2ca686b4b5c8325a455e03eaa385fb2e175080f8112f68d7b08191091197fa2b

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 16:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
Size 2.6MB
Sample261104-t3qmhsbw21
SHA256 2ca686b4b5c8325a455e03eaa385fb2e175080f8112f68d7b08191091197fa2b
MD5 774f17c147e9e319463c0f461aaf9f04
SHA1 dd094ac8de356a32ef2aa28338ae8718acd6c7f9
SHA512 e28226353fb42e86923850e480a764d0f62c3c75d6cf2472a2b30cc74e530fd75b6c488cb798710f71a288a179005638b9df3973f926b578282d09905672f755
SSDEEP 49152:wT+i4GvA+7srK0Y4qKQCFw6do0fi24ZRZDo9R:wT+OAprTY41QanhfibjZDc
TLSH
T134D502123AF4C53AD2914630CE6AEB98B0F6FB740D354C4777D42E5D2A79891C31BB2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3448	elevation_service.exe
6024	elevation_service.exe
4064	maintenanceservice.exe
5916	OSE.EXE
4268	PerceptionSimulationService.exe
2396	perfhost.exe
5620	ReFsDedupSvc.exe
5904	SensorDataService.exe
1708	ssh-agent.exe
4780	AgentService.exe
4692	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\40dcc8d1b68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000100000000994e-336.dat	upx
behavioral2/files/0x00010000000093b2-334.dat	upx
behavioral2/files/0x0001000000009323-333.dat	upx
behavioral2/files/0x000100000000a315-349.dat	upx
behavioral2/files/0x000100000000a300-348.dat	upx
behavioral2/files/0x000100000000a2bd-347.dat	upx
behavioral2/files/0x0001000000009369-346.dat	upx
behavioral2/files/0x000100000000a1d0-345.dat	upx
behavioral2/files/0x000100000000a0ca-344.dat	upx
behavioral2/files/0x000100000000ba3b-343.dat	upx
behavioral2/files/0x0001000000006211-342.dat	upx
behavioral2/files/0x0001000000009b8e-341.dat	upx
behavioral2/files/0x0001000000009cfa-340.dat	upx
behavioral2/files/0x0001000000009cd2-339.dat	upx
behavioral2/files/0x000100000001b987-338.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e311c8a7a6cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000055aa0a8a7a6cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a2699bc37a6cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c747eb8a7a6cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009ba38a8a7a6cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3448	elevation_service.exe
3448	elevation_service.exe
3448	elevation_service.exe
3448	elevation_service.exe
3448	elevation_service.exe
3448	elevation_service.exe
3448	elevation_service.exe
6024	elevation_service.exe
6024	elevation_service.exe
6024	elevation_service.exe
6024	elevation_service.exe
6024	elevation_service.exe
6024	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4472	2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
Token: SeBackupPrivilege	5620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5620	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4780	AgentService.exe
Token: 33	4692	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4692	SearchIndexer.exe
Token: SeDebugPrivilege	3448	elevation_service.exe
Token: SeDebugPrivilege	6024	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 2640	4692	SearchIndexer.exe	99
PID 4692 wrote to memory of 3184	4692	SearchIndexer.exe	100
PID 4692 wrote to memory of 1744	4692	SearchIndexer.exe	101
PID 4692 wrote to memory of 2188	4692	SearchIndexer.exe	102
PID 4692 wrote to memory of 296	4692	SearchIndexer.exe	104
PID 4692 wrote to memory of 3320	4692	SearchIndexer.exe	105
PID 4692 wrote to memory of 4984	4692	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_774f17c147e9e319463c0f461aaf9f04_amadey_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4472

