cdcc4b0b16ad08f90d4bb691ea9df22314d449703a395f4079754d801755842c

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/11/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
Size 2.2MB
Sample261101-2c2wvsfv9k
SHA256 cdcc4b0b16ad08f90d4bb691ea9df22314d449703a395f4079754d801755842c
MD5 9ac2593fb366ea1cb3842211fb472f36
SHA1 9a6211c2b9af1284710b44ca1958db4f0d803c9c
SHA512 7b7c286e81d73ea91fb633ae7c504ec334523a29a7f0dc3651c27c011f0079fe19b6f3b752b2acb90302bf3f0475ecde4bc1e5299eb4233cf3f5fef3d50510a8
SSDEEP 24576:kIClp7MfqsqjnhMgeiCl7G0nehbGZpbD5GLoYFt9cvbjpf1kS8SeyXFxKk:k3lZtDmg27RnWGjIoYP9c/3kS84FxKk
TLSH
T149A51211B7E505A8CE7E193808E66B708774FC544F3C8B97A334ED1E253A7909D293BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2476	alg.exe
3912	DiagnosticsHub.StandardCollector.Service.exe
4784	fxssvc.exe
2240	elevation_service.exe
3880	elevation_service.exe
4420	maintenanceservice.exe
2112	msdtc.exe
2636	OSE.EXE
4980	PerceptionSimulationService.exe
204	perfhost.exe
1920	locator.exe
4468	SensorDataService.exe
3328	snmptrap.exe
628	spectrum.exe
1640	ssh-agent.exe
3180	TieringEngineService.exe
1228	AgentService.exe
2608	vds.exe
1736	vssvc.exe
1976	wbengine.exe
4564	WmiApSrv.exe
636	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9d750d84862f6ed0.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2980-0-0x0000000000400000-0x00000000009A0000-memory.dmp	upx
behavioral1/files/0x00010000000233fd-436.dat	upx
behavioral1/memory/2980-480-0x0000000000400000-0x00000000009A0000-memory.dmp	upx
behavioral1/memory/2980-523-0x0000000000400000-0x00000000009A0000-memory.dmp	upx
behavioral1/files/0x000100000001678e-518.dat	upx
behavioral1/files/0x0001000000017032-517.dat	upx
behavioral1/files/0x000100000001780f-516.dat	upx
behavioral1/files/0x000100000000c53b-514.dat	upx
behavioral1/files/0x000100000001742a-512.dat	upx
behavioral1/files/0x0001000000017046-511.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104187\javaw.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.INI	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006991e02c506add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c3644428506add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e57b0b2d506add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ce0cf2c506add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e7fae2c506add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008cdd0d2d506add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3912	DiagnosticsHub.StandardCollector.Service.exe
3912	DiagnosticsHub.StandardCollector.Service.exe
3912	DiagnosticsHub.StandardCollector.Service.exe
3912	DiagnosticsHub.StandardCollector.Service.exe
3912	DiagnosticsHub.StandardCollector.Service.exe
3912	DiagnosticsHub.StandardCollector.Service.exe
3912	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2980	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
Token: SeAuditPrivilege	4784	fxssvc.exe
Token: SeRestorePrivilege	3180	TieringEngineService.exe
Token: SeManageVolumePrivilege	3180	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1228	AgentService.exe
Token: SeBackupPrivilege	1736	vssvc.exe
Token: SeRestorePrivilege	1736	vssvc.exe
Token: SeAuditPrivilege	1736	vssvc.exe
Token: SeBackupPrivilege	1976	wbengine.exe
Token: SeRestorePrivilege	1976	wbengine.exe
Token: SeSecurityPrivilege	1976	wbengine.exe
Token: 33	636	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeDebugPrivilege	2476	alg.exe
Token: SeDebugPrivilege	2476	alg.exe
Token: SeDebugPrivilege	2476	alg.exe
Token: SeDebugPrivilege	3912	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2980	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 3608	636	SearchIndexer.exe	109
PID 636 wrote to memory of 892	636	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2980

