964aca6e9987775e0b5a345f9a7360284159be1d8267589a54b194056af7887f

Analysis

max time kernel
123s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
Size 612KB
Sample260629-repzzafs4x
SHA256 964aca6e9987775e0b5a345f9a7360284159be1d8267589a54b194056af7887f
MD5 8e54ed5bf119eb2c37bcf61efb3085fb
SHA1 deec5f7fcce2e7ed6c1a88b82ec6dc1c7da9ca4d
SHA512 0662211830ca10d4bdb7ecb45600701e2b6196f8391cb1282ad8d61bad6cb2b19c1f981ec189cbac67a2c69a1848e3f5877fa4c889269203fe5dda1ecf860306
SSDEEP 12288:/cb7WLAlZxbEX9xq79m5h8jthoZ1gpAStyEeUDNpmV7cluTO79Q:/MamZxbsIgkj8KAoeU5pmV7ch79Q
TLSH
T119D423C6D13D8319D25EE7738A339E2F3E6A7BF6B4371B0915245B087C26267A94034B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 22 IoCs

pid	Process
1208	alg.exe
968	GameInputSvc.exe
2812	GameInputSvc.exe
4108	elevation_service.exe
704	elevation_service.exe
3508	maintenanceservice.exe
2204	msdtc.exe
2404	OSE.EXE
2044	PerceptionSimulationService.exe
2412	perfhost.exe
5060	ReFsDedupSvc.exe
3184	locator.exe
1972	SensorDataService.exe
5044	snmptrap.exe
2308	ssh-agent.exe
4328	TieringEngineService.exe
1896	AgentService.exe
3952	vds.exe
4508	vssvc.exe
5152	wbengine.exe
1724	WmiApSrv.exe
3204	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\827ef35ddcce6609.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102562\java.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102562\javaw.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004596789ad007dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c9f419ad007dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000089de279ad007dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002f79729ad007dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2289519114-2956110270-1748446682-1000\{6A416D14-61E8-4570-9700-4FA9A55E0504}	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2289519114-2956110270-1748446682-1000\{DE7417A9-5803-4762-BF58-A9D5E7B96A29}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2812	GameInputSvc.exe
2812	GameInputSvc.exe
1596	explorer.exe
1596	explorer.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
Token: SeTcbPrivilege	968	GameInputSvc.exe
Token: SeBackupPrivilege	5060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4328	TieringEngineService.exe
Token: SeManageVolumePrivilege	4328	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1896	AgentService.exe
Token: SeBackupPrivilege	4508	vssvc.exe
Token: SeRestorePrivilege	4508	vssvc.exe
Token: SeAuditPrivilege	4508	vssvc.exe
Token: SeBackupPrivilege	5152	wbengine.exe
Token: SeRestorePrivilege	5152	wbengine.exe
Token: SeSecurityPrivilege	5152	wbengine.exe
Token: 33	3204	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3204	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3204	SearchIndexer.exe
Token: SeShutdownPrivilege	1596	explorer.exe
