f2e9da65fd7d2eb12ec3da03cfffb40f9cf8cdc1ccde99c97052514254782f65

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 04:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
Size 612KB
Sample260715-em5deabs3p
SHA256 f2e9da65fd7d2eb12ec3da03cfffb40f9cf8cdc1ccde99c97052514254782f65
MD5 f5b81db08675808e372b68307d7898af
SHA1 0ed06eef4bd228a28e256ba0c203a5c6cf6ce7a9
SHA512 cebdb965fe28fe57e39e7e342cf2b7d77d650c0af569b24437b7e89a2a1ffb51b9670e0e31ae5db24359e59a7153eebfb8445178311dea60193d457b314187bc
SSDEEP 12288:Ho7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:HcnUJd/vJ/vA5kwzlUoq
TLSH
T133D423A3F755E64DD821EE302CA7BD7DD8A8AFDB98E8D0481E260949FC2035440B779D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1076	alg.exe
3852	GameInputSvc.exe
3424	GameInputSvc.exe
2060	elevation_service.exe
5964	elevation_service.exe
2732	maintenanceservice.exe
4748	msdtc.exe
1188	OSE.EXE
124	PerceptionSimulationService.exe
5620	perfhost.exe
2656	ReFsDedupSvc.exe
980	locator.exe
4448	SensorDataService.exe
2056	snmptrap.exe
1996	ssh-agent.exe
2984	TieringEngineService.exe
1748	AgentService.exe
4320	vds.exe
4588	vssvc.exe
4504	wbengine.exe
6092	WmiApSrv.exe
4528	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\bac7d06a8f8562d1.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001fe97d270f14dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000724c93260f14dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000019b854280f14dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004721f0260f14dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000085c8f82a0f14dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3424	GameInputSvc.exe
3424	GameInputSvc.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
Token: SeTcbPrivilege	3852	GameInputSvc.exe
Token: SeBackupPrivilege	2656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2656	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2656	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2656	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2656	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2984	TieringEngineService.exe
Token: SeManageVolumePrivilege	2984	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1748	AgentService.exe
Token: SeBackupPrivilege	4588	vssvc.exe
Token: SeRestorePrivilege	4588	vssvc.exe
Token: SeAuditPrivilege	4588	vssvc.exe
Token: SeBackupPrivilege	4504	wbengine.exe
Token: SeRestorePrivilege	4504	wbengine.exe
Token: SeSecurityPrivilege	4504	wbengine.exe
Token: 33	4528	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4528	SearchIndexer.exe
Token: SeDebugPrivilege	3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
Token: SeDebugPrivilege	3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
Token: SeDebugPrivilege	3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
Token: SeDebugPrivilege	3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
3500	2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 3424	3852	GameInputSvc.exe	89
PID 4528 wrote to memory of 5448	4528	SearchIndexer.exe	111
PID 4528 wrote to memory of 2648	4528	SearchIndexer.exe	112
PID 4528 wrote to memory of 2732	4528	SearchIndexer.exe	113
PID 4528 wrote to memory of 2600	4528	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_f5b81db08675808e372b68307d7898af_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3500