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2476

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3912

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4168

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4784

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3880

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4420

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2112

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2636

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4980

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:204

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1920

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4468

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3328

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:628

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4860

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3180

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1228

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2608

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1736

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1976

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4564

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:636
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3608
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f0e4a446194d95a17a04c84b5bcc574405867826faa6819597d8d1eb171756dd
MD5 55145694680a8d5cdf57d1082675a6a0
SHA1 38da402117236202f2433c9c6e4f1812e61e8925
SHA512 26bdc4e248ef51eda4df069661ffe15e195c47eac5d90a9c1b2909d074f659042a5a133d24726e361bc78fe4bc37fa3b3a0b17de6e8a14042bd4e6b3cc1e679c
SSDEEP 49152:5b+632BuPkFKRrdE6ohvstBhuXjfS4LWxniDmg27RnWGj:P3q6sjBlD527BWG
TLSH
T1B3D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.2MB
SHA256 2e3e84db31cf1970d5138c24a0f8f7a0ecee8e93443626481b668a411e26a986
MD5 541b4f74e067d93f87bab144cb29bb80
SHA1 44fc48f6635e003a20599bbc486924168662309d
SHA512 4aa783ff79ef36fe36c9b5c14d486ac80340cf65748eda967cf471ce816471e1dd2185bf98195bf4daff9ba55ceb12034253e3aa45177ff48172cbe0ffc8146c
SSDEEP 24576:gXYJizczAtsqjnhMgeiCl7G0nehbGZpbDFGLoYFt9cvbjpf1kS8SeyXFxKk:czccDmg27RnWGjcoYP9c/3kS84FxKk
TLSH
T105B5123973D408F9EC63817CC9E2D405EA737C558764EA8B43E0996A5F236C88E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 cbd65cf66f883c10167f5e9a8f727568648d28b6654b644e7c4f031b11d988c1
MD5 58e8dd4a825102bd851d5acbd9462bab
SHA1 63e6b6c50422313c5a2629798c544e9de436a5fe
SHA512 50ffba189aa04180bc2ea6341e5167ee463cb9ea30cc7be1fe9405164b46b4a53fe95738df2f327ad88c04df39d984d40a71a57715cf35398d9135e6c91f40ec
SSDEEP 24576:qXYfDtczAtsqjnhMgeiCl7G0nehbGZpbD:xtccDmg27RnWGj
TLSH
T14665F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 d64f1017ea242fa1a529bdcfddd93193407e3c79f167c36f9c7d4b1ef2638bd9
MD5 aac029c5bbe1b4a899542248c5943986
SHA1 932eef39f29fd933465cb2a73fb721ced0410777
SHA512 76c9e3d0980265de72a22090a4f0611ac55eda60666756cd0959dfad895fdb6c457c502524b2badbf7b6a95187f0a2e2fdfb1baec5aee5d229b31c5e022222cf
SSDEEP 12288:WeBNUbTVO86UZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:WJIUZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11465CF7BEE28FCD2C27A8DB85791C600E76278314F6193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 709ea3697b64e9d7d02ff2e77217ccbff1633061616bc514b19fa207447ffb26
MD5 39f65da91d20d3a3af953e922c3bc3e4
SHA1 0e39f848469e4ca2b75e5972dfdf12a1d966e43d
SHA512 5c04df05fef37fe1a62f7668988b2b861e519f2a16a2d42cc69fcb071e917f3348c954edef022827335f5c6e297a12d0581bc8f158e087657c38511a100f6919
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THo:SQvGAdlCEL8c/DRNw5C8D527BWG
TLSH
T13B266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 d8438a48253ad1141106bfa9a3688bada98d04e0acf9a730d2e3304314f2d8fe
MD5 c4ee07efdd058fe54544ebf01f86c176
SHA1 554ba1a8d5e3292413ea7e27e247dd1d1409e1b4
SHA512 de9c9902feae85d2ef4643e5519e57c880fd989c2b546c9654775df9820e3bb9fae85f43b76bcc2275eb458a95eccd32774fad1c60a8a27907598412bce157af
SSDEEP 12288:MAwSfxL/2Dc3RDLLmt0LDQewsAjTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:x0ewsAjTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11E75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c17093b993ecb4d76e7f935c639bdf1325107a3ab6e52c6a804949226d5ad3e2
MD5 b4136b91ef029d2e52a0960797e8c804
SHA1 b615d660687263b3de9bb8ce4ed1b090592b8c21
SHA512 d493af7873841b03af00122718c47914d4a5e3f3f4a880e0c4acd7c41db3276fcfac2674acadf199ba227bebad1201e4a438e60e1a8c82ebdd772a58ff4c84be
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHPVQBWG:HUEtQevvqc2W1cpV2tI32GB
TLSH
T195474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2d7ccd88c5e2d0d5b7dd7a3e4cd30af0135465eea48de2c1841929c149d0b3cc
MD5 8b2dafc55f00e9a74fbaffcc776ad594
SHA1 326c5ab18d6f8ffe13f83f308d85e873c87b5f42
SHA512 43db7196628f721ba289bc123d386198a4ed4c3704b5d55f56c04d9193632d0a546f61cb93226b74cd3b9d0d8733c1ddaff27ebfff8708e73f21e80e93b9672c
SSDEEP 24576:/AhGL3IFoiwtA5l7S53ssqjnhMgeiCl7G0nehbGZpbD:/AMUFoiq5IDmg27RnWGj
TLSH
T1D9359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 195dc7b03fa05685258ec302716fd78d31645e4d35f54ac29016e9d33bacdd03
MD5 d3df32adec05778b43e6f06dc61c9a7e
SHA1 cb3e42a723be81463c03a5f8782c6943601baf4e
SHA512 3056fb574834745b9e96704cbcbfc6fd795bc3f242a2172d2aeb525083f08e52ac11d2689801e33779f67b0090150400485fe73a53da848e66728d16543ba9ec
SSDEEP 12288:kmw5HEjsChNVBFgl0WDm+CQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Bwu4OWfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12C65F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ad7af8d5108a37d37e96006b71f346d1f18c4bc8c3016b05935242bbb0f8cb8c
MD5 615b45b062d0d4f5efacdca170995ae3
SHA1 47b7ecdbe6daf090a794602a6c7843ca99da1ab3
SHA512 c8ad8efe058f99804cd1c7fe325af5695aa9d2d74559173006655a5c6cbdb161733a20f65a9b11a2f875d3e64828537d1bd59a3aa7a2869112486ceccfe16162
SSDEEP 12288:7eZ1IyjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6ZuesqjnhMgeiCl7G0nehbGZpbD
TLSH
T11B5512AA239820FAE163417CC5E5D609E7337C62673043CF16665AAA6F739C44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ad4bea0b8a06cce2ec99681a513a3d9c4a8cfded433a864d82f85d84f1a0a2db
MD5 6d11f2eb317a2814e4e23c8d1f2d802e
SHA1 58d55970e1a969f7e7d35bf9cc36600de715fd9b
SHA512 4d65759dc4f300f2cb5e6f5656e867734fb7421af1b9a72164c050b71ac0cc32cc80dd3c3a6be4b888f79c0de3ca94367c52b0b22b6570ad1836a2aa4d82b13f
SSDEEP 98304:QQRQyi36YOcPbLvw2gAf+PN3ZD527BWG:HQyiKa/X+PNJVQBWG
TLSH
T1F5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d1ce757805126a4160ad8ce85f2dced2d50d1f332aed49e7ae323e9500631a1a
MD5 e3e3c5388ae5a61f2d6a1a35920fe083