Token: SeCreatePagefilePrivilege	1596	explorer.exe
Token: SeShutdownPrivilege	1596	explorer.exe
Token: SeCreatePagefilePrivilege	1596	explorer.exe
Token: SeShutdownPrivilege	1596	explorer.exe
Token: SeCreatePagefilePrivilege	1596	explorer.exe
Token: SeShutdownPrivilege	1596	explorer.exe
Token: SeCreatePagefilePrivilege	1596	explorer.exe
Token: SeShutdownPrivilege	1596	explorer.exe
Token: SeCreatePagefilePrivilege	1596	explorer.exe
Token: SeShutdownPrivilege	1596	explorer.exe
Token: SeCreatePagefilePrivilege	1596	explorer.exe
Token: SeShutdownPrivilege	1596	explorer.exe
Token: SeCreatePagefilePrivilege	1596	explorer.exe
Token: SeShutdownPrivilege	1596	explorer.exe
Token: SeCreatePagefilePrivilege	1596	explorer.exe
Token: SeShutdownPrivilege	1596	explorer.exe
Token: SeCreatePagefilePrivilege	1596	explorer.exe
Token: SeShutdownPrivilege	1596	explorer.exe
Token: SeCreatePagefilePrivilege	1596	explorer.exe
Token: SeShutdownPrivilege	1596	explorer.exe
Token: SeCreatePagefilePrivilege	1596	explorer.exe
Token: SeShutdownPrivilege	1596	explorer.exe
Token: SeCreatePagefilePrivilege	1596	explorer.exe
Token: SeShutdownPrivilege	1596	explorer.exe
Token: SeCreatePagefilePrivilege	1596	explorer.exe
Token: SeShutdownPrivilege	1596	explorer.exe
Token: SeCreatePagefilePrivilege	1596	explorer.exe
Token: SeShutdownPrivilege	1596	explorer.exe
Token: SeCreatePagefilePrivilege	1596	explorer.exe
Token: SeShutdownPrivilege	1596	explorer.exe
Token: SeCreatePagefilePrivilege	1596	explorer.exe
Token: SeShutdownPrivilege	1596	explorer.exe
Token: SeCreatePagefilePrivilege	1596	explorer.exe
Token: SeShutdownPrivilege	1596	explorer.exe
Token: SeCreatePagefilePrivilege	1596	explorer.exe
Token: SeDebugPrivilege	5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
Token: SeDebugPrivilege	5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
Token: SeDebugPrivilege	5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
Token: SeDebugPrivilege	5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
1064	sihost.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe
1596	explorer.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
5400	2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
848	StartMenuExperienceHost.exe
5240	SearchHost.exe
1596	explorer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 2812	968	GameInputSvc.exe	91
PID 3204 wrote to memory of 888	3204	SearchIndexer.exe	112
PID 3204 wrote to memory of 3360	3204	SearchIndexer.exe	113
PID 3204 wrote to memory of 3784	3204	SearchIndexer.exe	115
PID 3204 wrote to memory of 6092	3204	SearchIndexer.exe	116
PID 1064 wrote to memory of 1596	1064	sihost.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_8e54ed5bf119eb2c37bcf61efb3085fb_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5400