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6024

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4064

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5916

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4268

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2396

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5620

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5904

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1708

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4780

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2640
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3184
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2960 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1744
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2928 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2188
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:296
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2928 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3320
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2960 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c8aec47ee6f1ff56ffd9b642578d89c074d5f87b5ddac7c838305f1a03dc9e2f
MD5 2c6a8f41a6c783d8bb6943114941abbe
SHA1 26dbef20c2968d6345f654c555a2187991edf248
SHA512 33523e38c6c1432e15e18850bd11c0355e6d75752c282dff98dc8e49227c9b3e451863f15ca7136aab2950e12b488fb11be84769ad5fcdc7979dca1555dcb03b
SSDEEP 49152:eb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnjA+7srK0Y4qKQ:g3q6sjBeAprTY41Q
TLSH
T1ABD59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.5MB
SHA256 993d65adf352e49e8abb0278f14e5c73291f50bbea34efafe52a17dbc57ce945
MD5 4421e008621bed9a2f144321e292a8b9
SHA1 aba372448fa68e796edb27cf644bd4eef6b0e873
SHA512 c3537901ac94346b37a224393f7aff52ce39f5f92672ac07e25262cb4202d8ec91d03202028a17e4170a1dd93b9af70fb9a480f95e0bdc409950d30fc522969e
SSDEEP 49152:FtcpA+7srK0Y4qKQQFw6do0fi24ZRZDo9R:FmAprTY41QgnhfibjZDc
TLSH
T168C51225B7D449F9ED9B827CCCB28415FBB378510760D69B43A86A260F372C44E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 50e7f03e9f76ecb9ed92705f328c81042671dc8efec9fe252bfb71caf78c8119
MD5 225e28b3f280d90e5788dafbd0d2b6da
SHA1 dec9e33f3423584764e44fd1e737ceb163eeaa4d
SHA512 f3bdc3f104c02379e5747c4d637bd61d0f93db2b576cd92f69bdb91b83d8f23e135f7c8a6dfcd1b15dfa8e97f7d944c43b987fc73303fab51d17d89f41d45767
SSDEEP 24576:3XYfDtczACAEL+H8ZaUGNM0Y4WlBjV1SQN:itcpA+7srK0Y4qKQ
TLSH
T1E285F12967E449F9ED57823CC8B28506E773B8514760E79B03E49A260F337C45E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 ad5497583fd667d6c3b5d080d8c855bc6a4bf05a6c22a3abca8b70b1eeaa81d8
MD5 2cd54704e95b8193a5d607229e4d35ab
SHA1 306c50ef66d6dc728be30d56c7770f9ec0c9d0b5
SHA512 d7c0493f54ade066e3bbd0434f58463312d49f61cc737bf16b7eb31f766420c31bed6b05724c17b377565bf7456bff78d230fc9da242c9864fb86972e4edb961
SSDEEP 24576:g0Le5ji0hmxirM7AEL+H8ZaUGNM0Y4WlBjV1SQN:gPji0A0kA+7srK0Y4qKQ
TLSH
T1A2A5AF16F6788735D073C0B9C5D2A68EE972308157308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d41b2b06f4badaa0ce87720c4546d167397b502c38eeb63c3c9c71ed660b681a
MD5 bd4a9da35c3b7ce0f51b2c7b2bd21e0f
SHA1 74b6d155f174651ad8ae77f831e9824325968505
SHA512 34a0ed282e764d027cddc4d8f6e3e72e724797fe3b20675fdc46252a38d60bee59f9eab068828707ce44ea0d0818002699c9f55b4186ccffd8ceee5e492f5713
SSDEEP 24576:Ba7/ezSC6vUyD/aqgrvWn6q8wyu5AEL+H8ZaUGNM0Y4WlBjV1SQN:A/ezSC6vUzPveHjyYA+7srK0Y4qKQ
TLSH
T1C7756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 014b92796b02ed70ff0228640ef1fd53bef3070bd695abf385f8739cbbfbdd5f
MD5 905240f320676a98932b830453a2df71
SHA1 847999b68da209ee083f1fb9786ff59879eff904
SHA512 dcecb78cea9052b039fe76163cadf728adcf4596532e4068a214ec25714ed7d449d270aa062c8be6bd11305490cdf144b130c51cd30fcc108f0683df25e19b0b
SSDEEP 24576:XVbqPb88hv/l+YuAEL+H8ZaUGNM0Y4WlBjV1SQN:XVO88hXl+hA+7srK0Y4qKQ
TLSH
T1FA559E66F674C331D073C0BAC5D2AA9AEE3234414B318ACB5246D76C2E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 08cc7bc90dd30d22e1f21fd599a91717abe615f2d2513e08a1a6a91a5b89889e
MD5 b10c28116cfbea3c7ae67b1ce5770973
SHA1 9f9ce2c3acdf1ecbdca741e95051dbc72aecfe9f
SHA512 0c750f883d87e5439a9e2cd7c853810648d85bee9e31b1a739b16f5dc29e65e44ce26fa73e6ef0331cc3fe278e87f3385b3869a06056f2a5681f112d035d8a87
SSDEEP 12288:Kd3ARSL+H6F3V8eaUinNMD4PKUc4W9TnFPJjl7BorES+fhX:Kd3AEL+H8ZaUGNM0Y4WlBjV1SQN
TLSH
T191752397876CCEC9EB8E0634397A2C5FD3ABDE508891521AD3587B1B44BCD80C52A1B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 6ae431b6d4627fea48a326ae1b45fb80538e9cc6800f108e50232034fcc51850
MD5 9dfe4527178057f641ba8a2aa8aeaf21
SHA1 e45edb915c8449ba4bcf57bd8629506fc31e88d5
SHA512 45f8451125357f05a73e964e8f9df53ed213fc87258cc32bdfc432e88e72884640ffa1a74dd8e27c034d233669b8d5bc6819fc616d70e10fd93ac00d1e72f3e6
SSDEEP 12288:CeBNUbTVO86UmARSL+H6F3V8eaUinNMD4PKUc4W9TnFPJjl7BorES+fhX:CJIUmAEL+H8ZaUGNM0Y4WlBjV1SQN
TLSH
T14685CF7BEE28FCD2C67E4DB85A918640D77278704B61A3CBD265830ECE235D05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 10c057572f3145abec9de0f97d5dac1d5ce9c23ca018df2a74d873c320f2636f
MD5 b97b555d404ab36c0018030d2e43fa3a
SHA1 dfc50009b5fefb46f321cb80d7e183ec2867e95a
SHA512 40c37e2e68fad3ee346de38195bb2714656fd7332b04781709d70db379cbf5b64572aff58e54195be04818127212feef1a63f1c4269089fd04dd038bd4f2fab7
SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THG:wQvGAdlCEL8c/DRNw5CJAprTY41Q
TLSH
T1BA267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 26789eccbcae57377ab022a6ea935f768a0daf4bb506c16d00a435cbe9ea9756
