cdcc4b0b16ad08f90d4bb691ea9df22314d449703a395f4079754d801755842c

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/11/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
Size 2.2MB
Sample261101-2c2wvsfv9k
SHA256 cdcc4b0b16ad08f90d4bb691ea9df22314d449703a395f4079754d801755842c
MD5 9ac2593fb366ea1cb3842211fb472f36
SHA1 9a6211c2b9af1284710b44ca1958db4f0d803c9c
SHA512 7b7c286e81d73ea91fb633ae7c504ec334523a29a7f0dc3651c27c011f0079fe19b6f3b752b2acb90302bf3f0475ecde4bc1e5299eb4233cf3f5fef3d50510a8
SSDEEP 24576:kIClp7MfqsqjnhMgeiCl7G0nehbGZpbD5GLoYFt9cvbjpf1kS8SeyXFxKk:k3lZtDmg27RnWGjIoYP9c/3kS84FxKk
TLSH
T149A51211B7E505A8CE7E193808E66B708774FC544F3C8B97A334ED1E253A7909D293BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4908	elevation_service.exe
3500	elevation_service.exe
4200	maintenanceservice.exe
1456	OSE.EXE
5932	PerceptionSimulationService.exe
4604	perfhost.exe
5944	ReFsDedupSvc.exe
3992	SensorDataService.exe
2672	ssh-agent.exe
4676	AgentService.exe
4860	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\83d667253ebf6fe8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2108-0-0x0000000000400000-0x00000000009A0000-memory.dmp	upx
behavioral2/memory/2108-96-0x0000000000400000-0x00000000009A0000-memory.dmp	upx
behavioral2/files/0x000100000001b8c8-292.dat	upx
behavioral2/files/0x0001000000009951-291.dat	upx
behavioral2/files/0x00010000000093af-290.dat	upx
behavioral2/files/0x000100000000932b-289.dat	upx
behavioral2/files/0x0001000000009cfe-294.dat	upx
behavioral2/files/0x000100000000ba3e-298.dat	upx
behavioral2/files/0x000100000000a2c1-302.dat	upx
behavioral2/files/0x0001000000009365-301.dat	upx
behavioral2/files/0x000100000000a1d4-300.dat	upx
behavioral2/files/0x000100000000a0cd-299.dat	upx
behavioral2/files/0x0001000000006215-297.dat	upx
behavioral2/files/0x0001000000009b92-296.dat	upx
behavioral2/memory/2108-295-0x0000000000400000-0x00000000009A0000-memory.dmp	upx
behavioral2/files/0x0001000000009cd6-293.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.INI	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005842e66f506add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001bb0e72e506add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000059f1e030506add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c57cc2e506add01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4908	elevation_service.exe
4908	elevation_service.exe
4908	elevation_service.exe
4908	elevation_service.exe
4908	elevation_service.exe
4908	elevation_service.exe
4908	elevation_service.exe
3500	elevation_service.exe
3500	elevation_service.exe
3500	elevation_service.exe
3500	elevation_service.exe
3500	elevation_service.exe
3500	elevation_service.exe
3500	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2108	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
Token: SeAssignPrimaryTokenPrivilege	4676	AgentService.exe
Token: SeBackupPrivilege	5944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5944	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5944	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5944	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5944	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5944	ReFsDedupSvc.exe
Token: 33	4860	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4860	SearchIndexer.exe
Token: SeDebugPrivilege	4908	elevation_service.exe
Token: SeDebugPrivilege	3500	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2108	2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 2908	4860	SearchIndexer.exe	100
PID 4860 wrote to memory of 3684	4860	SearchIndexer.exe	101
PID 4860 wrote to memory of 856	4860	SearchIndexer.exe	102
PID 4860 wrote to memory of 1004	4860	SearchIndexer.exe	103
PID 4860 wrote to memory of 5676	4860	SearchIndexer.exe	105
PID 4860 wrote to memory of 2640	4860	SearchIndexer.exe	106
PID 4860 wrote to memory of 4092	4860	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2108

