFr5:7gb4mBIBhGF0Gn9puQ+/1UtdgeFt
- TLSH T11275BE1E22E802F5E0F9E2B8CDAB4417D6B278164731D2DF1151427D2F2BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AppVClient.exe
- Size 1.5MB
- SHA256 de1b995da4ea64b037e2549cd84f10deb724f7acd4d2f7d9e46bfbcd9826285b
- MD5 fce1627b77a5d4f261088d2bcc94fb0d
- SHA1 e2fcf3852e32c8e886526c26f718ecfd0bc1d427
- SHA512 72f078cdf9d1ce5165a063afe20c5ba84d89d34f356a8771cf889e6fe1a36ab36726cdee459a1a52d9de7414f3d4d921f40abd5791f01c512fb3ec88f4329868
- SSDEEP 24576:ETkNvNnaFeYhJNtmZBm1GsqKKvFsmb4jc55o+O3dyeHiu+aZ2tdgeFr5:ETMwBtOm1Gn9puQ+/1UtdgeFt
- TLSH T17075B02EB7F846E4E1FAC6B5CD238512E6727451073292CB9290C13F0E579D89E7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 828KB
- SHA256 f99a5b2b021ac63ee1e48a6dd64d35d70045575da6b8d645431e795c4b97e5bd
- MD5 e9ef14ce75b5919478688bde9a69bed9
- SHA1 1b793edd00959d77e412fad991a1194b45dbf0c6
- SHA512 78dfba4f42ea9ff4880c032b95c78778069700718f8ad287f64d4eff5d86e871326700358f8b851eaab5d02d9bb1f55ed96f4cdbd57bde1aab2d181acb56c2df
- SSDEEP 24576:9GBGsqKKvFsmb4jc55o+O3dyeHiu+aZ2tdgeFr5:9GBGn9puQ+/1UtdgeFt
- TLSH T10105233D23E45778E074A2B5886BB1E7F63671518F1094EFC9C1B6B98F819E0167EE08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 792KB
- SHA256 5daab011c9a424430fb16334f3f291367059a82963e00717ea4f44d6e8d25261
- MD5 ec74d598630b447092e82bfa3df46f1c
- SHA1 2a4b55e5bb72749e60f0b07fa57a8b848b758060
- SHA512 b8537d656225a8b4acba7aae17a2fd067658620f00b6d60eb33e8888d44b96247aeb3f126a4e4947d575539b240ed2aa59839e024bcf8f30ae6c3bf56d7318fd
- SSDEEP 24576:9ZWGsqKKvFsmb4jc55o+O3dyeHiu+aZ2tdgeFr5:9AGn9puQ+/1UtdgeFt
- TLSH T11705237953D48B3CF19471F18D9BB5E6E72A52429F10D8C3D8823AED4FC69E006BE609
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.3MB
- SHA256 45ef081c4ece6bb63bcb04cfe013944a9e4011b772986e8da9019efe5a618965
- MD5 3f6c9cb1053fb358d8c8d8071a407499
- SHA1 19004bcfacee2c6ffe74f8dd85179dfdad31bd72
- SHA512 6476505a37365594726576f08521ea025d9bdd163a49877b1c148cd8ccb4cf1f30300f367ce34398f3815bb07dbe5b1c2ae741873100290de3ec57dafab73c2d
- SSDEEP 24576:Irt8/8FpJqH1Mzria7/mbGsqKKvFsmb4jc55o+O3dyeHiu+aZ2tdgeFr5:uCUFPqVra7/eGn9puQ+/1UtdgeFt
- TLSH T1AD55016563E002F4E47BE138898756A3F672B4160720EFDF46989B951F13AE10B7FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 996KB
- SHA256 88f498c37c770473b6958051fe1a6abf9d0c6e7d33e1ffcbf590d2641914a2de
- MD5 94e00e87986354f457af0d50144ccf0a
- SHA1 204bbb7b0eb0cb09041e0a568557b5ff061066df
- SHA512 748fba902a8586c5f9d97d6b0af2ae748b090a5164565a1c90001821f57945a0f406926eab5ab2c9fee42c53c662c721a9fcbac327d1e98eeb42587256351f6d
- SSDEEP 24576:ZPUr+NQ6GsqKKvFsmb4jc55o+O3dyeHiu+aZ2tdgeFr5:ZJQ6Gn9puQ+/1UtdgeFt
- TLSH T1AC25F12E23E809E8F676B17D89869659F732B4520711D2CF02D1917E4F53EE8AD3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.8MB
- SHA256 1ee602207836a38353d8a9494cb83ddffaf235fd5c1b70f16e2fc6bf7c10b784
- MD5 ec726d8654e40700637dabbc4b29d6d6
- SHA1 11f1b6649112dfc74def4eb3d8bf404b87069837
- SHA512 4fcffe628d38ae89fcd6d62099dbee1ae4433d44406a1d90de17f591722a9e91019af4785259285f4cfa3deb62d6bc464cfc9140ea1e702d3f19e8d23c9ef004
- SSDEEP 49152:0BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj2Gn9puQ+/1UtdgeFt:XG05lO43b9SDuLIKit