MD5 bb08124ab7128efdeb31c8d58f170ad8
SHA1 9306f1933fe36bd1620d38c1eae7a788ad8ae0c8
SHA512 60cc835e7960436ce5531f316dc2053bebae32ba6944a0f646ef699763ab14414ae44a198919241f5d722446a8cb661f2f1b1e0614ad3a5885c9852f60a50648
SSDEEP 24576:U1ewsAj0AEL+H8ZaUGNM0Y4WlBjV1SQN:Alj0A+7srK0Y4qKQ
TLSH
T19B95E031FA74D436C7BF0DB11B36D71A547DBA204B511AC3E3A89E9E49742C22336A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f0bb8402f185d9e34ddd489c2c24602d8e587f34a71f8390be5fb95cd11b473b
MD5 d9bbf169c30805fad97052faf389e68b
SHA1 e8f4ec46cd34c0510281b3229b604786874459d9
SHA512 792bb206990c636a0a7473f17033aa7357601d9f1d7fb4a7d65cb35a24c6d435cd26af14e6a27636ecefa128b2d3d26d59969e73e9451822d7d3b1bf5df47e00
SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH8QrTY:eUEtQevvqc2W1cpV2tI328Q
TLSH
T1A4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8a67f5db4d4510234815379b21ce7b6aece7797b698f8ed9b1e8a7d094604180
MD5 0794fa4aebd26793fa38d68c5cfbd1b6
SHA1 f91421ae946eebdab07435fa056ead738711f9b2
SHA512 0754f3c4494dd8ec57de73f14e518aba6ece7639e7718a0c0fae5973c171b57017ad9d776f1fcb42258101663a48596887cc9d19f98f52e84314d9c9c3bb9cd6
SSDEEP 49152:DCbRquA/m2yL5zLfFiV+XenmE3/zUA+7srK0Y4qKQ:8oq2VjnmNAprTY41Q
TLSH
T114D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 47bcd6248e29d74b5c9ac607c38028ac738d0dfc85163d1b602b2b4ffb59ff3c
MD5 bc28fb3f89d40c5fec1e818d720383b5
SHA1 5f44018ddca787768b9a73e2051dfd95396bfb0f
SHA512 c40340b670ac61c8d80a44d287d059da0e2e6028303a03573283dfaafb0768275ca1187b9c417f37c9e5dc2f219057558ecbaadf0295fad98e4f2f518a6bff4d
SSDEEP 24576:zAhGL3IFoiwtA5l7S53tAEL+H8ZaUGNM0Y4WlBjV1SQN:zAMUFoiq5dA+7srK0Y4qKQ
TLSH
T19F35AD81E7F945D4F5B3AA7899B69571EA76BCA55E31C20F2260D20F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 a16afa8b527fe2b37dd80be48e66eda0558a654acb81acded38e9f1ec4f41fca
MD5 2ccb0925dc03c327a0eba14af73b7ac3
SHA1 9ca306760a5cf0c767084a9617b0e8f78f8a6308
SHA512 1c35d6021a04d602b4ab307131134de413fbd3f5511ce897c1a51bdcc2b84f6aed5d3195c08e5471b8780406637ecc7a5dcc90b45c7242f4c6d5db5db9496237
SSDEEP 12288:zmw5HEjsChNoBFgl0WDm+CZARSL+H6F3V8eaUinNMD4PKUc4W9TnFPJjl7BorESc:Swu5OW4AEL+H8ZaUGNM0Y4WlBjV1SQN
TLSH
T1DF85F14A77A84CF9E9A7823885678536F7F3B8012A21D71F5360C61B5F37351AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 b8b0f64b22cf4c330a3ad198a5d2b347cb5ad882ab3de906f36c3f0b1b814152
MD5 0d7e8d953f1dfb09eb16b982d359850c
SHA1 356955a6e867bcc5dde9a6207d94015d24873f3e
SHA512 8b19bfa9a45f014e8e5634c9df0976724d43b91e8a92dd8e3642971c79191d942a3b373b84a8aea2407ea8f6ae3deae7e27004947e3165ed81d0ed01c2023e0f
SSDEEP 12288:jkZ1IyEARSL+H6F3V8eaUinNMD4PKUc4W9TnFPJjl7BorES+fhX:IZuzAEL+H8ZaUGNM0Y4WlBjV1SQN
TLSH
T11775129B23E8A5F9E687423899B6190AD3B2B851477143CF9368571A0E77EC14D3A333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b58d8ba74fca0abb82ffd8d0ecd785d8ccdf8f08fef3d07ac850508e9f78fbd2
MD5 26ae1116965a8da60c5d8e4c518b9ad7
SHA1 e5b5ab1dd79524a539844dee65090910cf31f6ce
SHA512 25228c9a66e82a4990299bc62de8d88a0721b26a24fba0ad7a9cd588b7eebeccef26e34743cd6d4eb87bae9f3e2808b2a0aae70c98b5091a4bb49218268f48a3
SSDEEP 98304:jQRQyi36YOcPbLvw2gAf+PN36AprTY41Q:yQyiKa/X+PNqQrTY
TLSH
T1BD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 896c0613910df4e9531c3f0a9f951ccd19dc86b258ba00165901722fcc82dee2
MD5 8565ba9b288e8383b1343e1db26133bd
SHA1 ad62ee4a82a489ec609d544e5621f8dada6a5649
SHA512 1a1c601faa162b162eadad3d8d636ea84804d3483805ed5f5e2ed871d1067b1aa2bcaee20d2498162baaa970de43e6eaa374d67bf71a1382f52715b76197ba70
SSDEEP 98304:iQRQyi36YOcPbLvw2gAf+PN36AprTY41Q:5QyiKa/X+PNqQrTY
TLSH
T1A6667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6a123aafb2dcff544a8d6f27a7459e71ce6bb09960f30d7b6421c065af34f5fa
MD5 ab74ab81e6580db8a024c2ec51318cf9
SHA1 1b118a916515c6e703e8c0113189e1cefa295215
SHA512 2eede6f28e27d4edb174b170f2d76cd2aa2bc28abe6c8c5263caace93acfaef6bbf7b325791f7b5b719d13665953799026a0d058e96a4287ba64f63361a60ea2
SSDEEP 49152:U68Qg55nhceWu7PNU3/kA+7srK0Y4qKQ:+thLRc/kAprTY41Q
TLSH
T1F9B54A33B2F60099C44DE1769F4A972196D27C718FE0E3DB861572061BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 199a62921f89a9aaa05ec16977ab1842e1efcca4ff08fc4347db491fd144bde1
MD5 82e4d8d278c71fd5142e34b621d8075a
SHA1 8aecf997b320d7d6cd1d34cb4791387ebfe8738c
SHA512 17c6454fd0e260c24b8439751a4d4d607e84864c02045dbc579e7e250715970a9f1299ffa83fa485c267099ae9b41d3cebb269e5e3ef1a22f92b8d300dbb49e3
SSDEEP 98304:ky5112gYy5azzVvt69nLKnhZ3AprTY41Q:lLIHEWhVQrTY
TLSH
T10C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7e38b62298cc7ca18236cbc691ba4dc04a5c7ef16aae250da6c2799db6082df0
MD5 149029f5618dcfb3eb78e4b91d6f621d
SHA1 7e9ab63a412e00c577c2e5e90ba7175928cd1b82
SHA512 6927640289dc55daaa610102eae3feb9f979b1abc4e3d534fff1c336217057d1e930c76d395c31da8d0177d737fce3b06c53db79eff0f4c5a19824b3732286e5
SSDEEP 49152:sB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glyA+7srK0Y4qKQ:mu6Jmdxd2dyAprTY41Q
TLSH
T10AD59D13F1DA01E8D05ED478974A9233EA62BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 81b7144014e338d7e18582ce5a4860e2a129cb08aa33600090bb01585245f12c
MD5 ed949e5ecd66ceebf2c87e89750e8043
SHA1 38b3594bb9a6b3d4500836e6e60da93c329daafc
SHA512 05a0a34d42304265c4de9eea50118c3867ae3c29f3ef62022870b172928066ef97b10e3a43dc4f0c16cd0d2b53f039bab3554c2ed9f344a3797590b61144d7e9
SSDEEP 49152:a1hpsNoJpF1A63U44CwH7R4xGA+7srK0Y4qKQ:amifPWRNAprTY41Q
TLSH