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3500

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4200

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1456

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5932

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4604

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5944

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3992

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2672

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4676

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2304238888-3968896904-642854331-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2304238888-3968896904-642854331-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2908
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3684
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:856
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2988 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1004
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5676
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2988 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2640
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 54dde822653b39f1a705f9bdd7af8c5d91ac4b14a6d4f0cc01dc9a954d044878
MD5 f9bd1bfef744a795f1b9df3e15329bba
SHA1 3d7bc2b3d64d952944d10e3cf0235d201d7b4e9f
SHA512 702a43ff17ef6ac07c32efd3a30eafa3c589934b93f3193dfe58f5f90f42de897ebd56d298829ab764082c717c158f3cc3bd36d63d822607c17ffe1e66837fd0
SSDEEP 49152:Vb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnxDmg27RnWGj:r3q6sjBCD527BWG
TLSH
T175D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.2MB
SHA256 c9988fc068d3a8678232c693de76f994da5f5eb7db3ca735476e212749eda4ec
MD5 bfe7e024ce82958ce45d2404e8a22406
SHA1 da0f59fa9c0384d2e99f98972c22bee71c006b94
SHA512 6a6c1c1804eb8565d20faf90db930466b97dee4cd9b0b248f08bb5f5b75b850ec132bb1f726594cdab69066b535bd75a59f0a83a386b3b35753787d0e6cd727c
SSDEEP 24576:5XYfDtczAQxsqjnhMgeiCl7G0nehbGZpbDoGLoYFt9cvbjpf1kS8SeyXFxKk:8tcjDmg27RnWGjroYP9c/3kS84FxKk
TLSH
T149B5123977D408F9EC63817CC9E2D405EA737C558764EACB03A0996A5F236C88E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.2MB
SHA256 db4cadf625901249aa7cb537bf25429b1ce70c581596f8121306b491833bbcef
MD5 35634ffc8e91077f4228000cc32240ee
SHA1 6d4ecc1fe13f0ff3fe4a07cc86a3bef3bb2c80d7
SHA512 87b38b011523ec429b51bacb0232eb0538700135678f25fb71ef8350de995ce2babd1dce8a7833d73c0464588188687fd7b3c3550e321d2b082f44a9596630a5
SSDEEP 24576:zXYJizczAQxsqjnhMgeiCl7G0nehbGZpbDoGLoYFt9cvbjpf1kS8SeyXFxKk:9zcjDmg27RnWGjroYP9c/3kS84FxKk
TLSH
T16EB5123973D408F9EC63817CC9E2D405EA737C558764EA9B03E0996A5F236C88E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 5d931953a6f4739b6a40dd8576c4c8e89010e731d25186da23d915514f5b35fe
MD5 d30598acf078e65400d8df5e559fbe7b
SHA1 f34fc444395011bb43acfcad9261c5ee92152cd6
SHA512 24202d04368e35712523a514dbfb12914d0dea55e6aaf0dcf567294d6bc8b3766da010f2e1954b3b2bd23d52c705464c594e7756ec2814ccb9f764daf52caeff
SSDEEP 24576:5XYfDtczAQxsqjnhMgeiCl7G0nehbGZpbD:8tcjDmg27RnWGj
TLSH
T17C650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 f0fd8687800872828e7eaaa25896e3de2209cf0c9e48a128eaff243ab1db1556
MD5 77019b3ec9b0ffe67ea0143d9279d687
SHA1 0c8b125abcf8d41b45439d53b78b500d18d23c71
SHA512 ac449ac87d766e9b9a67f949f032d9c629622c60f4df8eea95fb612911b56bb20bbf25c085fc21da3e93f1fe26e05338c47eb0ff55b60c6a0555622d1ad0ae2c
SSDEEP 24576:10Le5ji0hmxxrM7xsqjnhMgeiCl7G0nehbGZpbD:1Pji0AjkDmg27RnWGj
TLSH
T178859E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7fda9cfa27e9ebc8868b3a7b45589d80615c6c9d26c342fe142eeff54555078a
MD5 5d097c29014cfb3114202163c967b7d6
SHA1 0e568bb7dbc3fb2b13ce4c3249fabffd57621795
SHA512 fefde2324ddf28cd01f31ec87b83b0ec8998e3276dbc923a243ab93f6d07fa34904f4b9b85d8c79a2adcfa836a52e0c2baec29357c2e1ade262ae2e528b53f68
SSDEEP 24576:Va7/ezSC6vUyD/aqgrvWn6q8wyu9xsqjnhMgeiCl7G0nehbGZpbD:c/ezSC6vUzPveHjyQDmg27RnWGj
TLSH
T130755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b06261feb60898fd988d1c3d1ee7c470d88192f2e3877e2c62ceb420c8827fb8
MD5 eecc23ea8a867b1c432d80e7a7bd7364
SHA1 10641c5edbb9ab5e651d832d4afe0b0b1debd1fe
SHA512 410bd1fdcb1d50d4ad8e6809e6c5e71f420c202b6310fc0de51b7baf02035ceb95037c28e69fb09aa3a57efe3fb8ea69dd310818d496062eb481a18e0e2bd5f0
SSDEEP 24576:XVbqPb88hv/l+YExsqjnhMgeiCl7G0nehbGZpbD:XVO88hXl+bDmg27RnWGj
TLSH
T148559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 863f803bd7e59965fc127a21ce321c351b8f8675c835ef87411e1733938b2af4
MD5 ad2d9c791dfc557a0ef18b88f427131a
SHA1 6d7334689e9f4a91eb83273847cc180ca92aa9e2
SHA512 ed463cbbd491ab1026e0f9c2ce1f91214c97bc79b5242cb221add7a8d4595374d5c790c9ef5c811f3321d4e2ea3930ff4c2a3b55237d956f5f14b12137a0ed29
SSDEEP 12288:7LfxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7LfxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E94523BF974C50CAEA7608B5C3E9F11EAC137E56982008436A637DFDE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 621bcea4bc6e0f5d3876abb182904996c68f7e28be4b534335fbeebd066ab575
MD5 09efa3cc92a63044e083a4946d4c8ccf
SHA1 b4a9e70eefceed9711e45488a961b685640bf480
SHA512 776af206512a8164af3eb7a03ba3efc27f1617befcdb3b709ffe5e11398ae78a1232fe884a44845989d909300d5228f4a755e8ce561435610664a4ff08447c6e
SSDEEP 12288:HeBNUbTVO86UsxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:HJIUsxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19E65CF7BEE28FCD2C27A8DB85791C600E76278314F6193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 99c36930f90570063d3da8e60d544115bc3c3661637f891afa21656efe2f858a
MD5 ce613db3c67ee4c303fd9ccca227e396
SHA1 c15bbe3f603d798f3f446709a40fe28e89c3a8eb
SHA512 5d4f6d2d110d1870d93e2920a51aecf171f3f2bccd565ec3eafb9f0a958e2c4bdc237ba5b3e378afecc757f1fcd2fd3cc1acbfbcbbec2f89532622276d829a4d
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THh:4QvGAdlCEL8c/DRNw5CDD527BWG
TLSH
T1FA266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 750b3a57cf8ada9b2d89e888f7585c6b8793be6af25068df2c2685769e12c5d4