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1076

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3424

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2060

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5964

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2732

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4748

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1188

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:124

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5620

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2656

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:980

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4448

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2056

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1996

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2984

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1748

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4320

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4588

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4504

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:6092

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5448
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2648
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3068 3064 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2732
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3004 3024 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 eaa857a37593ff8b99bfcb193a30a20ebca1617bbe5a9b2a561f4b0ac37f3713
MD5 653f0432de618d9ca8cb6d7fea402443
SHA1 2d6d75736532a30fa8a91ed9858beed7156f8ff0
SHA512 2fb626017ea5ae09526c98edad9d65d94fd3ae2ad846f983ce2d4bd276b7ee361f5c3f3f3c48e8c7f6d15e8071ad0cd7ec5a0d2cacc829d180acd75f4a25f233
SSDEEP 49152:Eb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnLVbh/vAqslUoq:+3q6gjB1hlUoq
TLSH
T197D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 41d33e3d1de80f3488bfc455f6dd164bc776d0c4dc549096db5ce78a7dc24039
MD5 b8235c0da1b48da4b90a9a6aae104c13
SHA1 f3e080cde2e32151eed6fe4596a2b6bf7d7a3170
SHA512 7828f451f7e070c34f574f42aa3515f96488322f7027afa61660feabd3bee37557499e784f85cedf25bd728239fbea86dcd2eed148a3808238c43084093ca8dd
SSDEEP 12288:F1XLsAJguxy2lRq2czAXo7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:LXYOPtczAXcnUJd/vJ/vA5kwzlUoq
TLSH
T14E050229B3D409FDEC67813CCCA28915EA73789647A0E78B03B489655F233D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 72fe88234054242fb6185693f3ebdb6907661b4e541abe7f55cd32dbc53806da
MD5 054e88f82fffdaab4c99e0252fafc496
SHA1 58c82900908278d71d36abd3e04d63c3d260d5ba
SHA512 fe29fb113d710aad8a146f798f355b44c73e51df5adb360a8b91b8d013519e4b047d6dd61b3fee83e3662924d27705a13b536e6aa58f28e216226e59d0ecdb7b
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+C9o7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuNP:Owu+OWqcnUJd/vJ/vA5kwzlUoq
TLSH
T1D405F14673A41CF9E96386388997D53AF7F2B8422A64D71F0760C6576F23360AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bc070461a6254e2c37fa8030016928ceede2bd696d831b4c838157de5c38763a