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1208

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2812

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:704

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3508

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2204

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2404

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2044

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2412

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5060

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3184

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1972

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5044

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2308

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4328

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1896

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3952

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4508

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5152

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1724

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2289519114-2956110270-1748446682-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2289519114-2956110270-1748446682-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:888
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 924 1648 3020 944 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3784
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 924 3012 3024 944 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6092
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:6284

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1596

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5240

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4eb2047a8cff0727b79cae69923432362fe6ec9824710291eec294ec10121f10
MD5 39cde24135f9ed5662b1b095571e0108
SHA1 3b1d85e4739278457ec0569ca87bbbb87abfb3ff
SHA512 3a230f2181dbff323582ff15e1d82c69fa296fa5abb805f566a2ca5222fe371f60c0d64c8caaf41360bb5f0d6ca21377d496b77306f215c798b9360fabb09425
SSDEEP 49152:QwR632BuPkFKRrdE6oh7stBhuXjfS4LWxnHM5xbKkj8rBGGAh7:s3q6gjBzhg0GAB
TLSH
T16FD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 93a103c737f862861ef4a51ac0572948eebbf3b0908af7d8437064c35716a5cf
MD5 ee16f479773ce43390b23b00e9854fa6
SHA1 4b5dc03fc20e3a03644da26dd7780bac69495845
SHA512 e64a82d68b323803a4fcead3f8d289710e9abfa40de5f08d7307af7744d10b17d406a570a1c28521e0dd615cb6557d02c34e153b6276f35e25252b700654dac1
SSDEEP 24576:CXY6X5czAtMamZxbsIgkj8KAoeU5pmV7ch79Q:25cUM5xbKkj8rBGGAh7
TLSH
T118050269B3E409F9ED6B823DCCA28506FA3378554770E78B03A49A251F233D85E3D752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 826KB
SHA256 8ae982f37bc73655365c348a083cfe72238dcd525707dcb665ff04ccf34f6712
MD5 04d7604ff5bff563610dab82b25a5a50
SHA1 50b472312a29f6c4bf7efc7a56a7ed58f8387695
SHA512 0f996499da6d8da761beca9d35d15c7bc1ae91b8436f1d87a5e4ae8f80af100d15efc2d537c8cef2fcaa8470a505d3001e5bab4d0f976af3c95e001f8c699b53