MD5 34e403231f3eb7ab1c15dac62718e51a
SHA1 05e97c5300a758d276d65d1f0da61d967996e964
SHA512 d6ab264f72fb565b62bb50419ccb613787247ca5f31cf6a5182dc8ed6c5cdad374f2d9532c6b009a120a8362e26bac73616708a654536999f0873068b7a4a10b
SSDEEP 24576:80ewsAjGxsqjnhMgeiCl7G0nehbGZpbD:hlj0Dmg27RnWGj
TLSH
T16475E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 197b3c29b769ab2273783cdb229a5625074087c95f2ad7db9c9e86ecffec082e
MD5 00441c3d3f4023171fb19e7bc530f27f
SHA1 15fc7930f5fb4c2c0efa1f732f0a39a7e67dc8cd
SHA512 5e1fd6dc6a9d45478dccdf64d3e77ac9fc911c9142147f31410d0e5814a42837dd0678f03c8961647e5a1db22be324ade0865bde590471cd6239a7ef5bf40e24
SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHcVQBWG:2UEtQevvqc2W1cpV2tI32jB
TLSH
T19C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2166eecca7a43f532ca5fcb34cae31b48047b2eb99d7e6541d4a85de6fce5fc9
MD5 9da489bd658d5bd4ef3641ceabbd3b8a
SHA1 8ea40e75c1e0519909525db2fbd1d54e0a06b64f
SHA512 fe1eb2531e25909b03dc027f06416f61e55e39e0e941a4db51ee593fd7ada17b24fa21b0df5b50c6726ca3ef56a96f374ee91cf4523d554a14014a9aeb5ddb5a
SSDEEP 49152:bCbRquA/m2yL5zTfFiV+XenmE3/zUDmg27RnWGj:EoquVjnmvD527BWG
TLSH
T1BFD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 398f325d8d5e8f3c9e7ef5f219070f694234d4be46e56c70fa296c34d3cc1741
MD5 c909798c3e5ea0af37da78547f9050fa
SHA1 45600b8f68c3d796f4177652ef7379bd4b0794a3
SHA512 154b34982fe5d735fddc9eed821aa66e9f4b653b91009bf6834cc3895f7d2682ec91765d84f9bc762328e18fc643c61417e5d9e72be04040e01f1d07bfa14b39
SSDEEP 24576:sAhGL3IFoiwtA5l7S53JxsqjnhMgeiCl7G0nehbGZpbD:sAMUFoiq5/Dmg27RnWGj
TLSH
T151359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 faf48095a1be3dedc633955614979009e3f0f33cabdc9eff0e9aad6ef2439db2
MD5 a7bc3afd679c68e45a9b0d4edc2f0791
SHA1 abdabcd052863ac3c91a62eda94f30fe7f67c15c
SHA512 37b3c430990410e6260c9f1b7caa9bdc8f2e8d803095245ddc8c27fc4ba10a413b0c712d7b6869b3c99f08dbe8acfa0918a8c0e9da9df3353a0b2fa5af3d6dfa
SSDEEP 12288:imw5HEjsChNVBFgl0WDm+CdxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83i:7wu4OWixsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B965F15A76A80CF9E9674539C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 846c6a0ef67bc86e241c7bada1a3c683a884dd6a03db14b67e117103c33260a3
MD5 88fd719218a5a46d20d6cad1fb792b19
SHA1 9b7e460076b7380bc5800974bb3fa1011eb29d09
SHA512 d0d0ff0c7e61c3f62c3ed5ff7444ef0478b981ab3ab82ca5fa62d78a017f71c347c5a410833a5d0456102130ffae72fdeb2ad789b1efb6f4b88ab9b267fd7440
SSDEEP 12288:SeZ1IyWxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/ZuDxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15E5512AA239820FAE163417CC5E5D609EB333C62673043CF166659AA6F739C44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5a83506b02d2f68a45793582c82dfd16f0045001363ae1bbfafda33dba724941
MD5 d58811c7970e4c3a4703f5a38920510d
SHA1 5c35c135201cacf1f66a083420ecb85703152d33
SHA512 e46ca6c8b28cd88369c1a2d410aaa5938e302492caf4cbdf0a48dbd12d950c6db33faa80190f30aa9a4515fa2c5a162d4f29ae8dd9561be12c4cb79b10633ce2
SSDEEP 98304:kQRQyi36YOcPbLvw2gAf+PN3GD527BWG:rQyiKa/X+PN2VQBWG
TLSH
T10F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b8590521acf01f049e6d696512fe9f8c92f7454131d32567192c36142eb1b1d4
MD5 5dacd66ce4bdcfc7706ae0a81237b118
SHA1 c39a6255225663a1c1e3a0dd618b384292e26e0a
SHA512 6df8d75cf34757c7c3faae49f6082b606213f4b0066a32a62cc07480f4c14cac306ea53279ea81060f3cd947c6e2fa077001b16fd32de67ff2cd474918418664
SSDEEP 98304:sQRQyi36YOcPbLvw2gAf+PN3GD527BWG:zQyiKa/X+PN2VQBWG
TLSH
T157667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 edbcf4ec5ec0ceb91813c16683ad0991031dc48b01a69bd00acac8c5a8d15422
MD5 ef0933d62b02b4519cd8b22f843fb117
SHA1 85c325acba272b5a82222c741bfb1957711bbd1d
SHA512 e832a0401d70874711e34220d65f3b266a5b4c64d7e184808891ba5aea599a4d6c13d0078f62ba2d2cca9cc6a161eb1a3e21061bd80a2c9b5860a8d812ef89db
SSDEEP 24576:pwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0zxsqjnhMgeiCl7j:168Qg55nhceWu7PNU3/kDmg27RnWGj
TLSH
T1A9B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 97133f41c29ea1ad1d04cb5dbbb6c8c9d5c678d5b5d4126947078244b2e40b91
MD5 1205a277d6ff5fcb5ee38e230f80877a
SHA1 988fff085d5cec8d78a2f65baf67f845a7ae66c3
SHA512 e3cfc821e059fcd52f3dbf460e2c3a58bcec6fe7cc1f712e306c47e2a8a5c7326d411000dd3a60447c6f078c2b4a9e81ccf562c69b6603dab854e2cc5ff52513
SSDEEP 98304:Ly5112gYy5azzVvt69nLKnhZtD527BWG:mLIHEWhXVQBWG
TLSH
T189167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7d04eca80361d71af994c064fe3aa901069cf4b7517004d5ec2de2669e1829e0
MD5 ceafe83ebfd4af36c679e5f823ba8394
SHA1 1b34f2bdab5732d1165565501d901a7ae45ed3eb
SHA512 86e57aebf12c917b2bc2dbf1066e4abca510fc22b863a387abea27f53e6c6f75f4cd3710423009b8a5b47ff8d125fdab8cfe2fe649738da7ca9903323cbb11f0
SSDEEP 49152:XB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gleDmg27RnWGj:5u6Jmdxd2deD527BWG
TLSH
T11CD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 02d5374e0040f195f8a69072aaa2b5682d2445cb878478839433c818bd10d94d
MD5 d90171ad6f87f7408a548d7794dfaf2e
SHA1 bf9fc68b4d862f4b084fce38d67556eb2b6b890d
SHA512 e3791a8a303e8b9124ad72f891c29929e8b67f33d84db61efa74ce10d2b340a507915502d08ec1f61d735527aad426e21a66837b575159d35b646c64ba9b8f2e
SSDEEP 49152:Q1hpsNoJpF1A63U44CwH7R4xqDmg27RnWGj:QmifPWRvD527BWG
TLSH
T1FBB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0a0cb6154b49a6df47bdf1b7fd82f7c3dd7d2dea1a7281509d9c05595015c929
MD5 a910166d536cda0873377444bc5ba3fe
SHA1 f6548ca0c78969417097b2391b8821344fa8c0c0
SHA512 de703525ae66c3b307016c4b91e90ef6e2f6de4cdfaae929b0e3899cbc90de05b4b582e4ebc4df1aa8c0b3c1c524afe64a21dd948251d86133230190c963b772
SSDEEP 49152:1SuZQIY0Be2KcRVtOnks6NMHqBDmg27RnWGj:b5dKii61BD527BWG
TLSH
T1EAC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 240c4df871a7874f2eeae6035f295b5d2d47877a2b08f3fe0ed0062dfab543a0
MD5 8c53ffec805861f60dadf8cdf87f22d2
SHA1 34648040be67048ff97cd74f88110cd5fb701613
SHA512 f8e50ce15fb95650e3e4f79267f6465bfa5ec67719f303000e34003465b457d5f77b01b915c4118a33c14b675f167bcbd0ecaa9364ef75c78e91477ba5cb1da4