MD5 db94913ebd0672b66db1366910285d59
SHA1 ed95022dd380e2c799fd156976505ef319aadbf7
SHA512 58dcdff309a2283bf8c991a15b9fd5d8c178173a374343d8f52c9fa8eb82f73ba3de815ceabd4a216335c88c52afe65432d2c29ca8dd798a7acf4ac69c448d93
SSDEEP 49152:YB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glQVbh/vAqslUoq:yu6JmTxd2d5hlUoq
TLSH
T142D59D13F2DA01E8D06ED578974A9233E962BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 ccbbfe37fa43cf475d975a79d4032b705aa2251d8be0a0a87ddd03535909f314
MD5 1e182fe32192da37af36718f0188e49f
SHA1 d31349dc0d8f685e958d5c44f6da2937ff3b25c3
SHA512 3769ce95c8a9ad73e7c1f26d2bde1a8e7ae819b6b34030330f152a66325e4ca6c1211213b973dbef45d3b5b9abc1e93fd2850cba15efc3f9fc4aa86b82476016
SSDEEP 12288:Ba7so7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:wscnUJd/vJ/vA5kwzlUoq
TLSH
T146D42373F345EA4EF831AE306C96AD2CE46DBBD79EA4D0CB6D250541AD3038448BA35D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7d179f04620d47418fe8d32f0d4800b4884beecc10b18a70b5ae13c0e6951a1e
MD5 98fb1260228c820f6253fc34d947d55c
SHA1 277a14c72cb884b3c3a5fd5efbedf4cf22ab761b
SHA512 85f205651b58aa5036f302984b0a1e31332ab4f205a90d311af1d250999d0b19fe23d14b2d0c35913fb0acfea696e335d5ccc38449e07a27fabd2797ba9bf708
SSDEEP 24576:Tgb6bmBIi49WNNFpg1rSvFv7bYfcnUJd/vJ/vA5kwzlUoq:Tgb4mBIBhGFEVbh/vAqslUoq
TLSH
T11C65AE1E22EC02F5E0F5E2B8DDAA441BD6B278160731D2DF1251426D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 7bb70c64143fdbd4643d9d2d54d0584218f18760c64d94eb40f97bed3b8cc4e3
MD5 d503ca7e9a3a750e9288a2f29dfb56f9
SHA1 5428923c47bf13e840270943631d39be12882617
SHA512 27f7601cadf5d8017e176364e169f02443a2f6c79f638c8b005d9605dcca218a951071c0d95b57958b5bea102bf318bd64d6ca13e3dd9c884a6930962279ea9f
SSDEEP 12288:FBGZo7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:XGZcnUJd/vJ/vA5kwzlUoq
TLSH
T139E4237A72A5718CC835DE345CA2AC6EF8F47AE25B64D0EF0DA145319F103E0617EE98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 f3dd58aef23e28206438f4e602e2565b733fcfa9fd6e15a47336b65846777362
MD5 9d6d70ef76579f9f0f7c13be0d5429af
SHA1 7a4ef2be2d92fa1c92dd114eabfbce6b3762f9ed
SHA512 b436fc7bb76593b600b6bf2522b055bdf1ca8c1adfd9082b2ffb778b8e14fae92d88b403a3e07b6b9c4e1c9bbd04561c935ef65a0ca8cad71c6edc3404ed09f7
SSDEEP 12288:NDo7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:NDcnUJd/vJ/vA5kwzlUoq
TLSH
T1F9D423B7F305E68EE821AE306C93BD5CE8A8AFD79BF8D0CB5D3505019D103D451BA298
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 5a140f7097219021978ce9f34f4d7bddda60042ae16e7483cfc884a5603204c9
MD5 7c82600e283d12136fd750d684c1b3d9
SHA1 bbbdb2853a50ee6876ba0e6dc9a41f1680f5a38c
SHA512 25b1ff56a090d9cbef2b245857cbe166b4d4f815c76c4dbd7628b04d5b055f8199327e2f7d6f5671707a1997a28f117deb6a9dafccb145fbd2270c8d5823d167
SSDEEP 24576:bwr8+8OsJqH1Mzria7/mgcnUJd/vJ/vA5kwzlUoq:UwpOEqVra7/7Vbh/vAqslUoq
TLSH
T12535F165B7E101F4D477D13889824A67F6B1B8260364EBDF0BA88B511F237E44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 6658abb750c49a51c94381e5dfda4a0391c439a9a15022eed16c150b65abade4