T13AB5BE13F2D801E8D05ED178875A9632EA62BC460B30B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ef21420e0fd78a450f2788509e199da28b043672dca9c4365495e6324f9ac97c
MD5 5365efa2edc915df9dd72113077c649a
SHA1 de90adfc63a33912060c47481ca101dc65b5fecd
SHA512 9aa2a1048b8aecc1acd8ab713e4bbfa71ddedd6a2b0d98022a5cc13b5598e8527f02a26ee72ba150a7bf349a222677e7d3e2ed238947b64b0ec43a286dff697c
SSDEEP 49152:oSuZQIY0Be2KcRVtOnks6NMHqzA+7srK0Y4qKQ:y5dKii61zAprTY41Q
TLSH
T19BC5BE03F2E941E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a656e393e23e6bd3c3144ff7fae09867c2e2d88198ab445ec7e6fcf035b20612
MD5 4f6fd30c7f1a9136d86ef568852eed1f
SHA1 e594f9930a6c35c973cbb887adb1637416916fca
SHA512 742ca1ec7d5c0a787f6f511e94cb75aa63b6c68899a506fcf62e110826aac9fd636cca047ff8ef764496b781d736335afabfe89613e3ec4c8912b56992e34d34
SSDEEP 49152:chtSn8EApI0fig3giDn0AP5wCA+7srK0Y4qKQ:dX2imphxAprTY41Q
TLSH
T1CA95BE13F2D900E8D05ED178C7568632EA62BC150B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 a0832796b110282cff17e83530dc319309891b0bdee37043473d8e1c46600d9d
MD5 74d03297228aebea7285b7cd49138f5d
SHA1 8b90b4ca13635360920527b76d1946b15a1735a2
SHA512 86455d92aee23053ebbd7e89b6b34dc3793d21498514c591622c747fd80977e8c787366bdfc9fa8cce91700adb9595cdb861ce4943ff191067b37436a8c49fa1
SSDEEP 12288:pvARSL+H6F3V8eaUinNMD4PKUc4W9TnFPJjl7BorES+fhX:pvAEL+H8ZaUGNM0Y4WlBjV1SQN
TLSH
T1B375239B976DCECAEB494674393A284FD3AF9A408491125FE35C7B0744B9E80412F4FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 dc7b4f4d84f377815dd13151f85dc6f381ebecf370ee1554d698ebf8296eadbd
MD5 780b9f4dedd2e578a0f29e6dcc19edf4
SHA1 c05b252745232fe303612c1ab3990b17f4822f18
SHA512 b6eae9b206d84cbd143ce28abdcc78fc5e64c04d6bd274028216039674ebfcea5c2ff0da88ab46974dcbf90eec25a415b871d8ec6109b73fe2312685a11f2ddc
SSDEEP 12288:kAARSL+H6F3V8eaUinNMD4PKUc4W9TnFPJjl7BorES+fhX:kAAEL+H8ZaUGNM0Y4WlBjV1SQN
TLSH
T14D75239B9B6DCECAEA494674393A284FD3AFDB408491125FE35C7A0744B9E80411F4FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 3ae10e13ce6e0377455fd684f5f87fccfabd97220ccb27a15249ec7deb88ffcd
MD5 2439fa2611364a9fa7b37db912d61a1b
SHA1 f3fc0badd5171c265298e8989d24018b1860779b
SHA512 d5fac0bf5dcbbe33519693cc53e946c60055824181172b71d03439580d0bbe359322673b3c9a17601fbd39d88f988862c475f784106abeb25c242df0d5d997d7
SSDEEP 12288:ZeARSL+H6F3V8eaUinNMD4PKUc4W9TnFPJjl7BorES+fhX:ZeAEL+H8ZaUGNM0Y4WlBjV1SQN
TLSH
T1DF75235B9B6DCECAEA494674393B288FD3AFDA408491125FE35C7A0744B9E80412F4F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 5f733f1ac65c6efcc0b990e7dafa5397965162f23b6c1abd97349a60cc185c94
MD5 edcb9b651d4cfff9eac1713f62c74f17
SHA1 b350be29181b34fc8374949f6fbf664b6510534b
SHA512 1dd31a6e08a6375abd678389596d73a328d257ee9aaf439c4fb665370ef30983d7c0248a680c4a17adbfc2f3d39357004dae0388ca74f37707c2ef8a98e27bd6
SSDEEP 12288:fVNARSL+H6F3V8eaUinNMD4PKUc4W9TnFPJjl7BorES+fhX:3AEL+H8ZaUGNM0Y4WlBjV1SQN
TLSH
T159752357576DCDC5E98A8274A936284FE3BBFD908671139FD3083A0B0CB5B804539AB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 fe0c448bfc4363e53e8b4a7b58c96bb300746b214156a5d72f17c17733a1de03
MD5 ae9f33b64fc4aa8d76f8ca35d07112c3
SHA1 1c489ae9dc37dd0af3b5e7a573322dd03512151b
SHA512 809ad62cc8548239053780bc97e7de4b4114a2ca8248a4b271924865dd4223067af4cccef5c73165996eeabc9766bfbacbf509acd18f23ffa1de175e45ad8e75
SSDEEP 12288:U1ARSL+H6F3V8eaUinNMD4PKUc4W9TnFPJjl7BorES+fhX:U1AEL+H8ZaUGNM0Y4WlBjV1SQN
TLSH
T19775235B9B6DCECAEA494674393B288FD3AF9B408491125FE35C7A0744B9E80412F4F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 ac30eeeece27770162f8ec99f660508c090737a3541a80180382b908b243abc2
MD5 685431d99eb561d26ab7aa0a4effa632
SHA1 d20c8a6c66a08849b4aa9459ead85854c3ad0305
SHA512 08b8df2eff4d79fd60da46c8d8cabedb5ba97f6842400a9a87090b9c15e6cf5d78f8f79a59d218e5f4efefd5e3fd48b9207060c766e86f4327c5cdb9884d2f64
SSDEEP 12288:1MARSL+H6F3V8eaUinNMD4PKUc4W9TnFPJjl7BorES+fhX:1MAEL+H8ZaUGNM0Y4WlBjV1SQN
TLSH
T11875235B9B6DCECAEB494674393A288FD3AFDB408491125FE35C7A0744B9E80411E4FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 19882ee8234dab3ac2a0ec25dfca6bb592fd2ac510cfc48949561d7e90746f70
MD5 97c502bc0d898ed78e34639febb05eff
SHA1 f7592961bc0c2c4852783e81e463e6f3c6c46152
SHA512 20cc8ab8f938b484dfa07a1ef9a27517dd063807c70de9f093e09459e373c5d70b846e829f0c44cd1c7cf2d1d2bceccdc1a9554495a3d97e13a92334d4954da0
SSDEEP 12288:boARSL+H6F3V8eaUinNMD4PKUc4W9TnFPJjl7BorES+fhX:boAEL+H8ZaUGNM0Y4WlBjV1SQN
TLSH
T15975239B9B6DCECAEB494674393A284FD3AFDB408491125FE35C7A0744B9E80411E4FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 457e637889162be68c659d0692818591a69137de3fcfc4593735a0c4eeecd525
MD5 ed4d7bd44f403352bd127989bf3ce0fe
SHA1 28463f57b4e2031ed73138a4662c7431dbd47d13
SHA512 e8d268571b43d302db5d0513f25aa033fbdd20ce8581b235a1f3e6ff21f8bf3261c6465741c6a6ed884c5425e792be1319f99996da4dd03a93be7293a8b4aa39
SSDEEP 24576:mZM4zFVSOgAEL+H8ZaUGNM0Y4WlBjV1SQN:mZM4zfcA+7srK0Y4qKQ
TLSH
T11D850195B3944CF8ED67823DCD25590AD2B2BC550B60C61F53A8362B4F737910C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 bf44320107f47914e95c945a8b5cdfe07f380fb30601cb1d5d0b2a14511c1123
MD5 0e600ecd897bf67e18ff298d618e9124
SHA1 f23b4a642fe9768825d05b5c345dec1ca759fdb2
SHA512 3e42e20a5005e1e9324c91844a031c2a794429c97f32e66b928b8be2f01b2128a82b9d5d864b3fc06240e04a51761f358426c739c3dc4928c0c727a825571459
SSDEEP 12288:zDARSL+H6F3V8eaUinNMD4PKUc4W9TnFPJjl7BorES+fhX:zDAEL+H8ZaUGNM0Y4WlBjV1SQN
TLSH
T12F75239B976DCECAEB490674393A288FD3AFDB508491125FE35C7A0744B9D80412E4FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 2ced27e4dcee83f29472b4989a67eba3c7bc84573630e55c48c1d8b5664e7e79