SSDEEP 49152:4htSn8EApI0fig3giDn0AP5wuDmg27RnWGj:pX2imphrD527BWG
TLSH
T12E95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 3ceed7037d83921af379b2826c8a1692b9a1c1e253007825d2a483c6dcaae530
MD5 f1afd9a7a29610c8e0c280aa5a25c7dd
SHA1 68b548eba938ff0e7b4597aad27d168656837fe6
SHA512 0d658ff448ce928fd69ddea88ab014f68bb93cc45a5141d7d9f50bf487faa941682b3b51dacd8ce1ff18784bf3ce3fefaad2bacef612695a1dc6c2c5fdc95ce6
SSDEEP 12288:InxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:InxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18E4523BF964C41CAE52648B5C3E5F10EAC073E5BE92004937A5B7CBEF7B24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c5e881122794099e780491722599323ed948d2a6ea5f290ea0d90e73a53aa135
MD5 805988e3d9fae5b5c3af7b9005bd6baf
SHA1 377714d5a56a022ea1840d1dee82478bbcb73d35
SHA512 a42477f475dc5c96e3dacea5cb5247ce334afd3f49c57c04160d0306008d533ec15ddf75ba34f80e238c224110059598838027672de979ad73f09f8fa3ebc181
SSDEEP 12288:66xXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:66xsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18D4523BF964C41CAE52648B5C3E5F14DAC073E5BE92004837A9B7CBAF7B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ced208266771671e51be745ae5d68a9f2fcdaa9ab4c2180c820b7afcd882150e
MD5 826a6d04e4ed8db7d61dfb503cb8a40c
SHA1 4beb5043e9c41ceba67ae0c953c7d4d94727cfae
SHA512 be1a0532e206e99dac36d3057230d9bf6836c163a48979076709334bb7e63dd065d3fc37b6a64bd0eeae8a8e1d568f057cc5f146e35f6fa41c74935cf6ccd1f9
SSDEEP 12288:r0xXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:r0xsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D64523BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B24584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 97bfa9361b277cdf53cf717c1e0dc4bfd3f144ec15948b7cace3a67cc1295491
MD5 8c2f97f796c52bf7b171f77275a6c4f2
SHA1 1f70ecd7ec9c6b8801d5802527f3dc87a812ec9a
SHA512 1088b3e20499fdbc85dbc1901cacbb220523cf2a84199a16dcd85a77723da6fc6d563c1a5927a703fbc53385ca3be51872818aceeedd9203147ba8633ddc67d8
SSDEEP 12288:4VpxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ExsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13A45237B575C00CAD83685B4C2F5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 fb2d4a4b3783634b39b0f7abf27d9f8b4b979ecbc707a70d49e09872122deec3
MD5 42df52e773ca9e9e208abe52112265f7
SHA1 b707f5622382be781b945dd18104f1204a23bbd6
SHA512 c130869f1b2b718da44c5adea7215d1a76a4a58002c5577cc6ae6184cbcafc1f317b16e0f01f0bf839589e285d2686fdbd44eb459d2faebd7ce405c24752c5a2
SSDEEP 12288:VhxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VhxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1694523BF964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 56be1a37a4387926aaedd031c4f8fc68c8180fc530a26786efbbee3e231da14c
MD5 7447dc022f7b881723733c2237587fb4
SHA1 eedeee505ae794a207e052ee9881a1a55b304846
SHA512 464c21bb4312e93c455f0b173f515b288771e9c9cb03908a372e59655c50cae0bac572dfa0e579c19922a469c7286802fc104d67486d16ed802134da0f2deebe
SSDEEP 12288:DuxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DuxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1484523BE964C41CAE52648B5C3E5F14DAC073E5BE92004937A9B7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 3120ed5a1d024b6e54b5ae5de48b6e5d670328de3786a26667f88c7ea1888398
MD5 b01fd29cfb07a1320c103dbd4e7bb84c
SHA1 bf14c46b29f3defe34adc61d5aa3f0a5f2fb9fe3
SHA512 e25bbd5e920cd32e2dabd9c0e4afed141f034c31b1d08d9caae6900872d14bfcbda6fb0d97392bc29f928593865a85a941064f34fa723fe29a75299f80f588c2
SSDEEP 12288:vSxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vSxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1524523BF964C41CAE52644B5C3E9F11DAC073E5BE9200483BA5B7CBAF7B14684B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 ce014d1ca5dcf5ff01f04b2145509b5307b8330ce665c3ee38aa3248e3b5ba45
MD5 12b2312305982e7df497313f687b39d7
SHA1 46798f76bcea33415476186f63f417a5e2c555bc
SHA512 8d350858d0bff09254384d9d26f35fc8d028b9b1847bee0cb38c6decbca68ead05e69f61e1b135f4b0505c84d85c5d67a39ca2e95e9cb86a8de3aa3880ec9ad3
SSDEEP 24576:uZMRzFVSOaxsqjnhMgeiCl7G0nehbGZpbD:uZMRzf8Dmg27RnWGj
TLSH
T1926501A9B35018F8EC67813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 87106ea30ac99477e9f2380b30f98c58ba119c21a9c7c5287542dccd8d30aa71
MD5 ad651750fc33902b46145fd06b05b8bd
SHA1 09144e6ea53611bf212ae192210e2cc53f3500e8
SHA512 371d62c76ffeade60449539685273417d4fdbeb5b0101d7316e9ee9024668026fa850c1bc929800f8c0f0f32ed1fac90b1aeb296444635f56d0ceae792e5b859
SSDEEP 12288:4TxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4TxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F84523BF964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF6B18584B3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 1543a10395dae29a78a2018f3a71f885630dad34248a1d6cb06d7d5d8f4be270
MD5 ac042d2beee5bb80672a53e05ac31eec
SHA1 7ee9772157169c0467e0085e3a7e66a4cc771506
SHA512 e5c63a311036fbebb82f896eb8ab287acbd0dc98af8f960e2965186b1d9b14154be71f8e6748f8a216d52fa7c05fcb1958e7aa1fdd58e5f02cd819f269038f4c
SSDEEP 12288:DvxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DvxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11E4523BF964C41CAE62644B5C3E5F14DAC173E5BE9200483BA5B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 267b31c9c3b13052270207cd6453bea0212410182f235ecc1fa35b536ab3af18
MD5 04448cacfd98d9ea484386429baf13e1
SHA1 749ba847c853251d0017012e71fdcf7a51825f4d
SHA512 1bbce2e74175bbd584afaeba4138b139ebab4425dac0b80ae937393ca38d8f37b159bbc8f0607e54a98698345a497eab04ea33e04e038db5c59cea08350fcaa4
SSDEEP 12288:qyPz5L8WxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3zyWxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C855125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 3955870c564fa2ed7a0af866e974d58d3aff481f4a2b1d2b4964b12365185d88
MD5 b274c7897f161287967fb899a2be477f
SHA1 3ae943c295201f24a1ef5f540219231dd118af47
SHA512 ade17c8a3257fcfda7f039d8b3535229ea370491966d00d2ab136b3a1d5d65cdda477e63faf5cef7e1c9b9eff6c31afc8cb083db1ea7394c21db129ea9a13ad8