SSDEEP 24576:Qwu+OWGMamZxbsIgkj8KAoeU5pmV7ch79Q:QwlOlM5xbKkj8rBGGAh7
TLSH
T1C405F18672A80CF9E5679239C553C536FBF2B8122A31DB0F1760C75A6F37361AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ad68707e88f5e4bf00af1baed5040fa50132499c56be3be0ea0a3d5a6b97884f
MD5 4473f1c92f37afa01d226ef71521d698
SHA1 2a07f17528766634574342ee01f098b568b0618f
SHA512 584afc27b8fdfe11da937703b72a33c81815267be629f48b52ee28da1378a2dd6004b271e1638b9f9f0b1340cf235e0bdc633d420ba20e968b9a68c9d02e5475
SSDEEP 49152:PN+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl5M5xbKkj8rBGGAh7:du6JmTxd2dEhg0GAB
TLSH
T1CAD59D13F1DA01E8D06ED079974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 be887fd5ff5f864c8455caa5963b2f06aee52e1fcadfb6f6c2c196b7986804a1
MD5 cf945094f7284e9cb281ecc5db79ae20
SHA1 0ae743e2a09e005aa28a93bfc21a134844e8bc44
SHA512 56ce128500724c26ae4e6f29af4306715c36f0079f5d27a96426dd5c68ee9a422223e224ef0b11e85043433e48ae199870166fe25eebdac8e9e0426f0c71df8f
SSDEEP 12288:BQ7lcb7WLAlZxbEX9xq79m5h8jthoZ1gpAStyEeUDNpmV7cluTO79Q:mlMamZxbsIgkj8KAoeU5pmV7ch79Q
TLSH
T1B4D423C2D27D8719F17EA3738563891E3E2F7BB5BB32578B241417402C266E6AE4035B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a6ba37644aa506ffd1df4b93b72264003777f53ea6c2e15237b595ace50fe036
MD5 9be9e33ef2bb8fd136fa31e2ef7c1ad1
SHA1 63cbc7d68b2b891cf3c2af8ac27411e5f5b9f5c4
SHA512 1df01d9e10538a893de5fc24eb4442b67d13ea9bfe7817583c954c23e2d8784ddae7af59cfc9ac9aafb151a45ca062d96015a79c2fdad5e217ef8e2b33ed40ce
SSDEEP 24576:Pgb6bmBIi49WNNFpg1rSvFv7bY2MamZxbsIgkj8KAoeU5pmV7ch79Q:Pgb4mBIBhGFFM5xbKkj8rBGGAh7
TLSH
T12965AF1E22EC02F5E0FAD2B8DDA64417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 7b0da3374ece9aca2d05410867241d8b7c21a5b547c9de7b33a620597ea3a9d9
MD5 e8146868f1ff005010080d51daf4fc46
SHA1 cea6bb697bea59423bc8f7e99e4134d899947969
SHA512 3c8d2ba9b385886afea70f157bb12cb9ec2d465ae7b0f1d020e3dcc8eb6f19fd513d752ad84c598ce436d10d415a862c2c5dfd63d0de1ade99470d95cd343849
SSDEEP 12288:pZG41cb7WLAlZxbEX9xq79m5h8jthoZ1gpAStyEeUDNpmV7cluTO79Q:7G41MamZxbsIgkj8KAoeU5pmV7ch79Q
TLSH
T14CE4229EA0BA6358C13FD37B8872991B7D7236B1A7312BDF046096309F166F17630E46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 1bab1e0d3119ed70360ad9250d0ec2d2d70602c545aaa073f336630a0b5ca3fb
MD5 9a0e09caffba4196ac4cc9f086b2dc5f
SHA1 4b0feeadc61a97a071bd113fba04892ab0b0b3dc
SHA512 21daaf4ca2c542edda3ada4dc9f65899701cd3bd7169e55b0d868db0eaaed8700043ee15d569d59f7be316fe6dfc9d656e7b6b881c19c81cad84f83875ed8973
SSDEEP 12288:n7cb7WLAlZxbEX9xq79m5h8jthoZ1gpAStyEeUDNpmV7cluTO79Q:n7MamZxbsIgkj8KAoeU5pmV7ch79Q
TLSH
T1A7D423C6913D8319E26FA37785235D0E3E5A77B6B7332BC7242417002D1A6F7AA70297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 4586e97b2cb3e1c1b5991b247b20d575bc56b65657e8e09726324cc21f889617
MD5 3ae6106b5e727e7d86f287ed5ab56c56
SHA1 01c13d331e78227131562af5f1a34c4d54ec7caa
SHA512 63e37b84418c44917786fbf680a5e0abe396f9f88b2102148f438aca89099fab38925a7dbb4b81b36b951de51142518512e48a7d902af7e756c0df2deba115c9
SSDEEP 24576:XEc8u8FpJqH1ScrZa7/mMMamZxbsIgkj8KAoeU5pmV7ch79Q:UbZFPqVFa7/DM5xbKkj8rBGGAh7