SHA1 2a7e32677f88cecbc6f1ef43ea79a9684d461e32
SHA512 2b946b82719fa6201ab5e6124ccf1c9d9adffd78bcc4cb400a74e8f0e79a1947a8514a509bfa1819da14a8968443d1d69ede1766fe9b1dd4e35419d6007fe4e5
SSDEEP 98304:RQRQyi36YOcPbLvw2gAf+PN3ZD527BWG:IQyiKa/X+PNJVQBWG
TLSH
T19E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b59e5d80be630516c72573c1283f5e8e1e144cba9273ab08bc18666067710be4
MD5 ff4e499ec7c5af9f6efb9592b849836b
SHA1 f6362e0adc8caf2363a3518136b6d739ec8d701a
SHA512 2c0f7e3168575616398583f795126cca583ade64f909d82cb51b74e19bc4206f2cb090e5690f98cd6a07b8cea9c8d76fe9cd37a0c8d36fa33440a4e4d2fc19a9
SSDEEP 24576:RwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0OsqjnhMgeiCl7Ge:968Qg55nhceWu7PNU3/HDmg27RnWGj
TLSH
T106B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c91ecaf8df89ccc9a1f9a5bd303c73f71f4b909831bc286b57b16793a5fe3e88
MD5 bf0220b3bc3483d6395f43da426d01c5
SHA1 5f0895cd943a5355a82e1934e4a12e37f964278f
SHA512 7f1cd04db942b884bde8ed0c67202bf0ba1c857fc391e05a3bd7348725f1156d4691e87c9e92db7c659de87a9192af7d8be2fb9d597463e7b219faeaecfc6aec
SSDEEP 98304:ay5112gYy5azzVvt69nLKnhZuD527BWG:DLIHEWhwVQBWG
TLSH
T1A4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2670c79ac13875e6be779dcfc49aedf14e0c3a99426afed66361f6aa27a007d2
MD5 2c3e987cba2ae37038b580dcc1f24d2e
SHA1 0560eb7a29279ee4fd2f474a37853c044026b63b
SHA512 350609af52c0af5734b26cff584f67eeb5ecb5f4cf8ecf64985160138af198976137a56b442564d43a7539951530dda0fd88f75f537ac2bad0be982baf6fb7d4
SSDEEP 49152:vB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glBDmg27RnWGj:Ru6Jmdxd2dBD527BWG
TLSH
T101D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e799706142104d6dc367b13cb2d6f950dff801296ad0d98715aa86647f7a3f86
MD5 3cee922440d5ff9f13a02c49998816ef
SHA1 33c5efe1c98a7d051398e509c3c8ba3a51bc519b
SHA512 6b0d8d7d668c47ed76fd80fcdd1a49adb4bdd909b2321e9904eaafce51d08a7228e1d6f5ce91635adb1e7e1650a950d5c639d353e9450781be35b170255a847d
SSDEEP 49152:I1hpsNoJpF1A63U44CwH7R4x9Dmg27RnWGj:ImifPWR4D527BWG
TLSH
T15BB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2c0f1649002587bca2be2c9c988b1c410164e483955bd51d4eee859d37d16709
MD5 d9fe8bd68d87750003d59c8054849e5e
SHA1 953772297741b6ddffc575f0fded6dffc88d24ca
SHA512 20218d50e4eb9a740047f026754b2b7ab61751fcff24dd5f1b0a2aacefd9aac340067ba4dfdb454e44854ac186d1d2a65136eb0ae14731855c34847bb1c1f98f
SSDEEP 49152:fSuZQIY0Be2KcRVtOnks6NMHqyDmg27RnWGj:l5dKii61yD527BWG
TLSH
T11CC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 172a4d4122b3132b6e104d98cb4c2565fd62867600684d72551b580b16218ade
MD5 2c9afa0986ada3a18f524735b8b33cf8
SHA1 985700cb9caf00695b90710813dba784e603f2da
SHA512 ca374c497f62b39dfc1c69cf6e938191e3784cf7812f5b5349e125dce8fad6e569e174c5daae7e2a0bf8c9139fb1bca2675b6ed4eef3cb0d716806f2943be886
SSDEEP 49152:LhtSn8EApI0fig3giDn0AP5wRDmg27RnWGj:KX2imphUD527BWG
TLSH
T1B295BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b004107783b4548eae02ea447f9d5844788efb73026622a1ebd4bf968e8f4338
MD5 ed635d30f4e7b97e3b7165e655b2c239
SHA1 8485855cfeecf70c91c9219764f9e41969d660bd
SHA512 9254d0a38ecd6f763dea7341575bbf692d2017ce897e47d50bb21debd5d0b8ea487e50861a57dd20fe1e2af8f48d9ab45f521c240e0c0011e111b2d46ce2edd1
SSDEEP 12288:rSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1624523BF964C41CAE52648B5C3E5F14DAC073E5BE92004937A9B7CBEE7B24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f9a43960e5959a1f7a8cb226442240c848aa4c8a2dc88fa3e59f616bb31b1709
MD5 bb711f3a15cd7dfdb961ce4f9ab082f3
SHA1 efa2419e19d45c098a278a8f40c8dfbf9056a038
SHA512 e7d849ac6f4d5d99c21686f6026baade082703056ebd0b67476e32716edc234b522bbe5c77455842ef6cd09289c726f41aa7f73aaec9ea1090c757560c78f3f9
SSDEEP 12288:NnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AA4523BF964C41CAE52648B5C3E5F14DAC073E5BE92004937A9B7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 b9e77da0bc6f3cc0358a6f5290bd4a04ce0ea9cf2cc3a4c40350c4a258d4f388
MD5 d64434889075ddfeb79c7921f92bfef8
SHA1 f9c78222d847c512aaba31159156d557c7609318
SHA512 ef6da1f070d88e18b4d296cd072ca8e06fb6daba1c6790b50dd55e61b37d9bae23767700c58c18bd6de8fa1801f83d5d4d0a5c6c930ff1c7d09accf4f57afc18
SSDEEP 12288:wRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18C4523BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF6B18584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 13c45fb2e43ab56402ed6fa4cb0aa9d410cd977fa52abd7152f993a22397a1d7
MD5 910fecf45123a80f6ea6f790835a7dd8
SHA1 2e0144845ff1ad72c23ef84f27bd889ff65de227
SHA512 a6f9678d9e09e9a6a5c2b96e8a7b26027d66d41ddd6b4327be2b980df9cac35cb2127b1b37f73ae855bc109dd4699f6182b6215d227eb427fe321d408d48aaae
SSDEEP 12288:eVMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A745236F675C00C6D83685B4C2F5E11DE8237D96EB3005DB6B532CAE5FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 b517a8478aa0097e01aa425aa65c288348698235fb0294f46c0063df22ed942b
MD5 eb3760192e43dcd5d43312cb85c8697b
SHA1 0c8d26492d9d93cfb8a02b90f4dc64bc1efc2769
SHA512 a6e56523c8b16960b17dd19fb5cc3db4e7ae976d5b364c51e1e830664dba7529d4a7df5224c350bcf2f21aa826e6b95e39e0812be06c525020ade8fe931524e0
SSDEEP 12288:W0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:W0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1884523BF964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF6B24584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 41b049f5ceb6d0a3fedf25dc9ea935764ddcdaaf2f6495c461ee5a113a198f72
MD5 168541cc0fe8aef419dc3f505f0d6216
SHA1 be4ac7aaff2a01db7bf39dcd9de958983546a81e
SHA512 bcd43fed9dec57d38cff23f85f4f2daa6ff96146fdffeae30ee36094a7ae2759187f2334ca85072b9d5afea73fce8825903bdf7e44e20b9655f47f7c372f147b
SSDEEP 12288:JrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12B4523BF964C41CBE52648B5C3E5F14DAC073E5BE92004937A9B7CBAF6B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 405f36a6c8958455a619ca244b3914a298cd61e6ee4302b406ff29ccd2fb657a
MD5 0ce39da25e36e4c7cca06774036bfe9d
SHA1 64e2171926f797948a78ffe1bf4a74101959e70b
SHA512 b0cabb3b68b9f90cc50e7f4741e579620dbb134507b896df0ac0897ff9386de9ad7165ae416f429dbf4165ee0e8a251a37608e730e7e344b232720bd84a548b2
SSDEEP 12288:sPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AE4523BF964C41CAE52644B5C3E5F15DAC073E5BE9200483BA9B7CBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 be3de5fb19fef29ba8367957b53ca52d8d95f721ef54159552291dc41d3dd1cd
MD5 dfa6ec956014c5c24e2f5d290e48e9e8
SHA1 3dac3691ddda4ef3a13c32e45e0685fbbd80192e
SHA512 91f94c9a2322bda4721445c60f4c3f7d9fb3f7fa2146fa27e6d4bed93df3c734cd25648f047b6363527c08503dfd7a06e881b46168a8fc7497e9b748f1fb29dd
SSDEEP 24576:jZMRzFVSOHsqjnhMgeiCl7G0nehbGZpbD:jZMRzfvDmg27RnWGj
TLSH