- TLSH T1AAD5C06E62EC02F9D1BBD17CDAC6860BEBB23415033556CB02A486A91F27FF4567E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.6MB
- SHA256 933b9443d7a8536a3587c032ff8c59fab21de73713e325fc8b799a54aadd7b7b
- MD5 d48fc97ae5a8eb17ecb8f546316f5032
- SHA1 b1d6089a628fbdf98db7d912fe795b2faefe6b79
- SHA512 f278ded91051684e10f1c9be15d2e69c2c528347e99d3b8c4fe88a4c7875d45615520e3280f45a2bb03860e940d074000adeec26c3d9b27ae6d8ab4673d5de74
- SSDEEP 49152:ba5POZ3wJt2pasx2+mnGn9puQ+/1UtdgeFt:HUtSDuLIKit
- TLSH T1BE75B05EA3FC01D5E1B9D17DC583861AF571342257319ACB122182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.9MB
- SHA256 b01d2bb2552f0612ee86680e68b02ac073b83746cba69f837eb1e20746bdc609
- MD5 8ec79a72aa0e47e742da1f89b433c54a
- SHA1 6d75a988a7bc3d00e0cb146408e7e754bc396a8f
- SHA512 20249798e4c6a98d41218af62a40d7a75960c2e9621970475e01f669a32f2cad3e2557c3099cafe909c4c5c34a2ed2ddaac90b6e4fbe16f3d49fe38a5723031b
- SSDEEP 24576:QNcwHdjbyQ4nLC18lb/EOjowL7FkyGsqKKvFsmb4jc55o+O3dyeHiu+aZ2tdgeFt:QNc/zEOVHFzGn9puQ+/1UtdgeFt
- TLSH T15F959C2623E901E4F1BBE1BE89679546FA71786517308ACF0291851F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Sgrm\SgrmBroker.exe
- Size 1.1MB
- SHA256 26881ac55741eed25a452ed4cd51cde91b39e32b9ca8121cb5e976f59ee86c8d
- MD5 dbe1480de752580eca91eece0d1e3153
- SHA1 d1a6c8ed4f8d719f643e881584f72140a8470a3f
- SHA512 c8dc7b571b186bcf591ea083c2212d6d8cb968461ebc875c82a4445d320a41fd75445308b38e1b94ced96e188b1d2be49bc2679c4b23bea11805c2d0d199b562
- SSDEEP 24576:jD3FHshBIYQgAgGsqKKvFsmb4jc55o+O3dyeHiu+aZ2tdgeFr5:jDVHeBIAAgGn9puQ+/1UtdgeFt
- TLSH T17745F13DE79C04E4E57AD1BCCA639606E77234A90721A5CB42D091BA1F5BEE42D3EF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.1MB
- SHA256 c045da48ba17dd9fc2aef61f6997b50590e071399ec29db945777a2f852565f2
- MD5 180e871f272d46942decaf117db662b4
- SHA1 8e37b3f4b71c528bd218aaf67419079209046b65
- SHA512 52f1ac10af002b9c03d39521f7202fce73dbbe2d0d2898e6ee4c66b1a16110c8b516a9c7a3d8df98b3a7acda7166b22ac6519c99ac8405706e75e39d6cee317d
- SSDEEP 24576:nJnJPbzB4SpGsqKKvFsmb4jc55o+O3dyeHiu+aZ2tdgeFr5:nJnJv6SpGn9puQ+/1UtdgeFt
- TLSH T1DC35E13DD2A810E8E4B7D2B4815A279AFF31346D2F2169C759B4E5343F02EE06979F18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.1MB
- SHA256 06496237cd6fa621b2b756234587df5f3404ba77c0b51ee04e98ee3e9e157c23
- MD5 9f37a55cbdfeeb272e6a53309a493470
- SHA1 668ff1e2f73d9880238adc63e2ba40d2980d838c
- SHA512 02b1c73104e5724153fa598e8529c745b910a080242c13620a378f9157188be497dc9566c5d77e8fa2af38bba2875f08595c9ce74134aacf4aef514ff124dcda
- SSDEEP 49152:jCLHGeeV5ijCmlDWDkoGn9puQ+/1UtdgeFt:+WSDuLIKit
- TLSH T13EA57C15A7EA4284F8F3CAF5CA2694169A327C549B34F7DF4E80C96A1E32FD0D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 944KB
- SHA256 cb06f718a31952d31fc9e05fae93dc1cc6789eb307e3014c70d86f9654b082e7
- MD5 ca409573de0545734ffd6f5af1a57a8b
- SHA1 e89870fb45b3f5a4bfc73eb4faa30829e7c08cec
- SHA512 01ae168386ec48872de847904bca7ff2b87d29545ad427c455c88c88d27d6d8286755d8e45ec4177994544c5b29777028e36aebd09900ea740c382d8640b7a5a
- SSDEEP 24576:Q6DI3GsqKKvFsmb4jc55o+O3dyeHiu+aZ2tdgeFr5:Q6DI3Gn9puQ+/1UtdgeFt