TLSH
T1F6350165B6E502F0D07BD13889824667F6B2B4251334EFDF06A88B511F23BE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 d74f4efdf4cf629e359fe770a5f5249c39222f6235541637064ae97727a2783b
MD5 70601dac378ed9dcaf1eb78046f58f7e
SHA1 e6e52b8ff9ebf663108e4aa2679e8d4ced42a8ed
SHA512 95471a430d72d10764611845bae3e79c5f37146872a206d40b70f722bce70163b2b92603555f73b5381f13852cb5c8d51591f9737b1429c9c35c65c27e02b517
SSDEEP 24576:kPUr+NQhMamZxbsIgkj8KAoeU5pmV7ch79Q:kJQhM5xbKkj8rBGGAh7
TLSH
T1EE05F25F62AD18E5E67AE17D8942870DF772B462131293CF02A0817E1F27EE8BD39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 0565ecef228a5b91fd0927de80c93a849864a1a6a2ce618a6c906537e3b798b0
MD5 912a829626782f0a04fbf383c25b1567
SHA1 8e7e02f3b4840a37270d16e0d71c03d851e1510a
SHA512 d7b4a28a4afa1d9d0cc7dbb537a942716019c4a6c4815428f4788294ae9d7e37fce5123a0bc1c3144f9ffd23415b52081ce77a9ae0e76e8428bf58e85423deed
SSDEEP 49152:1BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjVM5xbKkj8rBGGAh7:+G05lO43bfhg0GAB
TLSH
T18ED5CF6A62EC11F9D1BBD17CC9C64A0BEBB23425033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 14dfc486fb694d5d3f2917838a6371b19abb29cd0550586e575ac2794eb4d4e6
MD5 a273dea0694a2bcc709ed0b01ed4625b
SHA1 5962f876e5ade18b81dcae167bede736442a53ee
SHA512 ae49f2c2d79980fa64e5848282f89ac42ed0ec8c7ab88b144e7bcc4506060c044eff6dcc5bb50cca38357828a0e46dc9cb54a60ed75db158660dad9e1026b5a8
SSDEEP 24576:ZKa5POZ3dpbWVM50JicR2hG0lasx2+47eidnGflAuJx6xK0CYZGYXSdH:wa5POZ3wJt2pasx2+mgfeuSx8DYC
TLSH
T12465AF5EA6FC01D5E5B9D17DC583861AE5B2342153319BCF022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 29969cf3652438626fb94d3981f6e600656b05da848f8c4df7e4bac5bfb3db4e
MD5 c3aab69616f6aaeb188a040bcd9fe4f2
SHA1 3a6f4f6c720f7ebddf952e4cd3e59a8092d38d32
SHA512 4211cebd3072f597c3092c05518f0877beb4187c5a047115665e1681c6a461e8d6755b115fc2bcd72f5fc4e7a114ae6afa50f16b9a5a5f380865328c5e7fea7e
SSDEEP 24576:jNcwHdjbyQ4nLC18lb/EOjowL7FknMamZxbsIgkj8KAoeU5pmV7ch79Q:jNc/zEOVHFQM5xbKkj8rBGGAh7
TLSH
T173858C5623E901E4F1BBE1BE89779946FA71786553308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 17778d450b768816bb2b4088711ce26b8ca789ca427bf7a5d4bb86b2290523ce
MD5 b7a5732863d5a93f7520538d7c8e3cbc
SHA1 7ef03e7ff9395f7697d92fe8ba9c9be503ca0235
SHA512 92d311234c84773f55fbd8f75782ec6cfb9d2c2c5077cd52fe3c8a28f85da2269d8476398ddb8ce55ad2b252340986eab0330909ba3d8af017be5a33efb3cfeb
SSDEEP 24576:+JnJPbzB4SJMamZxbsIgkj8KAoeU5pmV7ch79Q:+JnJv6SJM5xbKkj8rBGGAh7
TLSH
T11215D06DD2A810E8D4B7C2B5811A1B5AFF31387D2B2269C719B4D5343F12FE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 79c92a817e76d33e806aa57d3b422ed7728f5fff6465adf223ea0c294382b54f
MD5 f6d4ff4617b78e5d7f4bac5de91a0346
SHA1 9aae6fbc58a5d128ccbc2328ed20a4eebaae5a7e
SHA512 775fb2a1cf2e35f3ba958cd8f23f85c40d165bc6662614ac85e582407e4a5ce6b98a25a3f610f3d0d384703babbee08e5c7ea14863e88ef66c6f3888bdda3a96
SSDEEP 49152:1CLHGeeV5ijCmlDWDkjM5xbKkj8rBGGAh7:sEhg0GAB
TLSH
T115A56C05E7EB5184E8F3CAF5CA2294169E327C549B34F7DF4A80CA6A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 65a0805bd8f1dbb285498280676c2afe85b0237cddb7399d160f2127a3ef8a00