MD5 3abf4facc68f0d40bc9e2b1c3121153c
SHA1 6cb8caeb8f87f923f397de3cb1d2da927c32a95e
SHA512 0f97349da23eb8207b42f5287ee92e16cf8f4712d902e83d0ffe63c42c6e2f51626e695568ad2a6fd5fa361af32c40556cfc923023cde3976340a787a06b3f08
SSDEEP 12288:vHARSL+H6F3V8eaUinNMD4PKUc4W9TnFPJjl7BorES+fhX:vHAEL+H8ZaUGNM0Y4WlBjV1SQN
TLSH
T12475239B9B6DCECAEB494674393A284FD3AFDB408491125BE35C7B0744B9E80411E4FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 4dc6ee034eb563779bf91a43f06a34ff3f91d5d9f5020e96312c6d953ac53747
MD5 e95f29424eeecfcd1451fa77e4d5b4ca
SHA1 51a3adc24bf2cc7f69c481c83cc712bbba1e8265
SHA512 c2221bb11a88f23e9ae14dca219aae72efa7f2086ce36ca5609595c7a9b5190d00aa576e0714b033b82fa3bd7197e7386ed389c4fdfc862df4a02c3d0eb22106
SSDEEP 12288:jyPz5L8EARSL+H6F3V8eaUinNMD4PKUc4W9TnFPJjl7BorES+fhX:OzyEAEL+H8ZaUGNM0Y4WlBjV1SQN
TLSH
T12475125773A564F9D16A823888721906F3B6B83147608BAF93A417371E376D08E3FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 56b96f562e54cc0fe38f7d19850aa678dd46c05486db536f0b06200fe2351e32
MD5 6ffe99df0425a368abb15155077d9eb5
SHA1 2d9c097eda6013902a8e589b58dc867567f04728
SHA512 f7a5247a093846154445d68830e4c3d4e5618bdd04070ea0e63726d90e4aeed18f72c0a8b34a7102209654ddee37ded8d86a4bc0c8761a67df75f4d099ddcf6c
SSDEEP 12288:4DARSL+H6F3V8eaUinNMD4PKUc4W9TnFPJjl7BorES+fhX:4DAEL+H8ZaUGNM0Y4WlBjV1SQN
TLSH
T12175239B976DCECAEA490674393A288FD3AFDB508491125BE35C7A0744B9D80412F4FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 3d950da78b88ab180e46b4c9d4e64de17de03dc407556d9fbf0a88332b9e4d50
MD5 9bc2259b3e884bdb820466c57f9c4780
SHA1 20a7cfd5f098934bd8e387ec5e15a56fce85822b
SHA512 8ec90d721c07516097fdba911df11dc3115fcbc9f2e6f41a7775b5670acdc471fcb9f2251c7024c746d284fd6ebb01a0b0a0681d6dec696dfe9c57836c64b457
SSDEEP 12288:PDARSL+H6F3V8eaUinNMD4PKUc4W9TnFPJjl7BorES+fhX:PDAEL+H8ZaUGNM0Y4WlBjV1SQN
TLSH
T17775239B976DCECAEA490674393A2C8FD3AFDB508491125BE35C7A0744B9D80412F4FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 301b9d6db4e2805676253b087ccbcfbf99d471e174177badf97a1f546b78cf19
MD5 6d742ec8f4d77e9494ed55e0e0c6c0b3
SHA1 daf7e70970893c0ef53d2a9b6b71c5c85a02649c
SHA512 03fe0974a2ff4954bd7a039fd0f8b7caec213ceedeca45b4ebfd78d9d9d6c6ef41839a9c8fe96505a772b3fc62180bf77ea47bbed2fafa609b10aad4fb01f15b
SSDEEP 12288:7yPz5L8EARSL+H6F3V8eaUinNMD4PKUc4W9TnFPJjl7BorES+fhX:2zyEAEL+H8ZaUGNM0Y4WlBjV1SQN
TLSH
T13075125773A564F9D16A823888721906F3B6B83147608BAF93A417371E376D08E3FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 4c4797bbe447b70b215cb0ddd7640bc8425d5f1be66f135fc2de5561b02e71ec
MD5 78f54e9399a5842935e4ce8612b6836e
SHA1 d94c31a2a20c4cbdc4fbd38c88000307223a74b6
SHA512 6624626ed9d8638cb72f691bd534cff994555817a97c610fa9a9895f9ae9bf88e758e93112b33af6db496208fc6e1e22a4fe445993b1937e68addefcfbd1b430
SSDEEP 24576:qT2aLl3z0zDOAEL+H8ZaUGNM0Y4WlBjV1SQN:qTVLlj5A+7srK0Y4qKQ
TLSH
T10785F1A5B3544CF8ED67813ECD26590AD2B2BC550760C61F43A8362B4F737910D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.7MB
SHA256 a1691f33342c3192de1284ca4fd72db427fdf7a92c82654537366e907f9b03e3
MD5 99cf8b259299ff1273b112430aaea5b0
SHA1 05744245af46552a9e1c5d1b65bd26496b006002
SHA512 8b1bb07f051c86d5fad9524da4bd971c1057f16d192c84558a0ab385b7866e388d532980675712fb171b3d35057585ac81a53f23dc6305871ee98d40f368c76e
SSDEEP 49152:cMnYIXA+7srK0Y4qKQ8Fw6do0fi24ZRZDo9R:3RAprTY41Q8nhfibjZDc
TLSH
T1CED5F129EBDC48E5E1B7927C98B7460AF6B178290B31C6CF125A136D0E37ED05D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b382e736bc57390bff2db30a08c06160fba12c25cdf676d124238aa0944cea4c
MD5 2a46840a073a2eb30e6661c1dddda50f
SHA1 6a437ee6832d1b48e637bb575115224059255635
SHA512 df9e70674c8ed65be58bac06602251ac0c011bef17b99e824488e2a92c054587a4d36f371c57de886972cb5904e0c1efdd8086bd8549520cf23c5f22d061b726
SSDEEP 49152:5YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0iA+7srK0Y4qKQ:UySzPaAprTY41Q
TLSH
T141067C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 645c4cfba5cf3083d41fa434e5cc3ebdd7e7c6d984cf7ce474ea53cf5e124335
MD5 a785cd9ca59231c162b07e9dceb023d9
SHA1 6426b83835abeb25fd48eae027c5a22fcf567497
SHA512 979b0ae75b1506f39d85bd45812a4dd727355a12cda515b4c27a47cb2024258485ba4bd59d7159703f593a3188cdc2e8a85af1b90f7e8a5a393fe10893325345
SSDEEP 24576:x47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYwAEL+H8ZaUGNM0Y4WlBjV1SQN:x47JUQjTirIhCnDHUPfF/yA+7srK0Y4W
TLSH
T19765AE1EA3EC01E5E1BA927885154A5AEA71742D1F31CACF1270837D6F63ED48F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 3417207953a84fb56f69960edfdc9a604da479301999da70a6562b54ede8b209
MD5 6638bbc517f86670fcf4be626ab1ce34
SHA1 f3380bd26636eaec89e136ab4d8288d54cefbf44
SHA512 3d97d97d2f0348b59df72503128aaee2537b1fe224858e2b157a87cbd552c18d15864120f011e1ac21d99c5d8ca65f82c2c547fbefd19d81f0ef6e2b63b18b00
SSDEEP 12288:42sfzARSL+H6F3V8eaUinNMD4PKUc4W9TnFPJjl7BorES+fhX:YzAEL+H8ZaUGNM0Y4WlBjV1SQN
TLSH
T19C75F11AD29886D8C05E5274CB665A46F3777C2087E193CB93D0F53E0F7AA808DEA753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 fc6139d3ce6ed4dd7d87f353df4f216e22f4049820364a2bb3c36667099dc435
MD5 fa49403ec33364c6d23f839377765d74
SHA1 2579f0a88562c4009e38564684f929a28a29dfe0
SHA512 b0237ac87f221c7d513727853904601c8132d27b94ae3f1cb4a64493489c502dbd235b71617fe97e47eb3d2f8f658d86467178b53a750a7ab1d7cfbd29fecd0d
SSDEEP 12288:CXPRUJZv//Fw+UScYhLB5stBma1DJRMwkVj:CXeJhBUYBvstBrDJRMwkB
TLSH
T131352800B666CB4FC66944326E37C1CCAB707D51EE05AB0773C9873F9576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 529d26101858879fdd30b24394cebf5306e7626230b44fa076aef01c902cc40c