MD5 d08f04b54748aec79d7606df4775aa23
SHA1 c25387925cd71b604173d296a60c866496b2fcbb
SHA512 02f6afc532bbb639101302ba8dca493b511ebbab2c9221cc8cdc2a4a66aba774e5c3563f5362150c5bd8afb49f0c609156e21946daf8ab64d42ce439f606e57e
SSDEEP 12288:BHvUrBFrEjwaQoo7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:BPUr+NQocnUJd/vJ/vA5kwzlUoq
TLSH
T1A705F12F62AD18E5E676E53C8982860DF671B4A31751D2CF02E1417E5F23AD8BC3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 c77ad283644ad7b3bac99fd1fa03606a37e01977f54acad6e11e66c3fb88946e
MD5 6c3fdb8cc2e8c4cc0bdb2d49a6c94e29
SHA1 4f29226acc11335f011d29d766afaa598e540515
SHA512 056a8ebf20d94d9fcd957e833f9171d4900816950d6a1168d0152b5e3ce4a40bbf3f9e2d22bf2d31ca6533a637437cddc29422acac5891e6455b6c686c6d5692
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjwVbh/vAqslUoq:eG05lO43bahlUoq
TLSH
T147D5CF6A62EC11F9D1BBD17CD9C68A0BEBB23815033556CF02A486A91F23FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 ad0c6ffac81f36ed1c97a4a519bf301b59b143fac1aa12562c2673940ef255bd
MD5 4c62b8e300861425cf23520055c66c4c
SHA1 367e533e7e251731ee44ba950202583b288994ac
SHA512 c43df8413f08c03084ef6b5b4768cf72457e0715a4f3cbfdeeed804e68e2e280e1841f761652faf4f40753dc75cbe7b968a54070f95a87e1edc213ed8416f3e3
SSDEEP 24576:iIa5POZ3dpbWVM50JicR2hG0lasx2+47eidnIcnUJd/vJ/vA5kwzlUoq:xa5POZ3wJt2pasx2+mSVbh/vAqslUoq
TLSH
T11265BF5EA7FC01D5D579D17CC5838A1AE5B1346253319ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a9d852dd297787d9ab89ec8efa0ea26eac2b6c5580e3f4b4d9e14c165014bd90
MD5 24f9dc1481bd25c7983c75c1cd6b458b
SHA1 799aa692c3b370cfcdd6ad0687a6d9a4dd7799b7
SHA512 7f45f94bffee238dd3c7131f3724aef405af8f28c296fa947b546464b47ce89360091d0c20a6b8fbe430256b6aeff1e0f0d86368841b73c9b75bda693120d2d6
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7FkccnUJd/vJ/vA5kwzlUoq:ENc/zEOVHFjVbh/vAqslUoq
TLSH
T142858C2623E901E4F5BBE1BE89779946FAB17865173086CF0291811B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 18d75b0e422ae45b19b3f5d077171ffe28c64d2deceb574a9818d11b70f63826
MD5 25c2f5a054fe80bc08323eff4d04671f
SHA1 3b9dd8da39920a7513b54584913a3c649fc54976
SHA512 c6a0571466bc28fdfae856f2a82745cf190edeb896e247b2adfe1128a150386b9c5d7e5017e37a1585e34a84b1773a5f9dacf2a687bf6bc3e25b623f6a7ed866
SSDEEP 12288:ayHPJnJP6szeCs6Rl28d4o7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:TJnJPbzB4S4cnUJd/vJ/vA5kwzlUoq
TLSH
T1D015E03DD2A810E8E4B7C274815A1A59FE71387D2F21A9CB19B4D5343F12FE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 45da61de50c372e8fa61fde163a461fe6c57b5f711ab47941870b9c527abf9df
MD5 d4b9c84a6b1c33d4d2d8bb203e90b340
SHA1 efdd1488939286a808df3ea793c6e654ee7d14e3
SHA512 6bdc0f4c477c0c6b2c8702c5276afe1e8267c71e9f7d2c19516e1d4738e799141a13ea9a7a60e97bae7718549ad4cf65252bec5b2ba39476e31dcf43b844c8bc
SSDEEP 24576:JCLHGL0MoeVtFumTijCmlKQWDk0cnUJd/vJ/vA5kwzlUoq:JCLHGeeV5ijCmlDWDk0Vbh/vAqslUoq
TLSH
T1D3A56B05E7EB5188E8F3CAF5C92694169A327C549B34F7DF4E80CA6A1E32BD0D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 629b23133912529379b62d671278897755e0df91070d361341d28ffe2dbf226e