MD5 b1c284545464a01b49c00f9e76f1c301
SHA1 223a45fa378a0c4bbd845a0f028d522758e77f77
SHA512 efe45d0b410a4701aae85095cfa0bdb625d3249e963f9d52c9e49602606f23b849af15774e006a2483109a4664ad979888cd901ed988682d35250251055fd0b1
SSDEEP 24576:e6DIjMamZxbsIgkj8KAoeU5pmV7ch79Q:e6DIjM5xbKkj8rBGGAh7
TLSH
T175F4024D737A01B9D17BD03FC6930506E6B2B1B1D7221ACF06A4C5795FA3ED8B938A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 48fda574570a0a09d6c612a30016f6944062db5bc1795775b3f22aa96145cc1c
MD5 e0adb3e100f95288a750282fc5730728
SHA1 12719da134141033cefbc061b03a7b3dd1de1d89
SHA512 97884e9cfc721c5eacaa75289f7bd35b90c8987ef136fc07d4de948cba77965e3627c6be0a47453652ef30a2aa408235f39fb9d54dac887131b3cc2fa0b827f8
SSDEEP 12288:DG6kyScb7WLAlZxbEX9xq79m5h8jthoZ1gpAStyEeUDNpmV7cluTO79Q:StySMamZxbsIgkj8KAoeU5pmV7ch79Q
TLSH
T1C1F4234593A85298E2BE5336CA3385556E36BD30AB3257CF1060A72D2F367E1BD30707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 9ca84277a56b9bd747146f4e9b82cc00d56365a13f5226d92caf6c1b4f8f568c
MD5 c32101ec732f322b0f783a03778c5851
SHA1 1586de6f4f0862be6f6709d8cbbf85a73f2875e1
SHA512 339723107d14903c50979dfaf54ae11439c59004a87139a56a32928d83d98e64f20fb9d5c95a23a574d1d71ba9060d4600d9892ca602c5772ea89b46fb20b85a
SSDEEP 12288:cYBcb7WLAlZxbEX9xq79m5h8jthoZ1gpAStyEeUDNpmV7cluTO79Q:zBMamZxbsIgkj8KAoeU5pmV7ch79Q
TLSH
T135D423CD913D5319D16EA37785234E0F7A2A77B2B7332BCF24205B205E1A6E36A30647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 3a1c2d81b1859ba647a9594331754da6b2cadeba9982d3cef0c9acb87026fb2b
MD5 f6704eb56608ddde04401b98d032ada2
SHA1 e0ce6a892278634db96588fd64024be314042758
SHA512 c6dec3900b60083a88908dc73c86006b4be9dd7dc87ac6869781ccbc949071bcc5d96ee849ff850603eacb43d390d346660599e241f2fbc0ad48de1d03e8a489
SSDEEP 24576:kygu1oTfaidZLMamZxbsIgkj8KAoeU5pmV7ch79Q:fgLTrZLM5xbKkj8rBGGAh7
TLSH
T18A558D1DA3EA06CAE2B2D275D8725493D633B4315772D6CF2448C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 4fad41edfa6347bfe89381c6787899387a55ce2ac1d51dba3fc1f0501facb392
MD5 af41c9142ab0f29e6cd46e84f7fc64de
SHA1 51ae4115c554b48d96006c031337448ab6469890
SHA512 7225739996bb44cda821b435285fd9ba7cb12fa6c3346c46c78db7e397035ca2e942f2377d424a951050f10c7c06fa294a5bcd5cbc180d4d717e2ee2ee52bad1
SSDEEP 12288:7pJcm8CNXAZVI6AkR352GxOAf+CdqpxKBPCCxqZw1tMb8ejXxkdXk+6fjw+g:7rcmRwflAuJx6xK0CYZGYXSdH
TLSH
T11205F15EB2BE00AAE2B7C17C89824205E6B37570675257EF02A0C77E4E5BADD7C34B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d5a27d41e6e9317f3e20684cff37a88001d207e63756f824d3890ab2e95e675b
MD5 2deb7b99d5a53d61e18bc9a84b09cbc4
SHA1 009bb64a93f1cb507ffb571549f29d7356d66980
SHA512 bec57744335d3afa89c4fd6ad74527d151421a3ab91511ea36bd115c136297a89a8ba2f967ebb495c5d16ca43c75d646cd00c2256c0f84094a6820685b2c1216
SSDEEP 49152:PDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3QfeuSx8DYC:k3Upow8sBLefik
TLSH
T1A7A58C3DA2E800A8D9AAC379C54213A6EA71782D3F3015DB0174C578BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/704-55-0x000001FD3C950000-0x000001FD3C9B6000-memory.dmp