SSDEEP 12288:RTxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RTxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CB4523BF964C41CAE52648B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 7ccc14bc137372f465266475c866befa1ed74aee60624189c4c1964d027de019
MD5 d9b0e5269c36222bf90c50d45fd7bc73
SHA1 2ed11965986d6ac91c8fe8aa77e4af0ab422e364
SHA512 03b4ec89a4d37b18d78ba6902e4382cba4661e6a26515bf8b29814fdbda12af87dffad1d7d71e3321022fbc3151b0f4115e34bf7f684703d807473a628fc30ef
SSDEEP 12288:dTxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dTxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AB4523BF964C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 1ff9e810c798e323a08d5df13713ee6d9e74daed55e4ecef9be2e538a9d49340
MD5 37dd14933d960ead4c1a2d0ae78abeaf
SHA1 953684fddc8758617c9cf898cdc0f3ea1ff3ee63
SHA512 b1a1bc5bb8a88c4462a21288970ce37782c3c0f003830a756f8d9a9e0f36a3f393d22c33690471e669b0c73618df7c6a5c33d7f4336b93973c4489fc6c07df7e
SSDEEP 12288:LyPz5L8WxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mzyWxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B855125B73A530F9D1378178C5A29A06F7727C3647204A9F17A406BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 d8561006802ad19a523e01f04e596b506a73d7918165a7b24bc809181a40a076
MD5 9509abf389f622ed0b0a7d17152067aa
SHA1 bc8c4d9986a45dcc234822e2c643172f10d177e4
SHA512 0e4ec31dbaa6455816b39ad219096f488fc883ef594ccb69039b6d785efc2eb8d85a94f914f31a23f969680ed44809adec905a0554e3476aee163132469fbc2e
SSDEEP 24576:fTDaLl3z0zDkxsqjnhMgeiCl7G0nehbGZpbD:fTuLljzDmg27RnWGj
TLSH
T1336501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 d9262e3ea63a9cf4494943127bf079e36b58656a5861cf8be495134c8f73cddc
MD5 882f7fcd8f200bee74ba4bb9b313a985
SHA1 17f0ebe209e35b4d6f33b8eabb5596117823c09b
SHA512 39cdfc64b6c368b83727f4c44a0926100a9c3373f16ecbf736b75720709088747ccfe7c0e71f5c0ea297d0dda0e02aa45d1333180b0eec253507af070e03156f
SSDEEP 24576:x3vd9CHKy7GZYxsqjnhMgeiCl7G0nehbGZpbD:hvd9CHKya8Dmg27RnWGj
TLSH
T16675CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 38731a3b3a1a277618d8f6ed979968f1c6cc3c9bccc2759a567b6c774f8f0b31
MD5 0c3c2cf64786864b02256a67ab38fa79
SHA1 9d0ea61dc177aab1e50baf9140b4d5c83304381d
SHA512 b944e06253d168c78517855774d800f912fe5accb061e392e131bc4c697907ec074e570c49f5716ab617ec2c589fab1bbab9bbbc8d06526e3c37eba7b27adad0
SSDEEP 12288:KUxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KUxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F64523BF964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.2MB
SHA256 b8e71af823ad269e4d1d73dff980586d51a6598d319a0681a91fe9e3c40b00dc
MD5 97f5b8ec1dfb84eeb2641cf10fad19b9
SHA1 648c8bf90b973ef969d674e1d82914911d9f4caa
SHA512 c663c1ea1a356af05903d98582d34b73501fcc1c302e324fbd48e8d8082c6442a9b5dec32aee0f1fcbab89c782929a0de401ea7097bd416cc35d1aa645f7e6b9
SSDEEP 24576:zAwvtk9RX6wkyAIaGLoYFt9cvbjpf1kS8SeyXFxKk:tMnYIVoYP9c/3kS84FxKk
TLSH
T11D45D029EBD848E5E1B7913C99F7460AF6B178580B31C6CF029A536E0E37ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ab669cff70eba8e274625200f8d9eb388524319331c945e9c6ad724e0ceae87e
MD5 d8c308b9db2c6c7d600c120f9f8a977d
SHA1 a0a0c962f72e6e4308704d3cdac71178e43a6a72
SHA512 9c315a690f36074349590769446786029ab4de17b60a4d0f924ad3fdc1f9fd88bd174a17ce0e78e80462ab4a2e0fa35d52c15f31b324a6b27ddd24bc4f8b5133
SSDEEP 49152:/YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ODmg27RnWGj:qySzPmD527BWG
TLSH
T18B066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e11babb1bf84a367a34943876b5dc1a55038f0ba7ccd418d7b34b3a9dcd937fa
MD5 ce64fed3e7c0c9460230dead978b4104
SHA1 251a7278d525d1462e2629e41308087c1d0bdd76
SHA512 5c77f18cd0f98cd2d20d2926c885af7455904699252628a67b1f8c46c63c859c582cebea54eb0556ae161140d141ab437da01e225734b5d9218cc8b3c89fa3fe
SSDEEP 24576:I47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYqxsqjnhMgeiCl7G0nehbGZpbD:I47JUQjTirIhCnDHUPfF/eDmg27RnWGj
TLSH
T14D65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 237c4b9aa34dd0191e5ff194c50c7ea42e9e1858346fc89d3a64503fff3dd607
MD5 e027d8bccec7720cb1a37ce40a399d9a
SHA1 1383cd46f5683c6990d7ad4a9f02c7f23ceffbe0
SHA512 3b7640560f25a12674797b4045d9de079c8ee753274d8f6c19203685f445ebcc0bf0b00d5860065d5295a156a57b3c2d23cc602cfc40b3e1ff40c1de201de4c8
SSDEEP 12288:GbsfDxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tDxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15855015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 8275fc2f61325321d6afa493b8e1fe48213a32a4ab54807f2887a3cf4cd4705e
MD5 8a0e866d7f8367545608cd01a0f9642a
SHA1 5abcd4f98f3690cf37335ab96c625e7a23b9dc2b
SHA512 7b4214381205709aef16ec7d27d5ef0caefc1a2d8b878197b4675b247d719a67082b32d16f279c8d1b1050e9f829c68704c5fe44846c7dc9696828c01e813755
SSDEEP 12288:sizbgcKU3f9yxa0kJVtNDDudNPIZp+tifm7vWfvNbCO:si3gHUPOkJgPIZpxfm7OfvNbCO
TLSH
T1634518007626CB4FC6A940321E36D6CCAB70BD46EE05AF0773C9973F9476659B6F1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 16KB
SHA256 6136a65a9f883f4faf5eabcdfa81e60141fa148745d5a948450638983415bad7
MD5 204b307831e3a263bd8ae03394affb57
SHA1 6f26dff45626719fcad9b971399827b308ad0bbc
SHA512 327693c2332dec59db0740fc63fee87197e994d8b144b5ef0d43eb9a5fc29ff58b21ac4400946da72da2506953308ac93f7140941c367280e1e9aaefdb6cd20e
SSDEEP 384:YSh+llBillXTlTEJVaZb+llBillWiRaZb+llBillJ:YSh+llBillXTlTEJVaZb+llBillWiRal
TLSH
T159724094F764F223E8B301718DD9E3ED6F28F8292F800347734073ADDC499454EA9AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 395fac3d9c330c6fae262953d689b4c79ca80c63d4fc8d5b6c84184f03307d25
MD5 66d2a719d8782d10831e5b30d277217d
SHA1 7d9fb09b6f5701ced88fe1cadd24aee3d6dbae01
SHA512 2a460be5d112ff4beb5634c998613613375fa9ca46c57ca599c2b537892cf9cecfc16e0cf1a403cef4ddbfe6d910c573e190785e84331c824deeebb7fe79cfb8
SSDEEP 12288:PXprWuH3tO9SAxYVE0b8hAoo3qBLb1YgQKbx/RJGU7K+qFPiDGF5ydTr1Yy:PXph2SAH0b8JkInaPKV/3vqF6aFwdH17
TLSH
T1A6753A016577D74FC9BA90370732A6CDBB74AC06FB453F02B385883A94A655EB1E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.INI