MD5 7b0f9c1fc5ea757b5f868295d4eaf081
SHA1 b826d533fd46c00b760b186530a8e4045d076a7f
SHA512 d53dab6839515ffe39ccf9c13dc321b53f1e1d55f31ac30516c33f96cbcc018eb21e2d934fb24cc8a042ba9f26041124e6bf0e0dc26822f89a92f9b54c0a599b
SSDEEP 12288:yePx468PAkK3w9JUnZFCvVS7H8Bg1f9ub++4DPaUgcPNCPkrsWl:yZG3YWl
TLSH
T15465FA41A437A7CFD1B76032072A9B4CAB74EC06B7056F26B3C9143ED82A751A0F97D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 f5595e42f06d5d87f6d669c8d683f42c98cca40409f6c1c62b3c5e1afc3e0a6a
MD5 c3549bd61365144842290ae3bf08a399
SHA1 a56f7cb34dfb5f3b9ad4325cfe1a4b74455a0774
SHA512 222b3d8429211b50546a6b30cc39b9c2d7dbd7061b05cd04ceb64bc185ae4f9a8de19ca7f90ded31aa9f59a896c833d8d2e5c649e9752b9ee307cb51864e2ef9
SSDEEP 12288:xr7bARSL+H6F3V8eaUinNMD4PKUc4W9TnFPJjl7BorES+fhXT:dbAEL+H8ZaUGNM0Y4WlBjV1SQNT
TLSH
T1F2752367876CCEC9F9890670293E681FE36FFA504B5051DBE348770A4479EC08D3A5AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 244fa12b78ed64c675504bb084f67522f396b68424554c0fe442c47187a40975
MD5 e2e444ec4fdad1e90e9dcf2190f70c50
SHA1 65f052565ca28688035a92907b7ac73c4c446758
SHA512 0b270a3f0f2451412696898bc939155108e01b6b97c6b5123c84f3d49d87d853aa38a7bdb9992e57359e6f480d9e71f2bae380e298c1663fed4778f9a2eea903
SSDEEP 24576:Agb6bmBIi49WNNFpg1rSvFv7bY5AEL+H8ZaUGNM0Y4WlBjV1SQN:Agb4mBIBhGFwA+7srK0Y4qKQ
TLSH
T12D659E1E22EC02F5E1F9D2B89DAA4417D6B378160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 1.3MB
SHA256 926fd97336a598c3ac1513a494cfbf762bd592d1d89c5aa8b02abfc4a1d72d10
MD5 8f3faccac2485238de220533e2d3ffb3
SHA1 b0ba8a43f0849c1628634dad5ee6bc5bc1488792
SHA512 bdb6730341543934972996872352394b19eeea69a8bff810ff733a429c5d4ed24a2ab90142e1842c072c2f6107efc66fa9a099d0cde2ac16e7f9734f46a76828
SSDEEP 24576:RTkNvNnaFeYhJNtmZBm2AEL+H8ZaUGNM0Y4WlBjV1SQN:RTMwBtOm2A+7srK0Y4qKQ
TLSH
T1F455AF6EBAB846E4D1FEC6B48D238516E6727461073253CB9390C13F0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 76e206bb67b473e6da0cf121f6c914ee17488ff0bfb2bf8717f8516935f97d5f
MD5 9d78b4d20d5e2e25e6da63f265f351fe
SHA1 2fa5bc8a854042aa536533b11611e7841e69ffb9
SHA512 e436f49cbcf941fccf9ee3a3bf1f083b2c45608205fcef91f476d0d258fdac35f9fe078b5e230b8076e13e1f95af2d6e897b482c7ba3811111da4f08b8a7f8d6
SSDEEP 24576:UGtFow26dkF0fiD8wQ1DEZ0zHwzZDo9cAz:UGtFw6do0fi24ZRZDo9R
TLSH
T15E052355A8E065A9D9FCC3F8D8A9A5697DF1323127288CFF4DEC227117380E04B79E19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 05a048b3b976cebd20ca3c0314756992183721761d35d66e7c305dac51b2c7a5
MD5 02c5df2bfde9b1ff34f7d170f463f087
SHA1 c021ad58ded67f547ace73e46db29b4d33ab7b47
SHA512 06317d4025380bae03c07b3ffc5ae90c6d7bbf3e13b182d29eff3febf77671639279a1be33dc0992176caf95ce76216e7d5c240c596bcb20df506541ea6d40af
SSDEEP 24576:dG88u8FpJqH1Uzria7/mgAEL+H8ZaUGNM0Y4WlBjV1SQN:w7ZFPqVja7/hA+7srK0Y4qKQ
TLSH
T18DA5F16667E502F0D47BD13889964667F6B2B4210360EBDF47AC8B561F23AD04B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 8634037423dd1e23f870877a976b9f38284154869c97838808d2058a8b16475a
MD5 85c49cccf43fe68b520abaef2e44548a
SHA1 a4e60e809e7afcd257cea140f53eda768f0b896f
SHA512 67c6b5ae4ca6bf2056b5937a290abbee43be5d062bf2bbb9b44023d5306d89028f181f2f89f54bb42b1d41462d4ae9c2b49d46071c6d6cfb8b36fd0734d62724
SSDEEP 24576:/PUr+NQcAEL+H8ZaUGNM0Y4WlBjV1SQN:/JQcA+7srK0Y4qKQ
TLSH
T1C585E12F66AC1CE5E67AA17C8956460DF772B461071192CF03E0813E4E77ED8AD3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5aaef4417d6c3bdb316ceea02b3f2dba856b2bcccc1311baffad6dc82dbe5bad
MD5 ff48071b0cfa491fba64f08981c42b22
SHA1 9504f7da98076e63dfc730e56a1fded7a6047ab7
SHA512 ed47c0b1bd30944ee54679a77ae7bcf1ea5c880daa850dbc2ff9b1512e493b056b20a701e489822e97b687fdc72588ab161e2d07c6f623c84110ad1489d65e9f
SSDEEP 49152:XBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjMA+7srK0Y4qKQ:IG05lO43b/AprTY41Q
TLSH
T143D5CF6A62EC11F9D1BBC17CDAC64A0BEBB23415033556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 37a42f39fdfd46aaec2dc48800d0435c115a7a5d2a41dff8c5848042f8813eff
MD5 079348ebc1a3d725b59d84f902843b08
SHA1 c26d21d9796114d8ebf9077790c08d2d718cb1bd
SHA512 bdcf7c93557e44a749ed0e129bc705532a68036a9ec8460e10101aacbf7bcc973a52fe61c9e785763492c00dd6f78a8650d5289a5052492e142f797f2f2e6f19
SSDEEP 24576:2fa5POZ3dpuWVM50JicR2hG0lasx2+47eidniAEL+H8ZaUGNM0Y4WlBjV1SQN:ua5POZ3BJt2pasx2+mkA+7srK0Y4qKQ
TLSH
T14265AF5EA7FC01D5D5B9D17DC5834A1AE5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 78dc6b403cae151b2d65f700d2ac0366310309f7a3c9249f44ebf3ffb62913f8
MD5 fd82cdcd6f33e824d64003b66c4b6de5
SHA1 6855a92ce9bc191c7895ed56a0eaa27ced64f806
SHA512 6a0b5a139aa89ac79fb4ea50262fcdee3336e14a88b3c07033b3884d31124dd730cbf09f7391e10421ab9714e699f89cfac3eb8d3bf7e726652e71d6876827af
SSDEEP 24576:kNcwHdjbyQ4nLC18lb/EOjowL7FkYAEL+H8ZaUGNM0Y4WlBjV1SQN:kNc/zEOVHFBA+7srK0Y4qKQ
TLSH
T197857B2623E901E4F5BBE1BE89779546FAB17865133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 0f09bf651c803c120307ff25b2446668025040bed50ebb13818649c5557f1759
MD5 dbdd626a12f8de08c17a28094c4390ec
SHA1 a343d768f5a6b8468db6b5796386f084abc5fd8f
SHA512 9948054408996926e2bf650a7d74e062ea8ae8ed75b3f064a98ac350095349627b960857928dd56b4c1c2bb23cc9fb04316049d744c8c3424e4bbbe510a7c469
SSDEEP 24576:Z6DI9Fow26dkF0fiD8wQ1DEZ0zHwzZDo9cAz:Z6DI9Fw6do0fi24ZRZDo9R
TLSH
T1C025125D72AA00FAD0ABD07DC5830515E6F2B171472249DF4AAC86B95FB3DD8BA3CE01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 928KB
SHA256 29406deb803c6592c094b4337b61a44a9b4d493d0449786ab542373b159cf103