Download

memory/704-54-0x000001FD3C950000-0x000001FD3C9B6000-memory.dmp

Download

memory/704-53-0x000001FD3C750000-0x000001FD3C828000-memory.dmp

Download

memory/968-29-0x00000246E4870000-0x00000246E48D6000-memory.dmp

Download

memory/968-27-0x00000246E4870000-0x00000246E48D6000-memory.dmp

Download

memory/968-93-0x00007FF606F90000-0x00007FF607058000-memory.dmp

Download

memory/968-26-0x00007FF606F90000-0x00007FF607058000-memory.dmp

Download

memory/1208-16-0x000001569D2D0000-0x000001569D336000-memory.dmp

Download

memory/1208-17-0x000001569D2D0000-0x000001569D336000-memory.dmp

Download

memory/1208-61-0x00007FF621430000-0x00007FF621552000-memory.dmp

Download

memory/1208-18-0x000001569D2D0000-0x000001569D336000-memory.dmp

Download

memory/1208-15-0x00007FF621430000-0x00007FF621552000-memory.dmp

Download

memory/1596-455-0x000000000E5F0000-0x000000000EE6B000-memory.dmp

Download

memory/1724-219-0x000001C6C6CF0000-0x000001C6C6D56000-memory.dmp

Download

memory/1724-217-0x00007FF6E3BB0000-0x00007FF6E3CDE000-memory.dmp

Download

memory/1724-218-0x000001C6C6CF0000-0x000001C6C6D56000-memory.dmp

Download

memory/1724-247-0x00007FF6E3BB0000-0x00007FF6E3CDE000-memory.dmp

Download

memory/1896-172-0x0000029E1ED70000-0x0000029E1EDD6000-memory.dmp

Download

memory/1896-179-0x00007FF7A96A0000-0x00007FF7A99C0000-memory.dmp

Download

memory/1896-177-0x0000029E1ED70000-0x0000029E1EDD6000-memory.dmp

Download

memory/1896-173-0x0000029E1ED70000-0x0000029E1EDD6000-memory.dmp

Download

memory/1896-171-0x00007FF7A96A0000-0x00007FF7A99C0000-memory.dmp

Download

memory/1972-209-0x00000245E9480000-0x00000245E94E6000-memory.dmp

Download

memory/1972-207-0x00007FF6A75C0000-0x00007FF6A79D6000-memory.dmp

Download

memory/1972-211-0x00007FF6A75C0000-0x00007FF6A79D6000-memory.dmp

Download

memory/1972-139-0x00007FF6A75C0000-0x00007FF6A79D6000-memory.dmp

Download

memory/1972-135-0x00000245E9480000-0x00000245E94E6000-memory.dmp

Download

memory/1972-134-0x00000245E9480000-0x00000245E94E6000-memory.dmp

Download

memory/2044-95-0x00007FF6B5420000-0x00007FF6B5569000-memory.dmp

Download

memory/2044-97-0x000001AB08960000-0x000001AB089C6000-memory.dmp

Download

memory/2044-170-0x00007FF6B5420000-0x00007FF6B5569000-memory.dmp

Download

memory/2044-98-0x000001AB08960000-0x000001AB089C6000-memory.dmp

Download

memory/2204-76-0x000001BE4DB20000-0x000001BE4DB86000-memory.dmp

Download

memory/2204-153-0x00007FF638E70000-0x00007FF638F89000-memory.dmp

Download

memory/2204-74-0x00007FF638E70000-0x00007FF638F89000-memory.dmp

Download

memory/2204-75-0x000001BE4DB20000-0x000001BE4DB86000-memory.dmp

Download

memory/2308-156-0x000001067AD30000-0x000001067AD96000-memory.dmp

Download

memory/2308-155-0x000001067AD30000-0x000001067AD96000-memory.dmp

Download

memory/2308-154-0x00007FF7B91C0000-0x00007FF7B9462000-memory.dmp

Download

memory/2308-213-0x00007FF7B91C0000-0x00007FF7B9462000-memory.dmp

Download

memory/2404-86-0x000001E9803C0000-0x000001E980498000-memory.dmp

Download

memory/2404-88-0x000001E9805C0000-0x000001E980626000-memory.dmp

Download

memory/2404-87-0x000001E9805C0000-0x000001E980626000-memory.dmp

Download

memory/2412-105-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2412-107-0x0000000000910000-0x0000000000979000-memory.dmp

Download

memory/2412-111-0x0000000000910000-0x0000000000979000-memory.dmp

Download

memory/2412-182-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2812-35-0x00007FF606F90000-0x00007FF607058000-memory.dmp