Path C:\Windows\2026-10-31_9ac2593fb366ea1cb3842211fb472f36_elex_wannacry.INI
Size 607B
SHA256 ac506ab3b15950f6a20755c864b1a63ea94a499234e6dedabd614d3fc5b030d3
MD5 8db9581389067377e5f22f519dda6eaf
SHA1 6ee69a96d6b9154132d19c4b962abe1f654c3d3d
SHA512 c001ab763a8f38d5137bd1bb5502a90c753835f9cae26e3b34a30ae12c3c028d85e47066382c90258a866177e24ef4122e09f6e2dfd6719b42cf6a057092d22c
TLSH
T1B6F0D575680ECEE54077ECA6A02739540FDB83A34871A9D7296F31DF0F732AED505889
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f159fd6c6fd9be21808b48982b8ab2105f7ea391d401ca59675c5cc4e30497b3
MD5 8be0b1f5f92b7c1ae4a48cb7afb70ba1
SHA1 e49419ae4e64ac9fa8bd7a2fec0a7d862b3828bf
SHA512 5edced59c1cb9d962b1a2cfb5c6189567ac397b3d5d53eea14d8257b5e24456c0854a63a6857e6897e88250475b4a67d9dd954f31a32a810ffa21a86da75381c
SSDEEP 12288:107bxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ebxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D645237B935C518AF93609B482EAE12D680B7E669F1044C3B90778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4fe52318deab82b22e5f5f85ddefc2c86e259dfe92eb4de5e00f441d8410dc62
MD5 96aadbe5b6307bce906200dcf8998400
SHA1 9eaf05a826a54eaf51be9f40fbac92969e2f0412
SHA512 10109f3f1d6cea3405c0f91116aee981e3fce56bb9a4aba449c5a31d25ded53e0e4424d6cc9c1814cad6b5889d805b9fd4ea633d57b70afc670b93f8303b59fc
SSDEEP 24576:dgb6bmBIi49WNNFpg1rSvFv7bY9xsqjnhMgeiCl7G0nehbGZpbD:dgb4mBIBhGFIDmg27RnWGj
TLSH
T102659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 2.1MB
SHA256 81c4c80548d68eee24497e30523dc012a10521e05eacf0f271367b98a4a0b970
MD5 80a39942958c5465fa9696b8ec4cd708
SHA1 ed59a36cd3cbd9bc2f54552cc7563b17a33d674f
SHA512 84bc7b90513aca7b790c68b35c1b26ff3e6248ad6492fd46fee92b4588cbab6e3a9e8fc3b6bb3f53d3029d8e866b249f993dd03b5822d5f1741711535a5eca46
SSDEEP 49152:dgb4mBIBhGFIDmg27RnWGjKoYP9c/3kS84FxKk:dtrD527BWGWDuw4F8k
TLSH
T1A5A5D01E22E802F5E0F6E2B8CDAA4417D6B278160731D6DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 2.0MB
SHA256 8a3e5eede5ce4387bfe5fb84bf76e6bb15e133fe07c0bf515becb70c389740cc
MD5 d2296e4fc60887e8be4a29285c225606
SHA1 5eead0d43093822ab12f417ad4f1c23ed87e1feb
SHA512 1f71b36462105e298a5204c64301f98bde130d773164e6bcffa6b576210600b2e33d9d48d8261bd3b484b6f70e0a43fdad9d4e5913530a8d66568bbf741f07b3
SSDEEP 49152:VTMwBtOmaDmg27RnWGjHoYP9c/3kS84FxKk:ZFyD527BWGzDuw4F8k
TLSH
T1ECA5E16EB7F805E4D1FAC5B4CE238512EA727861073252CB9290C13F5E679D88E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 856a93cf1f6aa1ee2992f7e64b262f271a41ca4d14c5457ec78fa546542c2056
MD5 ee8798a4206281802b4f5538b22e408d
SHA1 5c560a9660031f6389b9570354a04a8c06aae39f
SHA512 26a7b3b9cb50511994b0cf59ce71b6317668534a85ccc75bef4329125dec586c74f499815d2ad4d8ba55176ac0ee1aadcc0d4734fc4f7b43bf118c24df494b41
SSDEEP 12288:qmGYzGSItZwh/zKFagmWXDi7y67pZDhvKlKj2mhB1kS8FFQmEIpqdXHRzxJuGaNk:lGYzGLoYFt9cvbjpf1kS8SeyXFxKk
TLSH
T19905237A37F138F8C8B2D27D96F164526AE175208B2808FF81D05A3F9B11ED0E6B5D94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 5c3a1b2215fd0afb443888e9606c10c428da3483d61e12a4e36d857bd0885b40
MD5 6af93e536db3c897271763fc42b40960
SHA1 77a881f68a3ef292e42863e67769a1e47a34abb5
SHA512 c16c7afb4d51d5cbba1c2be7923df7f2e8033ef6380965689dabb88b4e6530fbe72b52234708db2514ee19f704191d2a28c362811495a3242b142d7b3fd006e0
SSDEEP 24576:jG88u8FpJqH1bzria7/maxsqjnhMgeiCl7G0nehbGZpbD:S7ZFPqVea7/bDmg27RnWGj
TLSH
T13485016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 731037964226d1966abdda0b80ae0b6a5cc944f1e3379062f24731f43d50b793
MD5 b04df32ba876337a53a32a0a9a65b717
SHA1 bf0f98886dd1375fa6886dc3d1d1a413eb687dc0
SHA512 76e81ecb099bc9702143a61d8bfffe90d144e70eed099987e4567b3a228eec8ccf9fde68289c813b5bd7b3ed2372e0225c9ac4211af8c5a860dafa9377d14282
SSDEEP 24576:aPUr+NQ+xsqjnhMgeiCl7G0nehbGZpbD:aJQ8Dmg27RnWGj
TLSH
T1A765F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9f122e977e0742fbf5fc29de52afb4106de4837b4ccb8442ac8088bc0d808c6d
MD5 54144002c8991f63005265a06a914453
SHA1 78103a9182be1b7e58210fad13de0b67f6c5b12e
SHA512 8b91982959fa5fd4c3c1e76fec33069df7d045dc466cce9875e25cefb5401a48f582c11f643496c37f28973818c269fae9fdaba6c967311d7e7109d2b4e52975
SSDEEP 49152:jBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjsDmg27RnWGj:MG05lO43bVD527BWG
TLSH
T158D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f72e2fbefc9838ff16c06e645231bacc7f8ba14fa406bb82b03ff3be985b30ec
MD5 a9cc25bf1dfce719e50f4b6185e91398
SHA1 4619f982661a6ebe51c0444b8fbd4193147ed8f9
SHA512 0a665b58bfe8240ab8efa56d33a3daf65278baa5cf5f3b07475018dcbc0775882ad2a48f0887ccddf6f42dee651613bb0df772ea56bf72891f06b9d04dc153d4
SSDEEP 24576:Xfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnwxsqjnhMgeiCl7G0nehbGZpbD:va5POZ3BJt2pasx2+mkDmg27RnWGj
TLSH
T1F065BF5EA7FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 124fcb85d1116ece3f001f10587c7b423adb79ab02049d72af8b6e39082cc64d
MD5 d2aacf391ebd635a888ff39d1d8a9fad
SHA1 0d45872b95c5889b9c995b6a8b2a41701b17e7ac
SHA512 7a3eaae558581421bb529ae9673c74261a56d2fb9c5c2c9126f2b2992f17308421cbd0333d846762ec19dcffcf83f1d0eb21a31ae3e04a6c4f15c2860ae032e2
SSDEEP 24576:NNcwHdjbyQ4nLC18lb/EOjowL7FkCxsqjnhMgeiCl7G0nehbGZpbD:NNc/zEOVHF7Dmg27RnWGj
TLSH
T102857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\System32\Sgrm\SgrmBroker.exe
Size 2.3MB
SHA256 2863f39950593bd5b09093350acd4f12bbeb7fa371bb918ad743c3a13caf5d63
MD5 9435bdb6f7f3b05c021f8e15bb18451c
SHA1 61e7d6e7c23477e124338feb8fc2ac660a6968e0
SHA512 9f2bf54d332bc8e59801181b59480c09bdd197f1cb93084a454877660a07d5a44cc38ee74fbf4cbab7c4bee9bd33da54e09d2aac0c4a5d31adeb7e9295ffa03e