MD5 4e48f6cb95a0de6aacd78bf2a2363600
SHA1 d6250c05edc30c2aaa06b964f1608042a4965cff
SHA512 a505d4416fbb2c591337e1ec19ab1e1567545e620ebce5a564863bb77ca6317de872a6e46925d4ab47d1df0c1872b59ea162a1c231b44206b232a13a32deea8c
SSDEEP 24576:uty5Fow26dkF0fiD8wQ1DEZ0zHwzZDo9cAz:utQFw6do0fi24ZRZDo9R
TLSH
T14A152300A6C451D9E5FC43B8DD7682647EB57D312B318AEF69A8733A2B352D08E30F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 800KB
SHA256 e92de7c097b832a2f7f747fff267cdaa7b6cd3875ccf5f8fbaf84c90a1eede45
MD5 26f041529e2c6dea8fa5c736d98cd070
SHA1 437d89c9870e30e85daba372ef9bd9d483d24868
SHA512 c7713a0935d16d415747c6ece6f159f342e7d3220c9e8894e6ee04312616fde7f74398bc65e4bec49376d4c2d200eb5b65f5c340430d0f2f1550885cdc699d75
SSDEEP 24576:TUFow26dkF0fiD8wQ1DEZ0zHwzZDo9cAz:TUFw6do0fi24ZRZDo9R
TLSH
T19D052341A8C0465AE9DC97F89CA9A66879F5333627368CFFBDAC237112380E04B75E15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 aebcf0b30cf71b3f0957d3bf48003e2e045f7079e0d2741e979ca0658d6fe003
MD5 b90b9f4aa669cf4a495838d0f7d9af44
SHA1 c7a7e7a01ec9d3c1da8cc9f7036c57deaea57b72
SHA512 920e0a991e905b5e0b938d7e0175a18b610a523bb0ca3fb0d5d49f76a1d83b7dd0d935b7d033a9655d187b4717c4b32e816955d8e1cadc6bceb8f9caddc15de4
SSDEEP 24576:eegjLoTfaidZoFow26dkF0fiD8wQ1DEZ0zHwzZDo9cAz:lgoTrZoFw6do0fi24ZRZDo9R
TLSH
T1FA65AD1DB7E905CAE2B2D279D8725493D633B4311772C6DF2448C03A4DAAED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 e8c29fe7b4bd55e76a69cf9e35e06a728b1197d87e50d904e55155f749b39876
MD5 a22349f68604ef19dff8f6d9eb10e3bf
SHA1 d7b10ca0296644b7f6834234309bbef62d13dfaf
SHA512 5975526a53c971ad3673caaf23f9623d40c7295b7ce347a2eac330bf08b7161037d08dce134b8f8ce50796a65c416bd714b359e3721c26bf7a4aa593b1470650
SSDEEP 49152:0gb4mBIBhGFwA+7srK0Y4qKQrFw6do0fi24ZRZDo9R:0txAprTY41QJnhfibjZDc
TLSH
T12AA5D01E22EC02F5E1F9D2B8DDAA4417D6B278160732D2DF1255422D2F3BEE48D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 8119337c5ab401cb3bc5b37319bfb13dbd3b84e7b2134f19cd7b7cd38ad5fc97
MD5 a4cbf1c4dfe398ccbcd5f4d3b77cf3bc
SHA1 ba131cbb8065d36e8f61ca9c14872bd34c519432
SHA512 426dc02b6f41a09c0e62ca205f124069ecd037f7c69049c3128b1b774c8576ca779ad84f405e9f49f012996e11ee4028ab2f3a02afffbdb3f42a248615a03600
SSDEEP 49152:yAMwBtOm2A+7srK0Y4qKQBFw6do0fi24ZRZDo9R:fFOAprTY41QHnhfibjZDc
TLSH
T12FA5D16EBAE846E4D1FEC6B48D238516F6727461073292CB9394C13F0E679D48D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 2.6MB
SHA256 4edeb9d5c6951670541a1d1b6a9dc14fbdace3c2223366e3273ad76783585dd5
MD5 61926ac7c7f9df207a0a9038e7e24ee4
SHA1 9546b254c5ed3cf047264f907c58c12b09787547
SHA512 070970fc40ec51ccd1c89f1bd66f34fa6a7637270064f262268af330d98ea106533ef8cbeed2ab6379682140b0524a97d3e54e308f0093634f93cd1082b466cb
SSDEEP 49152:1DVHeBIAAPA+7srK0Y4qKQ7Fw6do0fi24ZRZDo9R:DAprTY41QZnhfibjZDc
TLSH
T1EDC5127EEA9C04E4E57AC2BCD9638906F7B134A9033155DB429891B61F7BEE02D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 77bea58afd98e8b75e1c3099c13ce951dcbd148e76d634eb6e6f520c4e052b24
MD5 1f7b0c016e79c6ebe77f0daf5ca2ecba
SHA1 7052b0b34234a8a012025f8f79e5c0968b8b2d6d
SHA512 2848473192986d4367651882fecdc0f09358d905526615878e16da4c07ddf0d5d1be461cd28bd8d366f2aa2501ca63b549c60bd6ace45c4a1cff4d2c0c28dbcb
SSDEEP 24576:wJnJPbzB4SFFow26dkF0fiD8wQ1DEZ0zHwzZDo9cAz:wJnJv6SFFw6do0fi24ZRZDo9R
TLSH
T10335E13DD2A810E8E4B7C2B4815A1759FF71343D2B2569CB19B8D5343F12EE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 792KB
SHA256 120f325305cecea8223130ef28e826357fc27a69c8ae44583555835687a1d963
MD5 d0978db3d1648657a74b78f84106a889
SHA1 e153873d3287555e781a247ffa4982bea4dfe012
SHA512 83444256bb4c6ba15c3f75d48a14232343010b9856877b88ae45914898a828adbea19cb454ce3fa637647b421644e064e58932947f1c08ce57bb0702a11cf827
SSDEEP 24576:HpFow26dkF0fiD8wQ1DEZ0zHwzZDo9cAz:HpFw6do0fi24ZRZDo9R
TLSH
T191052341A8C08A5BE5DC57F49CAAA5683DF4333627398CEBBD6D3351127C0E04B75E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 936KB
SHA256 583de3b7527f1dcea2f4a9f7c714408da05e17488e9f819679661c5e0e4b963e
MD5 b56d2e98b375836c6c40cf9f2b0358fa
SHA1 9f55e84244197171a39566b21c74a4d7f630a4d5
SHA512 f020d55056ed431e5c138480eb4784511a8577a0f6909593ec1b9c4619c2fe53347a65066e60c945236889d56c56c7b9ff657d22e89e95aaffa008f4252d5188
SSDEEP 24576:a6UqjpKFow26dkF0fiD8wQ1DEZ0zHwzZDo9cAz:a6U9Fw6do0fi24ZRZDo9R
TLSH
T14515224A69C054EAE4BC83B4DC65823969F07932137688FF79EC637A47354D08A3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.1MB
SHA256 dd4aaa400d72733da4ac804b0d59ff71e8dada5e5d3606bd1d250d4b497e9a76
MD5 5ce6c552cf9d3d1aadf6b2a7e069e236
SHA1 100629ed7c62c13f32cf9f9891ba250913fa8b03
SHA512 a4847c135b516743b59a8aee9c8bbec1742f54d32e68694117a192b81cbd57cdff3b7c4d2ecaddd4a5d53ac3a5b484d0eb59ad34cde755a2a75f10f3a11d8b20
SSDEEP 49152:1CLHGeeV5ijCmlDWDkodFw6do0fi24ZRZDo9R:sEnhfibjZDc
TLSH
T1EAA57C05E7EA5184F8F3CAF5C92694169A327C549B34F7EF4E80CA6A1E32BD0D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 92afdb1b472a3bcf8dc8c55e60f1e5a31163f2b3321fccae3a9acd31d3c10f6f
MD5 eb59311f29fab25019c03fe658dbf6ba
SHA1 54bb95dcbca4e232f68e868fce4ede5a1eb8ccf8
SHA512 9f2e40fe6f915016158bb3bfe82e50f990cd687a6a4b80fce3b0cfdf4b6be03d029d3d17dcb28ee893df23d861a86726ebf73cbfebf0cbd3e5ef6c26faea0732
SSDEEP 49152:3DL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3dFw6do0fi24ZRZDo9R:M3Upow8sBinhfibjZDc
TLSH
T117B59D3DA2E800A8D9AAC379C54213A6EA71742E3F3055DB0174C578BF1BDF19A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1708-129-0x0000000140000000-0x0000000140229000-memory.dmp