MD5 71d0405593d6628017f2478bbfefe321
SHA1 6e62800b4a9a51c407304b89d0ea7b975cd90d7f
SHA512 da6bcc941945dd88e20a20f7b565647d7507621489e3362d579df6436f6fce3159d568d3aba35a8de1ff932dff17686d45eeef4c155bdb9018211992e6c057bb
SSDEEP 12288:z1Hck6j5ZI78do7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:H6DIkcnUJd/vJ/vA5kwzlUoq
TLSH
T166F4015D737A20F9D037D03D88830909E1B2B5B2876195CF0BA4857A9FA3ED8B93DE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 af6a4985e2b541ee25a0ea9234a07bd47a156867d050899521ad441c009ecf10
MD5 a90c52265a36c556a84b2d45bf38b789
SHA1 72d61bc0dd4893679c30ed25d11115efa282cbab
SHA512 bbc0cbc8cbd7d947bb5d9310613f8f05a25ac6f9c3d379db348ee079b59e0cacfe59788f8139d8229a1b0ddde6944cfbaa282891b841218946aef8a3779a5ee7
SSDEEP 12288:kG6ky5o7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:1ty5cnUJd/vJ/vA5kwzlUoq
TLSH
T167F42211B384B1C8E8355E349CB389ACDD74BDA29F60D2DF1AA0963E6F303D0A875B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 4ca46a3550e5de39623ea5c461bda0531f01aa7aaf96d404fd5535e53238169b
MD5 7736e76b165afd1f25cfaff877819100
SHA1 2ae92c01ec728d001681b1eb78f850f741c3e6e0
SHA512 e20624c4de0c37c37c36657d1fb8ab29812846b9e010c38cfad214b287e0d1b4be228f7c454128f0173f2473011a25835b9b8a55e3a675676323ed777b025c13
SSDEEP 12288:lP+o7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:9+cnUJd/vJ/vA5kwzlUoq
TLSH
T140D423BAB315B68DD820EE302C97AD9CD4B87BE75FA4D0DF1DA50531DE203D041BAA58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 7f08e467e1c552a207f003fc3e3544b5f352cd9f7d09f2222679b1cf25b6df1b
MD5 8b6714dd57cd5eac02c7fe45545ffcb9
SHA1 a3809e0667e6f0c64090a681dcde00377fa921d0
SHA512 66ced952d9123e0aec4f367427b567a699e99547eea93c814c07b50c7e0d8517494a70567aa9bac6ca8b6577ea50c6d75c89756b7028eab3e037d29b1bdfb86a
SSDEEP 24576:aog5LoTfaidZScnUJd/vJ/vA5kwzlUoq:zguTrZSVbh/vAqslUoq
TLSH
T1C6559C1DB3EA05CAE2B2D635D8725493D633B4315772D6CF2448C03A4DAAED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 dbd9658865dcc191627e23b76ddd1a0aa36423295b4544f3ddf494b02ce64d08
MD5 68aa3a478f472f8bea8c2393352c8403
SHA1 f4dbd4d07a39f098d646ead28779bd4f9b199525
SHA512 43e3463fa64d5aed66194f53d58cad5a46fdc98734e7c97869bac3108a181c6aac8624910760b3e3db4c99d620f802d5af0b21529ed80423cddb38409a120d46
SSDEEP 12288:6pJcm8CN+yo7ncqwHsn2kwH/0UtvJ/aQADHMW90IzQwaEBjpuN34q:6rcmRncnUJd/vJ/vA5kwzlUoq
TLSH
T11D05F15EB36E00EAE077C13C8C824959F6B374716761A3CF06A1877A4E236E97D39B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 cf8cf43e6c0372ef0f4a40ae8c01d256f28a3a43b804fae0558ebcb9b92da026
MD5 607b2a923928e79d1ba3d353357f093a
SHA1 95fadc0bb740ba3ebd2f7c85e31efb26d151673c
SHA512 5d2bb22c5d44670702c30d61d0b18e97d06c3cbdf81abacab84d2cc56b7867d76fd861e3f16948f7cb0d1a79b2b527e1b05c43f472064ee408946c7ca4ed3678
SSDEEP 49152:lDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3EVbh/vAqslUoq:m3Upow8sBmhlUoq
TLSH
T1D8A58C3DA2E810A8C8AAC379C54213A5EA71742E3F3055DB0174C578BF1BEF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-98-0x0000020278AD0000-0x0000020278B36000-memory.dmp