Download

memory/2812-36-0x000001D822540000-0x000001D8225A6000-memory.dmp

Download

memory/2812-104-0x00007FF606F90000-0x00007FF607058000-memory.dmp

Download

memory/2812-38-0x000001D822540000-0x000001D8225A6000-memory.dmp

Download

memory/2812-37-0x000001D822540000-0x000001D8225A6000-memory.dmp

Download

memory/3184-198-0x00007FF7D5700000-0x00007FF7D57AD000-memory.dmp

Download

memory/3184-126-0x0000025528170000-0x00000255281D6000-memory.dmp

Download

memory/3184-125-0x00007FF7D5700000-0x00007FF7D57AD000-memory.dmp

Download

memory/3184-127-0x0000025528170000-0x00000255281D6000-memory.dmp

Download

memory/3204-227-0x00007FF6D7B00000-0x00007FF6D7E3E000-memory.dmp

Download

memory/3204-228-0x0000022500B80000-0x0000022500BE6000-memory.dmp

Download

memory/3204-229-0x0000022500B80000-0x0000022500BE6000-memory.dmp

Download

memory/3204-248-0x00007FF6D7B00000-0x00007FF6D7E3E000-memory.dmp

Download

memory/3508-71-0x00007FF64D130000-0x00007FF64D297000-memory.dmp

Download

memory/3508-62-0x00007FF64D130000-0x00007FF64D297000-memory.dmp

Download

memory/3508-63-0x000001A4663F0000-0x000001A466456000-memory.dmp

Download

memory/3508-64-0x000001A4663F0000-0x000001A466456000-memory.dmp

Download

memory/3508-69-0x000001A4663F0000-0x000001A466456000-memory.dmp

Download

memory/3952-226-0x00007FF662EC0000-0x00007FF66314A000-memory.dmp

Download

memory/3952-183-0x00007FF662EC0000-0x00007FF66314A000-memory.dmp

Download

memory/3952-184-0x0000023727F10000-0x0000023727F76000-memory.dmp

Download

memory/3952-185-0x0000023727F10000-0x0000023727F76000-memory.dmp

Download

memory/4108-46-0x0000023A965A0000-0x0000023A96606000-memory.dmp

Download

memory/4108-47-0x0000023A965A0000-0x0000023A96606000-memory.dmp

Download

memory/4108-45-0x0000023A963A0000-0x0000023A96478000-memory.dmp

Download

memory/4328-163-0x0000014466370000-0x00000144663D6000-memory.dmp

Download

memory/4328-164-0x00007FF766380000-0x00007FF766514000-memory.dmp

Download

memory/4328-162-0x0000014466370000-0x00000144663D6000-memory.dmp

Download

memory/4328-216-0x00007FF766380000-0x00007FF766514000-memory.dmp

Download

memory/4508-192-0x0000020C1EFC0000-0x0000020C1F026000-memory.dmp

Download

memory/4508-197-0x00007FF704740000-0x00007FF704C10000-memory.dmp

Download

memory/4508-191-0x0000020C1EFC0000-0x0000020C1F026000-memory.dmp

Download

memory/4508-241-0x00007FF704740000-0x00007FF704C10000-memory.dmp

Download

memory/5044-144-0x00007FF60A840000-0x00007FF60A8F3000-memory.dmp

Download

memory/5044-208-0x00007FF60A840000-0x00007FF60A8F3000-memory.dmp

Download

memory/5044-146-0x000001D729B30000-0x000001D729B96000-memory.dmp

Download

memory/5044-145-0x000001D729B30000-0x000001D729B96000-memory.dmp

Download

memory/5060-196-0x00007FF76D230000-0x00007FF76D973000-memory.dmp

Download

memory/5060-119-0x00007FF76D230000-0x00007FF76D973000-memory.dmp

Download

memory/5060-253-0x00007FF76D230000-0x00007FF76D973000-memory.dmp

Download

memory/5060-117-0x000001D749510000-0x000001D749576000-memory.dmp

Download

memory/5060-251-0x000001D749510000-0x000001D749576000-memory.dmp

Download

memory/5060-118-0x000001D749510000-0x000001D749576000-memory.dmp

Download

memory/5152-203-0x0000010F3FE50000-0x0000010F3FEB6000-memory.dmp

Download

memory/5152-202-0x0000010F3FE50000-0x0000010F3FEB6000-memory.dmp

Download

memory/5152-244-0x00007FF6B4670000-0x00007FF6B4B76000-memory.dmp

Download

memory/5152-201-0x00007FF6B4670000-0x00007FF6B4B76000-memory.dmp

Download

memory/5240-278-0x0000018B83D10000-0x0000018B83D30000-memory.dmp

Download

memory/5240-313-0x0000018B94710000-0x0000018B94730000-memory.dmp

Download

memory/5240-276-0x0000018B93D70000-0x0000018B93E70000-memory.dmp

Download

memory/5240-270-0x0000018B801E0000-0x0000018B802E0000-memory.dmp

Download

memory/5240-269-0x0000018B801E0000-0x0000018B802E0000-memory.dmp

Download

memory/5240-275-0x0000018B83950000-0x0000018B83970000-memory.dmp

Download

memory/5400-0-0x0000000000400000-0x00000000004A4000-memory.dmp

Download

memory/5400-42-0x0000000000400000-0x00000000004A4000-memory.dmp

Download

memory/5400-7-0x0000000002450000-0x00000000024B9000-memory.dmp

Download

memory/5400-1-0x0000000002450000-0x00000000024B9000-memory.dmp

Download