T1296501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0d8db132233f133e28d20a9e2d589e65b5280458f89838ec65fbc21f3caa7884
MD5 ed3224142c7f3985a67987c7329ebdf8
SHA1 1e5f7cbe9d0abee671dffba89ef82da71f9b00fd
SHA512 25868d1bcdeb70320693b2b70451a4a85416643e41b574e3516c8f57cec85e813a352508ebae723ac2887e7934431fc8ff36fafd9bcf5dd384086af6b7955a6d
SSDEEP 12288:xuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A54523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDF6B18584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 fcca3276b03b6df03c36c227d0a79d74d1c5475705fd9f8798f0a7d5e9ae441b
MD5 7e6d4f3a0d92a93e8993f7bcc67bcb07
SHA1 6245c91004076a805e8e4075aec410b2b0e2d2cf
SHA512 ce1be1b5e9a1142d680cf7c0c5d3e0b88c18aa718368ab891ffacbe5fbdbb87390f832fc5865e0cfa30dc31e3a042bf91bb2f2f1c32d0a70505fe50c63754582
SSDEEP 12288:oqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D24523BF964C41CAE62644B5C3E5F14DAC073E5BE9200483BA5B7CBEF6B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 9d1a04ca7b5668342e58cf429abf40d40984deb605da97129632b44f895a9cc3
MD5 711ca0795432530a689c598e885c3002
SHA1 5d5a093cb20f846f00afcb8885594172362b97e2
SHA512 2a096f2e11639cdd2b13a20fdb5bbfbc6841df0bd0e5ceeaf20e154c72dc25079c0ee09c94748672f40aa3f88dda3a500c81194da1e312c5cb97edeb5e1bfc96
SSDEEP 12288:qyPz5L8jXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3zyjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DE55125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 41cce7675d96c9b27cd8c2aa16ec0b3040c808897d47e1bc61472c944ac7ba8c
MD5 b61df73d44f4c7a25d0f2b3f61dc3358
SHA1 0e1763f80cb7847cb27e7d2df00e64615ba568bd
SHA512 1d0543c335a59868c60baf2d4b0c6032278bf7640491cacc62f8d37337fe4f73edbb81499a5bb5fa276cb2a74b8a4bcbd9c30dc4060fe11ebeef1ac375e36562
SSDEEP 12288:euXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AC4523BF964C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDF6B18584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ed2fa5b10c6316021be64ecf2d6168be20edf1908dd977b51de32b9b1dd5bad5
MD5 5c23700c58dd35f4bf6b6cc92aa47aa9
SHA1 8f78ae569f5af5c7141603fd2f10c23e124206b7
SHA512 7111948dc0cc258d9989c394c08e46489cb4d15584c6d948d5bc90f82d48c72642bab752bcc5b617312b0026dc2f0d09a0290761f12db8c02635d67cdfa40e31
SSDEEP 12288:zuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1324523BF964C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDF6B24584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 aa11b958f60863b5f04b8bd91fdf7813999e91ba75a95f94bc7426f4ccbb325d
MD5 240e80b5dbb68c000804dea5e77a658c
SHA1 1f0a86f2a9116d6681c2e11a99f0d9de2c510de9
SHA512 03735a0ba7bed38c31902d6571f71622081f71c684bfa28cb44bdc84e569f6d21a87a57e39afa4b386de49404f387539480c019b33753b3be65d52918bae15a6
SSDEEP 12288:2yPz5L8jXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LzyjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13455125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 2712903bed15745b410bbafad3d4310752fd6f07dd80e7ad859f617b0bbe6e0d
MD5 1b91c5d2d6bc3a8e088791a9e231950a
SHA1 3ec8a1a9fe444fbde3a83c433ab52a22105d8cbf
SHA512 a8abf60a1155bdd4e48f2c6552bbd6cc4f6838b2265825a2cbe664406e2a1174f4bea93be2c8fdb299d84a8ebb96797aeb2a9dcfb1b9185a6e0040af7f22d0a2
SSDEEP 24576:iTDaLl3z0zDBsqjnhMgeiCl7G0nehbGZpbD:iTuLljsDmg27RnWGj
TLSH
T11F6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 a865ccb87c15fc4a43dec55f5af18c872d666cf0e54e08ef85c2f9335c1b8740
MD5 1243428c689163acc8346c4c12117d5f
SHA1 e4b5926d9715bb182ce89a28b52fcba75f47decb
SHA512 9d4b608b4a28be8994adef3c3da82930f2d945aeb017c9a8203253766789fe367779db681030b0ba52eb7de997c75afda27524528688bbae7ecd99386474b953
SSDEEP 24576:G3vd9CHKy7GZFsqjnhMgeiCl7G0nehbGZpbD:ovd9CHKyavDmg27RnWGj
TLSH
T1FC75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 6c82b8146d01a0e3dcc84a5ca08a3da5e15fdda3b439f24c22d46d4f08162473
MD5 52d4cfe8f6c25460750911cd1aa2074d
SHA1 80bb66de3a08db78fd168c28e9bb5e4f2b21175a
SHA512 b402d90fb932d20616530f6503a563de90077840f8891325f2279eed03aae3c570f3a21d800f26fb9051352d99bf7b7897c754712935c45ab87ceae8643dddad
SSDEEP 12288:YxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1404523BF964C41CAE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDF6B18584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f29771ef5f29c12e186c49f989fdbfd723aa424555ca5489c931a053c67aebd6
MD5 a66a48b6f18413152297102cb490887a
SHA1 1f6a792cf5286bb489ecabd0551c4284ff71adea
SHA512 62acf7eb214370469b7693a35623b1bb4736c665140d3a8eca5261c9121d893ee4ed50fedfe859cec48ebd0f9ae3946e3b779db3ab579aec4cead19cf6aafdee
SSDEEP 12288:4DXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4DsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1234523BE965C41CBE52644F5C3E9E14DAC073E5BE9200483BA977CBEE7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 5d397d57c9856270f4d4bb253d63d3d408868c56ee797ef688db19b4d66bb927
MD5 d56cd30c1d00431b7a92bc5feade79b3
SHA1 81e4e0866afc02051e9389d53863f9559ae5316b
SHA512 6499ad1f3fe28c0839be180519ce4236d77a5c31d0257df6aa60c7e8f3dc20ccbba3c2feae6025ad7cd02c8dc6a4a0ab3a1ffd01f0da1c7f1e4eb058ac8b522c
SSDEEP 12288:/4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BE4523BF965C41CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDF6B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 5b5788f43cbc637d90d83d29f32fbdf3bf6c3e1fa5046027584e6736056725d6
MD5 d32b5c97891ffadd166bf998360b974f
SHA1 a4e6d0e3ad13ba900ebca8a1d49877e8445cb217
SHA512 5a0158f900732b0a067ddbb295c4c39f74f4af8cd9fbe5aa600bc237f3fc40863af9696f73d11ecd54154ab035c96b29055b361c832290e1d0bc845ab0c3f62c
SSDEEP 24576:2cP4mcvIjkGOxhKP2l71SNKbrh/8KB2sqjnhMgeiCl7G0nehbGZpbD:RP4m4IpOO67N8K8Dmg27RnWGj
TLSH
T1D965BE2DABDC0096D0BB917886658A49FAB1742A1F3286CB1160933D7F77EE44F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 41a0ce2ed9be1d266c0fe72fe7cdfe52de787508dbc693c2669691d42a77528f
MD5 214bc58851b4fc605b454b0bcfdda01e
SHA1 418130a0afeadf92d99949b52fc90f929f163b5a
SHA512 55a9de22c990e6f60e639dc1b1724853ab605744fdff554acac33a1e4de32817fb469cec609323e32e829d605a34546aeca4efc0911392bf022e44e38127350d
SSDEEP 49152:+P4m4IpOO67/8K8Dmg27RnWGj1oYP9c/3kS84FxKk:2ppOOiuD527BWGhDuw4F8k
TLSH
T147B5D02DA7DC0096D0BB917886A58A49FAB1742A1F3286CB1160933D7F77EE44F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 640a53c134c9e2820fd1b91234b5a2a0f2351e7b59d7ff5c07b08d3611a9e171
MD5 1010346544d6a26fa32233a6723cb0a5
SHA1 f131b92bf2681a5fb4aa6cf3cec99fa22817a1de
SHA512 f3198bb0745ac76f46c9109cd65e73a13fadf47ff829ec50568828713718027a2cf9f75cc000b5056d27993c44126345bd5a853c7a0f6434fbaa7410d4f9e117
SSDEEP 12288:sbsfeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CE55011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.INI