Download

memory/124-152-0x00007FF6CC880000-0x00007FF6CC9C9000-memory.dmp

Download

memory/124-95-0x00007FF6CC880000-0x00007FF6CC9C9000-memory.dmp

Download

memory/124-97-0x0000020278AD0000-0x0000020278B36000-memory.dmp

Download

memory/980-126-0x0000015D70270000-0x0000015D702D6000-memory.dmp

Download

memory/980-124-0x00007FF772BB0000-0x00007FF772C5D000-memory.dmp

Download

memory/980-125-0x0000015D70270000-0x0000015D702D6000-memory.dmp

Download

memory/980-189-0x00007FF772BB0000-0x00007FF772C5D000-memory.dmp

Download

memory/1076-18-0x0000021783A30000-0x0000021783A96000-memory.dmp

Download

memory/1076-16-0x0000021783A30000-0x0000021783A96000-memory.dmp

Download

memory/1076-15-0x00007FF6CBD40000-0x00007FF6CBE62000-memory.dmp

Download

memory/1076-17-0x0000021783A30000-0x0000021783A96000-memory.dmp

Download

memory/1076-50-0x00007FF6CBD40000-0x00007FF6CBE62000-memory.dmp

Download

memory/1188-88-0x000001C3CE050000-0x000001C3CE0B6000-memory.dmp

Download

memory/1188-86-0x000001C3CDED0000-0x000001C3CE049000-memory.dmp

Download

memory/1188-87-0x000001C3CE050000-0x000001C3CE0B6000-memory.dmp

Download

memory/1748-179-0x00007FF7BAB20000-0x00007FF7BAE40000-memory.dmp

Download

memory/1748-177-0x000001DC55D30000-0x000001DC55D96000-memory.dmp

Download

memory/1748-171-0x000001DC55D30000-0x000001DC55D96000-memory.dmp

Download

memory/1748-176-0x00007FF7BAB20000-0x00007FF7BAE40000-memory.dmp

Download

memory/1748-172-0x000001DC55D30000-0x000001DC55D96000-memory.dmp

Download

memory/1996-155-0x0000018A42760000-0x0000018A427C6000-memory.dmp

Download

memory/1996-156-0x00007FF725CB0000-0x00007FF725F52000-memory.dmp

Download

memory/1996-154-0x0000018A42760000-0x0000018A427C6000-memory.dmp

Download

memory/1996-202-0x00007FF725CB0000-0x00007FF725F52000-memory.dmp

Download

memory/2056-145-0x000001F412C90000-0x000001F412CF6000-memory.dmp

Download

memory/2056-144-0x00007FF6AE3A0000-0x00007FF6AE453000-memory.dmp

Download

memory/2056-199-0x00007FF6AE3A0000-0x00007FF6AE453000-memory.dmp

Download

memory/2056-146-0x000001F412C90000-0x000001F412CF6000-memory.dmp

Download

memory/2060-45-0x000002B069C90000-0x000002B069CF6000-memory.dmp

Download

memory/2060-44-0x000002B069A40000-0x000002B069BB9000-memory.dmp

Download

memory/2060-46-0x000002B069C90000-0x000002B069CF6000-memory.dmp

Download

memory/2656-184-0x00007FF77E6C0000-0x00007FF77EE03000-memory.dmp

Download

memory/2656-120-0x00007FF77E6C0000-0x00007FF77EE03000-memory.dmp

Download

memory/2656-117-0x000001B500120000-0x000001B500186000-memory.dmp

Download

memory/2656-116-0x000001B500120000-0x000001B500186000-memory.dmp

Download

memory/2656-251-0x00007FF77E6C0000-0x00007FF77EE03000-memory.dmp

Download

memory/2656-249-0x000001B500120000-0x000001B500186000-memory.dmp

Download

memory/2732-71-0x00007FF763520000-0x00007FF763687000-memory.dmp

Download

memory/2732-63-0x00000201EA370000-0x00000201EA3D6000-memory.dmp

Download

memory/2732-69-0x00000201EA370000-0x00000201EA3D6000-memory.dmp

Download

memory/2732-62-0x00007FF763520000-0x00007FF763687000-memory.dmp

Download

memory/2732-64-0x00000201EA370000-0x00000201EA3D6000-memory.dmp

Download

memory/2984-212-0x00007FF6A4010000-0x00007FF6A41A4000-memory.dmp

Download

memory/2984-165-0x00000230A4970000-0x00000230A49D6000-memory.dmp

Download

memory/2984-164-0x00000230A4970000-0x00000230A49D6000-memory.dmp

Download

memory/2984-163-0x00007FF6A4010000-0x00007FF6A41A4000-memory.dmp

Download

memory/3424-38-0x0000014A283C0000-0x0000014A28426000-memory.dmp

Download

memory/3424-92-0x00007FF7802A0000-0x00007FF780368000-memory.dmp