SSDEEP 49152:PDVHeBIAAlDmg27RnWGjboYP9c/3kS84FxKk:fD527BWGHDuw4F8k
TLSH
T18AB5127EE79C04E4D47BD1BCC6A39906E67238A9033159CB02D181BA5F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 563a492c437dd071a852c5a83d6e234c49c9b5667a17bf279ebb6bfad0acfbe0
MD5 6499bc73ddcfb6489bddabe00e28748b
SHA1 5bbf20ce4dc968cc885684bcb95fa8b095c9452a
SHA512 ba0be1e0122220e4110097149faa9983a0808097f5a093fbb4713558c1284b73bd2731e6991f9901ecd58a1ce32375457d9e6e2ab3b1cec14910d4721f0f78d6
SSDEEP 12288:71Hok6j5ZI7sGSItZwh/zKFagmWXDi7y67pZDhvKlKj2mhB1kS8FFQmEIpqdXHRv:n6DIYGLoYFt9cvbjpf1kS8SeyXFxKk
TLSH
T1E625016D33B610F9D0A7D03EC6D20502D2F2B570872619DF4694897E9FA3EC8B979E81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 928KB
SHA256 9191a778bbf8d801427994b8b59247ef268350ca25cc49d67f80551f25aae896
MD5 587d075e1344d13b60992337032bd66d
SHA1 1c43764fafb0882d61110f33464cff728a1964ee
SHA512 f3369773049e083cb3cf7c3cf6af0363de62fb63b81cdcb894516851620301747eb65eca11713842cd10af631a9114afbabc45cd8998cbff98bd60e6286d4c22
SSDEEP 12288:yG6kySGSItZwh/zKFagmWXDi7y67pZDhvKlKj2mhB1kS8FFQmEIpqdXHRzxJuGay:7tySGLoYFt9cvbjpf1kS8SeyXFxKk
TLSH
T13E15225123E064F8D9B29178DAF251914FB5BC208B244ADF9190AB2F6F32BC0EDB1F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 800KB
SHA256 56f4dd80005cdcd4b1c2769166859bbc1d521fe3fe5601f6483d021e12e81441
MD5 8e7db801a99d0f031d86a74bd279b239
SHA1 2070b4e51df72bc6c1a4e781dd170f90ed22c95c
SHA512 aeff587c75a6ee4cb142bd444478f4685d6ee74f2d0e4079c3fc42b38fc454aaf770cd105e2742dbca7adf9361dd47f98032fb3a1b0411bf397100c9a748be91
SSDEEP 12288:JhzGSItZwh/zKFagmWXDi7y67pZDhvKlKj2mhB1kS8FFQmEIpqdXHRzxJuGaNk:HzGLoYFt9cvbjpf1kS8SeyXFxKk
TLSH
T1E70523B627A068F8CCA2E5BD97F5294107D4B5244F280CEFD1905E2F9716EC0EAF1E94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 b191b3f4c0cc536da90593c395bf2ffdfeecbbdc6d1a26513c2cf8cd9670b86e
MD5 10bc8a0151651257a93570253e420405
SHA1 92d362ec3eaf01c4f3cdd4dd80b30b55d4012a89
SHA512 4d609813e76fc2e46a42642e2ee853f4e6683dd47a50c6455bfa12c4f70d0152f39e87a93c6e7dc80081085d998b6b18627d3a142f69995162d76535dc66e0f5
SSDEEP 24576:8ug74oTfaidZpGLoYFt9cvbjpf1kS8SeyXFxKk:HgxTrZwoYP9c/3kS84FxKk
TLSH
T1F365AD1D63EA05DAE2B2D279D9721493D633B4315772C6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 6f75f6cf748d592ab73fdc2dedc9cb0b75ee956139edeac2fffb0690f9e17370
MD5 76106fd12f367fac7090c60836bc8417
SHA1 1d3b0c4198c72b6bec5e59eb46a64d3e7ac362b3
SHA512 a55ae5610ccd208cd7287842938a2a0ae2bf2d06d184f9dd70886f17fa26a1d523cd26b75c346e5533a9f425c39ee22f8e19e78352f51eadcaaeed57d193f384
SSDEEP 49152:8gb4mBIBhGFIDmg27RnWGjKoYP9c/3kS84FxKk:8trD527BWGWDuw4F8k
TLSH
T179A5D01E22E802F5E0F6E2B8CDAA4417D6B278160731D6DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 48f05ec13a225d23b316270b9946b34e82d30920a52188c14328542b7b2a4616
MD5 cb698aa3bcb09fdaf8b5eaca04ebbea3
SHA1 63f57bb65afe559c85c636b31ac42601dc7b3200
SHA512 a4d1578ccb08aec2e90c6c1e64ccfa6ecf581c58ecc0545f18c779d3c9ba1fd996fe21d97a5187716d31aad6a7edc30389abd661654acb8f659745c9a54b7313
SSDEEP 49152:wAMwBtOmaDmg27RnWGjHoYP9c/3kS84FxKk:pFyD527BWGzDuw4F8k
TLSH
T18FA5E16EB7F805E4D1FAC5B4CE238512EA727861073252CB9290C13F5E679D88E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 2.3MB
SHA256 a2369ff3aa4a19885c66451c44048c721d0790f078ec7ed71d95e8e4f149d6f7
MD5 f1407e85632a84530bb3d806f7e15289
SHA1 bd0271052c507040dc4345f6f1e9081ef87fbdae
SHA512 b6a24b95b2362e1af8f6159d3175363431a974976c25faddd6b36d70ca4483ad2a9d83d49630e1bd4833d4bedea0937ccb5ef5cdd3c55a455eff3937d9b579c4
SSDEEP 49152:FDVHeBIAAlDmg27RnWGjboYP9c/3kS84FxKk:BD527BWGHDuw4F8k
TLSH
T10CB5127EE79C04E4D47BD1BCC6A39906E67238A9033159CB02D181BA5F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 821d2ab362572ef1a1379ca2debe8cf221718890907718cfb75aa92fa8710803
MD5 b774d4a91d4514aec5b2197e42293a7c
SHA1 4ce8241bb5875000d9f02fdf2eebeb76e6e0ab30
SHA512 d0af8f7139d51d1772ce3e1d644cd80bcc690f670323d04fae73fd586f58ce001c8d8613393e23e771e89564350a998d555fd5ba05f93a43b927cc9320c74e69
SSDEEP 24576:fJnJPbzB4SWGLoYFt9cvbjpf1kS8SeyXFxKk:fJnJv6SpoYP9c/3kS84FxKk
TLSH
T1BF35F03DD2A810E8D4B3C2B4825A1A56FF71386C2F2568CB59B4D5353F12FD0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 792KB
SHA256 14f2dd7e61e51d5e583436f923beadaaa3a351148c761080b46c23a01377966e
MD5 df46e77a2b3008311b493fa960014470
SHA1 53d706de03c02a64e443ea61cf6000b3c955332c
SHA512 0b18c322e2775a300ddf349ddce0b2b0416b674ce3888c62b0a65c8b89760617276f5bac98de0f07571d741906126f85262e7521d1a0ce9dfbc2630f60892bcb
SSDEEP 12288:GtGSItZwh/zKFagmWXDi7y67pZDhvKlKj2mhB1kS8FFQmEIpqdXHRzxJuGaNk:GtGLoYFt9cvbjpf1kS8SeyXFxKk
TLSH
T1D30523B227E05CF9CDE2E1BDD7F278410BD4AA148B280CDBD1511A0F6656EC4E9F1E94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 936KB
SHA256 f54b7f4b97cb59b9c4ef50aa0f345053d679d68d4ed3a3c51309e9486c3489a0
MD5 68e845161a279fe84ffd99889b34c68f
SHA1 7476af2cdbfa50383a471085e3a0242a53b2001b
SHA512 647ee30276b478431dceff5063b77ef5639613fbff38bec217c2c5ac9406bd4b620b051fe64dde96a02e1df080767a5670436879dcace40ce1f298c8cd5369ce
SSDEEP 12288:FyG6b3IkxjbBzTGSItZwh/zKFagmWXDi7y67pZDhvKlKj2mhB1kS8FFQmEIpqdX1:r6UqjpTGLoYFt9cvbjpf1kS8SeyXFxKk
TLSH
T15115126A27D028F8D8B69278DAF5511146A1BC31073959EFA1D49A3F8B32EC0D57BF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1456-254-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1456-62-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1456-68-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1456-61-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2108-16-0x0000000003180000-0x0000000003205000-memory.dmp