Path C:\Windows\2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.INI
Size 607B
SHA256 ac506ab3b15950f6a20755c864b1a63ea94a499234e6dedabd614d3fc5b030d3
MD5 8db9581389067377e5f22f519dda6eaf
SHA1 6ee69a96d6b9154132d19c4b962abe1f654c3d3d
SHA512 c001ab763a8f38d5137bd1bb5502a90c753835f9cae26e3b34a30ae12c3c028d85e47066382c90258a866177e24ef4122e09f6e2dfd6719b42cf6a057092d22c
TLSH
T1B6F0D575680ECEE54077ECA6A02739540FDB83A34871A9D7296F31DF0F732AED505889
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 89d1e6a0db70cada649451c86c27851943640d21b687445d365dde89b80e6413
MD5 10de03a3424b156382a0fa18a8326aa9
SHA1 0ae7f57b79a29cd1d249d3aaba5c4ad384698da7
SHA512 bd310dc2d362eb3a82378485dbaf8782141d986063caa8c24301d300cb1795e29e201f35d304134dba8b85038798215bca772717e4ba357a1b021c59b338e1ed
SSDEEP 12288:K+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:K+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15445237FD34C518BE57659B082E9E12D780B3E669E204483B9477CFDE6B08948F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 890690d06ead78b6a1a36d936d0250425f495af127f4e7bd21fbee77f18c55c6
MD5 79a1b66bcbaf77f8e27c727d9e6cfc99
SHA1 e9b4c7520dfc0825879062b3c8314378f1ba5d45
SHA512 a7cf8bee343e255eef361262ebb837fbc226af0af8667493bee622f608519d5271cc4b4aeebadb3f49336a651dde1ae91d58450004973ce4b4fa92bc24b9ce35
SSDEEP 49152:Oa0h2GEkuAe73q3pp46zwwQQDmg27RnWGj:Oa0hNYG4JwPD527BWG
TLSH
T11685AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 2.0MB
SHA256 8bd8ab66943e3b0d6673c34960d5d4bb754262a42d2211d45f338030a5399b11
MD5 67cd7ae33930211dd0cd7745efd1ab4d
SHA1 fda358c90c4aa49a2fd4e145bcb4ed92dcd57e5f
SHA512 e7bd31a7dd4356ff91d6d015d82413450ca3fcab2b59d58417fbd387de75ac175cc4fc79254b5bd8cf2d2fde24b378a721117d8209a44b7a25fdfeaed5d5f77d
SSDEEP 49152:3TDxR+N5YzT4jMdDmg27RnWGjgoYP9c/3kS84FxKk:nu5mD527BWG0Duw4F8k
TLSH
T156A5E12EA7F815E9D1BEC5798B23C512FA727821073193CB42A0C17E1E679D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 2ba6c93647f666f5db7a6fdd4657c383ba15a2322e94758402fb2bfa8eaf48dc
MD5 d03271373ca085747a77461f43ca577d
SHA1 d62a166a59cc614c36617fe6800fcd8ee6d7066f
SHA512 4389a2f14b875f00505902fe2464524a127d4d38887b07d393f28fc9ffb3cc9e967f69dc462fa3395f5aa84bfa03a7121002d27ea5022b552545d6774783bd1b
SSDEEP 12288:thbHjfXXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:thbHjPXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FF55127E16AC20C9E572A1BD8296D10AD632BC26172053EF23D281BE5F37DE44D39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 62f8769c02ac278b98f482454d1b24cb1b0b6e0e5d72d7a1fde724bbb94c3c49
MD5 3408ad697425e05e0792a4f0c9c7e11d
SHA1 29b5a2ad74af13cf15e71494a5988459c02684ef
SHA512 5f72c3946a342aaf7ccdf6a6b95c0e76b81bc0ea5dfb17f419be6f23ecd31f0ac0b08785984bd9b395551ec2a13692e0d53e8ea043eed96ea4cd1e1be0222011
SSDEEP 24576:P3YgnJcRTk4yti+R5dpR/fsqjnhMgeiCl7G0nehbGZpbD:PIgnaTk46ppR/DDmg27RnWGj
TLSH
T13C45BF2EF2B910B9D8A6D136450147B5FB71782D1F209ACB0170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.9MB
SHA256 280f25226cf9385055caf7c9ce1a54e79da5fee773979a5c7c78a7dbbf7dc0ef
MD5 39a1c3422c03b80e2971f1f30a1d0160
SHA1 f79ac9ff5a315a413f910f39d43370635beae215
SHA512 dabb74c9e111a17be9f4856677c8d76e80778178bbc8750302ea0e46f0f38d9abe3bc782870153479ab69bd1ad14a7674eff219c3b4896fba7d0cd377e1689cb
SSDEEP 49152:PMgXoTk46pqR/DDmg27RnWGj5oYP9c/3kS84FxKk:PzqD527BWGdDuw4F8k
TLSH
T11395E12EF3B910F9C8A6D136854147B5AB71782D1F209ACB0170C538AF16EE89F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 c30e9b9700c4fadb9528d61046893b92dc1b04a1f38e7ccaf18f82dd863fb905
MD5 b8d8728c0a22fb5215d7604f84601361
SHA1 b67dc620cb8543d47eefa573208dfe706c21b788
SHA512 7bbdc8d4ad7e6c1ecd797d8e544081161a2a527341a8923a9014f4e48efb72b6ddb1497d0a0056430b1a5075e30d6bfddc4a1927281f8f092aa40dc557598e85
SSDEEP 12288:16Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:16sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1904523BE924C51CAD53649B5C3E5E11DA8073E56AB2004D379A77CFEE7B18E84B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 2441de2a3d6c6ddc39c4ae6a1d02b430b3a577f6f69630b0a44adc1f4c9198b5
MD5 23c2fafbae4f373fba00faa90a3e3abf
SHA1 07c2e4966d2e2758b64c35430a3708b28661a62c
SHA512 18d1e7afe13ee11c7e9cb13879794646f7356a369445a8807172d41273d1d1e29aead97e7a8b9b7f5cad433029a12adc3872673d631a93b78b2a89a2bc2888c1
SSDEEP 12288:2ObfA4LWOsvAYFTtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:fbL3UTtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12C750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 44183b2596b316450b986d1d61b10228156478ecb8da9592b5f5b871652983a9
MD5 aa16e6ab0963fe482417225a307df300
SHA1 27cd2102c0916b7429e666bbe1b77f8f7ad8e395
SHA512 4c7cab68f56e5543b06a0be672bca686a320ded46351ef3e9e16a5a34cf19992e0f195cefc4a598536bd0eaa1207931b80bd3c1a9c67d385035599e13118a1ac