- TLSH T11625026D23B902B9E067E07EC5835192D272B161CB1199DF8AC0E5BD4F93ED8B93DE01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 928KB
- SHA256 4909192d0f2a95bfe24c086676ba825df2bf9d42b1066a74af27f8b6e7a05dd7
- MD5 4f00efbebc4009729048244a38101ca5
- SHA1 75006e4d080508030ca31efa543ddbf9895f4209
- SHA512 b99841bbce3f266be81b527fabf973b8cf92c100de8a356409bafbd5757b6e1bbde573b28b0ff781a5b42b92e37e171aec627cf00de85fe918dcc56f49d3d9fe
- SSDEEP 24576:Rty7GsqKKvFsmb4jc55o+O3dyeHiu+aZ2tdgeFr5:RtuGn9puQ+/1UtdgeFt
- TLSH T10515221413D483A8F1B821B48EA7A2E1DB3AB8119F2096DFD5C1BB7E1F72BD05935B05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msiexec.exe
- Size 936KB
- SHA256 2b5c8efa7ae805fd56ba75ec6ce65aabbb3d5051fc47e43dc6ecfed3ec63172d
- MD5 7bb922a1677a9ba82ec59bb5caadc276
- SHA1 45461ef77a32b197a45699029ca3f83306b89875
- SHA512 070ece6bfd642091ddde11cfe1a65a288ce8805b483bc0d0080d61aa4a99874ebe8347d0b1fabb6579e687d39ce0b8f0276a0598dd15fcef49ba3f02b6bdcd83
- SSDEEP 24576:76UqjpkGsqKKvFsmb4jc55o+O3dyeHiu+aZ2tdgeFr5:76U7Gn9puQ+/1UtdgeFt
- TLSH T1DB15126D13D446B8F07461B0C96792E6C235B8625B20D5EFA5C0BABE8F72AD0463FF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 800KB
- SHA256 0e5d540a5db1e9e2e2a7bfce8386710de388d104b82ff4ca527036f3527cae03
- MD5 b20869901b91fe09bf17444cacd4eff3
- SHA1 6bf3d3769c033393da943f4b204659e701b4a10c
- SHA512 865163e931030793a537a6afc5294e8cb99145f30449024c2e0f159a56abc11945ee2a63d4016f5bc545e709db368e8cf2597298625a703fdd0c6d9eb905bf8b
- SSDEEP 24576:3pGsqKKvFsmb4jc55o+O3dyeHiu+aZ2tdgeFr5:3pGn9puQ+/1UtdgeFt
- TLSH T12A05237C53D8873CF154B5F1499BB2E6D33A61528F10D8DBD8C17ABD8F869D0067AA08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.4MB
- SHA256 6e007756e1b051045c77e1961b0975c3b6840f9d78f5b9d1ee4d0de8b1774326
- MD5 27806b1031d2b9c9a92f5f52b1dd2a29
- SHA1 857ec1e3e891a67476dc40b34e9fa858ebfee51f
- SHA512 4c74a8aa72a6342c5a3a4e180b52bd1c2239978d8a3992b013a3213e5b9b3da2be6fda11b86dab89fcd48408c45d513b0449a1c00f98964777636f7d7f3c1b5c
- SSDEEP 24576:p0gILoTfaidZ6GsqKKvFsmb4jc55o+O3dyeHiu+aZ2tdgeFr5:ygHTrZ6Gn9puQ+/1UtdgeFt
- TLSH T1B865AD1D63EA06DAE2B2D275D8635493D633B4315772C6CF2448C03A4DABED8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 960KB
- SHA256 a1fc3e4827e4b11cde07a494ae43f4d29b95b38c3af84e42d0a3ebc9de24d688
- MD5 fa8046740269e71c0333eaff11ff7312
- SHA1 9cba32fd7592d95e6cbb611f6d6f544c6cc3c3bf
- SHA512 897b3d2ffa7cfe0e8cf77526abf0f73fd04b26a2b85292d4e25c5e4b3a35682b6e0cc62626d954d4e5c0884ee1c1e053a7a53de0e6a5491ebf5328de78082161
- SSDEEP 24576:trcmRcGsqKKvFsmb4jc55o+O3dyeHiu+aZ2tdgeFr5:5cmRcGn9puQ+/1UtdgeFt
- TLSH T15E25011EB3AE01B9E1B7917C8C864296E77370315B11A7CF829197BD4E479E87E39B00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.2MB
- SHA256 13369728a70557407cce33b1700c69461d2bf7d9a822d1eb59645ef2c25c491e
- MD5 009351abac2b51f6a1d74c4510a662a2
- SHA1 f264f0f104149bcbe1cd76056e4daf01a3dd04c5
- SHA512 b319ccb3af3a7a4da6b3432d686ff693c4c7c3a19bd2af4f536ee03cf913489d1d2bd4d701294461dd4b75328c8baad4633d59d489864a0162382a4f4395ce9c
- SSDEEP 49152:SDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3WGn9puQ+/1UtdgeFt:T3Upow8sBFSDuLIKit
- TLSH T119B59D3DA2E800A8D9AAC379C54213A6EA71742E3F3055DB0174C578BF1BDF19A39F19
- MD5 SHA1 SHA512 SSDEEP TLSH