Download

memory/2108-96-0x0000000000400000-0x00000000009A0000-memory.dmp

Download

memory/2108-0-0x0000000000400000-0x00000000009A0000-memory.dmp

Download

memory/2108-1-0x00000000027F0000-0x0000000002857000-memory.dmp

Download

memory/2108-8-0x00000000027F0000-0x0000000002857000-memory.dmp

Download

memory/2108-6-0x00000000027F0000-0x0000000002857000-memory.dmp

Download

memory/2108-9-0x0000000003180000-0x0000000003205000-memory.dmp

Download

memory/2108-295-0x0000000000400000-0x00000000009A0000-memory.dmp

Download

memory/2672-133-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2672-411-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2672-125-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2672-127-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3500-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3500-137-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3500-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3500-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3992-410-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3992-408-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3992-120-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3992-119-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3992-113-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4200-57-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/4200-59-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4200-53-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/4200-47-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/4200-46-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4604-97-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4676-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4676-139-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4676-145-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4676-159-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4676-157-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4860-412-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4860-162-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4860-168-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4860-161-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4908-28-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4908-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4908-30-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4908-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4908-22-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5932-74-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5932-80-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5932-72-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5932-376-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5944-100-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5944-90-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5944-423-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5944-425-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5944-407-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5944-98-0x0000000000740000-0x00000000007A0000-memory.dmp

Download