SSDEEP 12288:apFtIO5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xO5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14355022E33DC10E9E536A17C8692D20DD6327C660B2117DF06D184BE5FA3EF85D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2c44c80a9b87e1b158f86564669e028707cd2a72bb237ba03d085755bdb1308d
MD5 d90a4c6ad2ca76425a612a0e3fe5c5f3
SHA1 420264fb15b506dd723f4fa7fa58254230e09db8
SHA512 3c16f850282051d3a72f1f0b0991bb47e9f76a99fd38e341fc379f0a2ac6461d8590c13eb4d3720ff9bc85b9ee64e7fcbad08a9d110725f7b868ded173c1aa98
SSDEEP 24576:D7NM9YmZqmWMUkPjZM48Mv6bEhsusqjnhMgeiCl7G0nehbGZpbD:D7cBWMpPjN8DbEhLDmg27RnWGj
TLSH
T110659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 7ea4e90f9e9a0f51cbeecd882df30b75a83a5141531bad6fa1363f7e7864efae
MD5 20af0ffb169ee2601d7aef6973561d33
SHA1 13ec44901dc9ea8955705c0c28b16df03f32579d
SHA512 81f96a7c3f6e29e53e1851f281ebb1939a9d16a814dc0420c84feff3cb6e476efa9e324446b87f9e657cffcc46c26d5a19ac1f5e23a0c69846938b6de3360054
SSDEEP 24576:PW6BApg2YuyuNDYTabvcRvNYf8km1YsqjnhMgeiCl7G0nehbGZpbD:PF2YuHNETovcvNYf8kmiDmg27RnWGj
TLSH
T185857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\System32\SgrmBroker.exe
Size 1.5MB
SHA256 6d821c7cea64b4cc4087a211c0909d8f427a5a34f3fe4ecd840cbbb5998cde60
MD5 e10fc36a4ba939287923c02f426210ad
SHA1 c4da7ff2ef7e6ef95bce6f223be62b7ff5b33cc8
SHA512 1832a9f32385630b3156d7c1e69b33179877e7b933b529f4f9992ac2d3cd85fc9fbd7f3b7a1a7828c6b3ab2cc41c96b931b14617ed393f396b86b1e98606552b
SSDEEP 24576:aTMdOz0FFS+bmSLMsqjnhMgeiCl7G0nehbGZpbD:20K+bmSL4Dmg27RnWGj
TLSH
T1AF75E17EA36D14E5E47BC17CC653D90AE9733862032166DB0690C0B97FA7EE46A3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 73ddafaefb05b0dfd3d869012b473edec79bd4124c104b299e524ff261aab434
MD5 a74841a3e12f2d0f7c4310b6f54e7bf3
SHA1 3a391fbbf23f1b1a81966f3ac3afd199da1d2626
SHA512 2617060e8305c0df585ee87424941141d59338dc54c717b9a25525ce1e5677148927bf07cbb1f5f76b06537194361313e28cd984c16ecfc3ad02e08bf9e559e4
SSDEEP 24576:9AFs06+OmlfkNXEbToFsqjnhMgeiCl7G0nehbGZpbD:yFs060lwXuwDmg27RnWGj
TLSH
T14565AF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 65f573cee89658192dfcfe4b100396c69b81ee58268b89852dff0a660f70c853
MD5 1e1e93c9d4e42237f298c0a0b0c8d98f
SHA1 d0cf6135ab5d2f308484e4c4bd5c8215d134eb8d
SHA512 b81eebbc9f44e3e9838f1cce44d35e3e262f2c75c6f81fac3c914a2ce369da908ad856b66e7396cb6bcf9f32e061788aee20127d95feb2f35ffb0630235a220b
SSDEEP 24576:IJnJ5D3WtUsqjnhMgeiCl7G0nehbGZpbD:IJnJ5DGtwDmg27RnWGj
TLSH
T19175E13DD2A810E8D4B7C2B4829A5746FE72383D2F2169C728B4D5357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d06462c3e5e75e6817114d85e9745cd551f425d015c94c1505a6aee11b1dc8f3
MD5 479d7f9352a4d29c1241f2fa14387703
SHA1 b9235f44f2eddc29af022cd9d0077a8ae28387d7
SHA512 811fc87530dbf007907eeaff2edbcb6283fe1ec62c5a2d22468948588c453b85aefa9a2e8b49b01280cabf06b2a1de8f226560ac6d961af45253b1ae66679af0
SSDEEP 24576:AEPohm6/7IIXdwcXrif7qQncjlP65i3VufsqjnhMgeiCl7G0nehbGZpbD:/o06DIKdwc+eQnSt65aVWDmg27RnWGj
TLSH
T139955C16B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 12109e6122b4b0a373eea3347a84a86f169a5d050dcb9112c48d0a462fb37b2f
MD5 70ea2b21af0de36e5ede082d688b7765
SHA1 b4b92084dfa2ece52b151328bca95e5846413182
SHA512 f29ae581b4f280017f6a8b2296897d4b7b4d9ffe7ab8aec930c9145d95439d570e33bd41c2149906ee018f0f9a1305478bc89d2ed092b6fe37ce450324333658
SSDEEP 12288:GEP3RrQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FrQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1ED55126E679C60DAD136907D82A1C209D773F4716B2127EF2692C57E8F739E80E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 8bef84f1512e9629963bd684f1b47801421881a31a42e809c7faae6065450e3a
MD5 2fb1623ecf75faa6388b4a6acd185f80
SHA1 4924b4b2ba3f284fd0e55d258764229820ff9183
SHA512 1937a13dc1c68159e78ff4a732fb70775ece1d97fbd75f0838f3bb3207a8d9d7a74c60204e170d4d47e3b1ae02b8e2c4e3231d6ad9ade08832ea1db07c49249d
SSDEEP 12288:NjkynXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NIynsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10C551219639C60C9E5760578C6B3D1989C36BC31AF2046DF6191FA3EAF72BD48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\System32\msiexec.exe
Size 2.0MB
SHA256 ec77fbbaa5072e8d8e469f39593315b81bee93a650236df3b9cff7a1b355e15e
MD5 5998e9de0906286531d277c686524fc1
SHA1 998509f7730bbec5f27862fa0568772034cde6bd
SHA512 4149c79323ace225a7cf0a19a0c7c3c54d9125caa4bef83b3bae0c1a4bf22e4036d799a2a9b6d702a35ed7dd7bf827c45373131ef361a71af73c8754243a722b
SSDEEP 24576:HtsqjnhMgeiCl7G0nehbGZpbDJpGLoYFt9cvbjpf1kS8SeyXFxKk:HRDmg27RnWGjqoYP9c/3kS84FxKk
TLSH
T156A5236A23E830E9E8B29178C7F6E0454961BC25473408FF65D19D7F9B72AC4CA78F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 113194cdfa41eddf0e279d6db0a409e96277654c056fe6273bae033498263205
MD5 bac47a87f28189950e09469d43dbb315
SHA1 144d2bba97fef88dca33743577a02162182d6f66