Download

memory/3424-34-0x00007FF7802A0000-0x00007FF780368000-memory.dmp

Download

memory/3424-35-0x0000014A283C0000-0x0000014A28426000-memory.dmp

Download

memory/3500-7-0x0000000002440000-0x00000000024A9000-memory.dmp

Download

memory/3500-0-0x0000000000400000-0x00000000004A4000-memory.dmp

Download

memory/3500-6-0x0000000002440000-0x00000000024A9000-memory.dmp

Download

memory/3500-37-0x0000000000400000-0x00000000004A4000-memory.dmp

Download

memory/3500-1-0x0000000002440000-0x00000000024A9000-memory.dmp

Download

memory/3852-28-0x000001FFF8EE0000-0x000001FFF8F46000-memory.dmp

Download

memory/3852-27-0x000001FFF8EE0000-0x000001FFF8F46000-memory.dmp

Download

memory/3852-26-0x00007FF7802A0000-0x00007FF780368000-memory.dmp

Download

memory/3852-61-0x00007FF7802A0000-0x00007FF780368000-memory.dmp

Download

memory/4320-183-0x0000022183520000-0x0000022183586000-memory.dmp

Download

memory/4320-185-0x00007FF67FCD0000-0x00007FF67FF5A000-memory.dmp

Download

memory/4320-214-0x00007FF67FCD0000-0x00007FF67FF5A000-memory.dmp

Download

memory/4320-182-0x0000022183520000-0x0000022183586000-memory.dmp

Download

memory/4448-134-0x0000020679460000-0x00000206794C6000-memory.dmp

Download

memory/4448-209-0x0000020679460000-0x00000206794C6000-memory.dmp

Download

memory/4448-211-0x00007FF6EAE50000-0x00007FF6EB266000-memory.dmp

Download

memory/4448-198-0x00007FF6EAE50000-0x00007FF6EB266000-memory.dmp

Download

memory/4448-135-0x0000020679460000-0x00000206794C6000-memory.dmp

Download

memory/4448-139-0x00007FF6EAE50000-0x00007FF6EB266000-memory.dmp

Download

memory/4504-239-0x00007FF76DD40000-0x00007FF76E246000-memory.dmp

Download

memory/4504-203-0x000001F0C7D80000-0x000001F0C7DE6000-memory.dmp

Download

memory/4504-205-0x00007FF76DD40000-0x00007FF76E246000-memory.dmp

Download

memory/4504-204-0x000001F0C7D80000-0x000001F0C7DE6000-memory.dmp

Download

memory/4528-246-0x00007FF7FCB40000-0x00007FF7FCE7E000-memory.dmp

Download

memory/4528-227-0x00007FF7FCB40000-0x00007FF7FCE7E000-memory.dmp

Download

memory/4528-228-0x000001C5B69D0000-0x000001C5B6A36000-memory.dmp

Download

memory/4528-229-0x000001C5B69D0000-0x000001C5B6A36000-memory.dmp

Download

memory/4588-194-0x000001B24ED30000-0x000001B24ED96000-memory.dmp

Download

memory/4588-224-0x00007FF61F8A0000-0x00007FF61FD70000-memory.dmp

Download

memory/4588-192-0x000001B24ED30000-0x000001B24ED96000-memory.dmp

Download

memory/4588-193-0x00007FF61F8A0000-0x00007FF61FD70000-memory.dmp

Download

memory/4748-75-0x00000226BFC30000-0x00000226BFC96000-memory.dmp

Download

memory/4748-76-0x00000226BFC30000-0x00000226BFC96000-memory.dmp

Download

memory/4748-133-0x00007FF68A5E0000-0x00007FF68A6F9000-memory.dmp

Download

memory/4748-74-0x00007FF68A5E0000-0x00007FF68A6F9000-memory.dmp

Download

memory/5620-162-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/5620-104-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/5620-105-0x0000000000920000-0x0000000000989000-memory.dmp

Download

memory/5620-110-0x0000000000920000-0x0000000000989000-memory.dmp

Download

memory/5964-54-0x000002A471790000-0x000002A4717F6000-memory.dmp

Download

memory/5964-55-0x000002A471790000-0x000002A4717F6000-memory.dmp

Download

memory/5964-53-0x000002A4714F0000-0x000002A471669000-memory.dmp

Download

memory/6092-219-0x00000202D8AC0000-0x00000202D8B26000-memory.dmp

Download

memory/6092-218-0x00000202D8AC0000-0x00000202D8B26000-memory.dmp

Download

memory/6092-245-0x00007FF6E6930000-0x00007FF6E6A5E000-memory.dmp

Download

memory/6092-217-0x00007FF6E6930000-0x00007FF6E6A5E000-memory.dmp

Download