Download

memory/1708-131-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1708-137-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1708-408-0x0000000140000000-0x0000000140229000-memory.dmp

Download

memory/2396-94-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/2396-99-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/2396-390-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2396-93-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/3448-29-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/3448-128-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3448-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3448-30-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/3448-23-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/4064-47-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4064-54-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/4064-57-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/4064-48-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/4064-59-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4268-335-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4268-89-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4268-83-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4268-81-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4472-0-0x0000000000400000-0x0000000000A8A000-memory.dmp

Download

memory/4472-6-0x0000000001080000-0x00000000010E7000-memory.dmp

Download

memory/4472-15-0x0000000003040000-0x0000000003148000-memory.dmp

Download

memory/4472-1-0x0000000001080000-0x00000000010E7000-memory.dmp

Download

memory/4472-7-0x0000000001080000-0x00000000010E7000-memory.dmp

Download

memory/4472-16-0x00000000032D0000-0x0000000003355000-memory.dmp

Download

memory/4472-337-0x0000000000400000-0x0000000000A8A000-memory.dmp

Download

memory/4472-10-0x00000000032D0000-0x0000000003355000-memory.dmp

Download

memory/4472-80-0x0000000000400000-0x0000000000A8A000-memory.dmp

Download

memory/4692-158-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4692-159-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4692-165-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4692-409-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4780-150-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4780-148-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4780-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4780-152-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4780-142-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5620-412-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5620-110-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5620-103-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5620-407-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5620-104-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5620-414-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5904-116-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5904-115-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5904-122-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5904-404-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5904-406-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5916-69-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5916-76-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/5916-70-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/5916-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6024-44-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6024-157-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6024-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6024-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download