SHA512 5a0f7b528ffc83cd4a096bff4d466ed92917ae4e541046a2f2fe4ba8579765f8e6e35b9329fbc2199fa88d49cf955966c7898603c59a06300bfd72aabf52f14b
SSDEEP 12288:2FJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0JsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11545237E525C60CAE93645B4C3A5E20DA8133D766B2014E779E3BCBDEBB24D44738813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 286b9792ae5c733d2e1789b6119c5d491721d14942c84d69aa0c6e3a2ac1135d
MD5 6a76de084ad445b09428a2471dca4b9f
SHA1 1a9c5b3543fb5dec15144e51a7e9df397c035ef8
SHA512 6dc1a1a891c80debdf23544ec52145da72e442364531d7170c36d45d1bdedcf261494b13d015e5c0b62519ce021c2d815afefb44627013f02251d7019730c6c9
SSDEEP 24576:KQ9MxZKdcz97w3msqjnhMgeiCl7G0nehbGZpbD:KVKXqDmg27RnWGj
TLSH
T1E5557C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 2db8b529016917b00f887403c8098a173d21e77340b828bdda1d875fc4b53ab5
MD5 3a7a1bd7907be08a3fab5ccdd78dcb8d
SHA1 cd59772b366b8b2646dfe842f34bcf72eb3edad9
SHA512 2307c199b5d75476eceac34132798c0e59b260362cfa54ed2c4e343d49ce813d42963eb2481a07bc47501cf4cd377fc48e93f2438e2c6002545ba453f19c0f08
SSDEEP 12288:DyoKo2HRple9pTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:DyocxApTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A665E01FB76D40E2E176813C8985C249E673B4315B2157CB6692C73D8F639E8BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 2b29e67e9cb3676f22ad8a3ab9e408d84522b62e5b3ad178080dad7e464be3ec
MD5 56a24473af947e87ac9e6bf5192418fe
SHA1 b69192a94e1f052f41d08d63e70f68e2303f2f80
SHA512 f8554bb811c2ff8abcb0a988933cebb7fdbab733b19533755abaecefc768468e9f5c94d7ed2e85566e5e9562399105b6e82c389149091cdd94aa503baa0c65f0
SSDEEP 49152:pWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKXDmg27RnWGj:R0zuNITD527BWG
TLSH
T198A57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.5MB
SHA256 12371008daa187c67c8bc8b73252cd88d50d2fc2d3aebf986e0d317e533666ae
MD5 b8677f74b9567b7b4c339b6db45336f8
SHA1 607beac1300be4055b58e74ce78f087ab50cdc3d
SHA512 58ca0070f5c1811fba98a7393785d4e8deb86550561e65a3593183cec34e1eb8d859acdca9b0ddaa37979b99717ba892de5943528ddc7bf2943288c5c1ef2132
SSDEEP 49152:aa0h2GEkuAe73q3ppj6zwwQQDmg27RnWGjJoYP9c/3kS84FxKk:aa0hNYGjJwPD527BWGFDuw4F8k
TLSH
T106C5D01E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE48E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 c7a7df089b40b24e86a10d9f3c718eaa24ad4024513d1710b4ee3c8c28042945
MD5 a8d71d3e57407b2103728d133c6182a3
SHA1 a76baadaf0a4df16bce92c3977ae3b8024dc23c3
SHA512 ed2ba0114513c33b18cd7dba07c9683e07357f6e120b77a3a18ccb616e1866ca706fdb5c959f9e9eb034119d17341fb1cf1c068ea92563a4b1a3bf3f073ff740
SSDEEP 49152:hTDxR+N5YzT+jMdDmg27RnWGjgoYP9c/3kS84FxKk:Vu54D527BWG0Duw4F8k
TLSH
T176A5E12EA7F815E9D1BEC5798B23C512FA727821073193CB42A0C17E1E679D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 2.2MB
SHA256 93a75c2ff3c9e0247cfffbd346cc139289a7ccff62d42e77e4b302b52b6898c1
MD5 4f5d0237f99bd65622bacba800bf8132
SHA1 f8e7794bcb9f2bb7b87d4bfaea4366c1851f3f43
SHA512 7a178ac123d64560684a42d6bc5864280829369abc449608799d7fe379e0284c2950d69465737a5b5e85dea3cfdbd8d8f986e51fed38e2e2a751b0c76e499874
SSDEEP 49152:q0K+8mSL4Dmg27RnWGjZoYP9c/3kS84FxKk:aoD527BWGtDuw4F8k
TLSH
T1B6B5127EA3AD14E9E47BC17CC693D906EA723861032169DB0690C07E3F57EE46A39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.9MB
SHA256 d0fd6c6214c77e5599e4436630425337354478371269c5a81585fb0a31350227
MD5 e0a343120e5e060dda614ee5cf95b73c
SHA1 6f3d3e8c3c391505da382015992a20ab00f33e50
SHA512 2873625922ad31c83a570f6a7bf14b7bc716a80e509b659e75bc7814ba9b5fee418bb2dc91f1880953e8c6c9543b83d96faf1bc51781fe9e045abe63b747923c
SSDEEP 49152:CDgXoTk46pqR/DDmg27RnWGj5oYP9c/3kS84FxKk:CMqD527BWGdDuw4F8k
TLSH
T11F95E12EF3B910F9C8A6D136854147B5AB71782D1F209ACB0170C538AF16EE89F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 2.0MB
SHA256 eb100319e84b68f5a1fe55f963d28c2e1d21bbc729ecbf98b9f4a4194203971b
MD5 92f70a5cd286f53d2d26f715972808eb
SHA1 fb7e3d644468c626404d1d691e8b1e26e425f80d
SHA512 3a383dbf9d5f4c786249bc476ea1ebacb120d9894477db535e64274cbcf8d4f7de930b8a8c27947f7857ae6af07460f10c29b8a630d9ebbf6e82cc731db82337
SSDEEP 24576:AotsqjnhMgeiCl7G0nehbGZpbDJpGLoYFt9cvbjpf1kS8SeyXFxKk:bRDmg27RnWGjqoYP9c/3kS84FxKk
TLSH
T13FA5236A23E830E9E8B29178C7F6E0454961BC25473408FF65D19D7F9B72AC4CA78F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-368-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/628-162-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/628-372-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/628-156-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/636-257-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/636-273-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/636-247-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/636-553-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/636-505-0x000000000D110000-0x000000000D118000-memory.dmp

Download

memory/636-290-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/636-390-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/892-566-0x000002B81BDF0000-0x000002B81BE00000-memory.dmp

Download

memory/892-567-0x000002B81BDF0000-0x000002B81BE00000-memory.dmp

Download

memory/892-554-0x000002B81BDF0000-0x000002B81BE00000-memory.dmp

Download

memory/892-557-0x000002B81BDF0000-0x000002B81BE00000-memory.dmp

Download

memory/892-558-0x000002B81BDF0000-0x000002B81BE00000-memory.dmp

Download

memory/892-555-0x000002B81BDF0000-0x000002B81BE00000-memory.dmp

Download

memory/892-559-0x000002B81BDF0000-0x000002B81BE00000-memory.dmp

Download

memory/892-560-0x000002B81BDF0000-0x000002B81BE00000-memory.dmp

Download

memory/892-568-0x000002B81BDF0000-0x000002B81BE00000-memory.dmp

Download

memory/892-565-0x000002B81BDF0000-0x000002B81BE00000-memory.dmp

Download

memory/892-564-0x000002B81BDF0000-0x000002B81BE00000-memory.dmp

Download

memory/892-563-0x000002B81BDF0000-0x000002B81BE00000-memory.dmp

Download

memory/892-561-0x000002B81BDF0000-0x000002B81BE00000-memory.dmp

Download

memory/892-562-0x000002B81BDF0000-0x000002B81BE00000-memory.dmp

Download

memory/892-556-0x000002B81BDF0000-0x000002B81BE00000-memory.dmp

Download

memory/1228-193-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1228-196-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1228-198-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1228-187-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1640-173-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/1640-377-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1640-167-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/1736-216-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/1736-385-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1920-125-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/1920-369-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/1920-131-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/1976-226-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1976-387-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2112-363-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/2112-95-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2240-52-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2240-58-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2240-365-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2476-26-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/2476-20-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/2476-361-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2608-206-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/2608-200-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/2608-384-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2636-106-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2636-100-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2636-364-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2980-8-0x0000000003020000-0x00000000030A5000-memory.dmp

Download

memory/2980-480-0x0000000000400000-0x00000000009A0000-memory.dmp

Download

memory/2980-523-0x0000000000400000-0x00000000009A0000-memory.dmp

Download

memory/2980-1-0x0000000000F80000-0x0000000000FE7000-memory.dmp

Download

memory/2980-0-0x0000000000400000-0x00000000009A0000-memory.dmp

Download

memory/2980-13-0x0000000000F80000-0x0000000000FE7000-memory.dmp

Download

memory/2980-14-0x0000000003020000-0x00000000030A5000-memory.dmp

Download

memory/2980-15-0x0000000003020000-0x00000000030A5000-memory.dmp

Download

memory/3180-183-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3180-177-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3180-380-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3328-146-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3328-152-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3328-371-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3880-68-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3880-366-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3880-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3912-32-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3912-38-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3912-362-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4420-82-0x0000000001690000-0x00000000016F0000-memory.dmp

Download

memory/4420-72-0x0000000001690000-0x00000000016F0000-memory.dmp

Download

memory/4420-78-0x0000000001690000-0x00000000016F0000-memory.dmp

Download

memory/4420-86-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4468-135-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4468-370-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4468-475-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4468-473-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4468-141-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4564-230-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4564-236-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4564-389-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4784-48-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4784-84-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4784-87-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4784-42-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4980-367-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4980-113-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4980-119-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download