4ca42b0cda9bceef50071df240e6255c661e307f1a0bbbfc326ba203c29b976a

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 10:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
Size 612KB
Sample260804-m11ldatybs
SHA256 4ca42b0cda9bceef50071df240e6255c661e307f1a0bbbfc326ba203c29b976a
MD5 8ad25b3fc054646e20c502a298b34246
SHA1 4a4ef982f21ca1461a4e350b0739a5514ad0ccdf
SHA512 de9fb1038f83f341ddb7138fea671183689bdb4acd6f73c9771071d1e7a3eb475c6252b323a95d6899c55dfc620d774a82d6ffd1059f3f42b183d99d2e358826
SSDEEP 12288:vTJd8wbba1++Eu9AK9wjNwMqKynwwdOBYD+m6Gy6dUIb3FflqsJ:vNOwXuApNbawaAOm74UIbXtJ
TLSH
T173D423D19F0A9D5AC83708B282FF22E3B371919559189B315E44CF2E4EA77680CFF855
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3308	alg.exe
4780	GameInputSvc.exe
5856	GameInputSvc.exe
2360	elevation_service.exe
5508	elevation_service.exe
3156	maintenanceservice.exe
5988	msdtc.exe
4700	OSE.EXE
6064	PerceptionSimulationService.exe
1872	perfhost.exe
3132	ReFsDedupSvc.exe
5732	locator.exe
5056	SensorDataService.exe
3632	snmptrap.exe
5656	ssh-agent.exe
5924	TieringEngineService.exe
5000	AgentService.exe
4188	vds.exe
768	vssvc.exe
5764	wbengine.exe
1008	WmiApSrv.exe
1216	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\baf0558d8f8562d1.bin	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\java.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a76300f0024dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000073c5ed0f0024dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a61acc0e0024dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c859c0f0024dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008041d70e0024dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092e13b0f0024dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
5856	GameInputSvc.exe
5856	GameInputSvc.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
Token: SeTcbPrivilege	4780	GameInputSvc.exe
Token: SeBackupPrivilege	3132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5924	TieringEngineService.exe
Token: SeManageVolumePrivilege	5924	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5000	AgentService.exe
Token: SeBackupPrivilege	768	vssvc.exe
Token: SeRestorePrivilege	768	vssvc.exe
Token: SeAuditPrivilege	768	vssvc.exe
Token: SeBackupPrivilege	5764	wbengine.exe
Token: SeRestorePrivilege	5764	wbengine.exe
Token: SeSecurityPrivilege	5764	wbengine.exe
Token: 33	1216	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1216	SearchIndexer.exe
Token: SeDebugPrivilege	2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
Token: SeDebugPrivilege	2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
Token: SeDebugPrivilege	2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
Token: SeDebugPrivilege	2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
2996	2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 5856	4780	GameInputSvc.exe	91
PID 1216 wrote to memory of 5036	1216	SearchIndexer.exe	113
PID 1216 wrote to memory of 2712	1216	SearchIndexer.exe	114
PID 1216 wrote to memory of 4972	1216	SearchIndexer.exe	115
PID 1216 wrote to memory of 864	1216	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_8ad25b3fc054646e20c502a298b34246_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2996

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3308

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5856

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5508

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3156

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5988

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4700

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6064

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1872

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3132

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5732

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5056

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3632

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5656

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5924

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4188

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:768

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5764

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1008

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5036
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2712
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2580 2564 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4972
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2588 2576 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bf0ae62b95c4b89c21d3757c116c0784b55c8c9acdf3d936de09e6c53de09048
MD5 7b8a1a59cb37186c857704b981071cd6
SHA1 b6f9af0823cb1966e623efac32f9c1f3f919b68b
SHA512 2ff78d03e830de76efa3180cf1833dbaa3e21f837edcc481338ff5ea4cd6c6f7d70bd3a4ce56eabb154db4c815d6ed1159d6ec98bc3c0492719ed878760f416a
SSDEEP 49152:hb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnBJXVDktJ:n3q6gjBGib
TLSH
T1D5D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 35d19b14426d416e1092994397c36495b19893f4c35f539371cceb84d4ac1d2f
MD5 88512295368a68f4c75bb953cae9081a
SHA1 a24e0920fe939f4e7269dc8ee06b727cdf8c29d3
SHA512 bf6f1ddd344e534e0773ade6b591feaa040546ea48475bbb00022bdb5de518a93107c8286f75051de5687686796b82e6033149180410309a8968e1889a43de83
SSDEEP 24576:IXYbfIczAyNOwXuApNbawaAOm74UIbXtJ:nIcxJXVDktJ
TLSH
T118050128B7D509F9DC27817DC9B68142E373B8554764EB9B03E4CA2A0F237981E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 0bd21da5925761cf6999085242e13a541a57bb90fa4489d696592293f14d98ea
MD5 4a46b807fedd0e822fca6fb1df51d36b
SHA1 d8f4fffa635f925d08937035836ea512ddac5ad3
SHA512 a450653b24cea9fdbb5e4f2c81706aa3c8f3edec18d8ff1b217e176f8a891344059caf3e2bbc05e4f931ea1565357734b90ddda4efd38b8f984689bf3a375f70
SSDEEP 12288:5mw5HEjsChNRBFgl0WDm+CucTJd8wbba1++Eu9AK9wjNwMqKynwwdOBYD+m6Gy6T:UwusOWqNOwXuApNbawaAOm74UIbXt
TLSH
T1BA05F18677951CF9E967413986AB8176F3F2B8012A24DB2F1760C71B5F373606D2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 90a47541011f53fae99c7b489c13b1c475134978a540ae10d5f1d804679cc652
MD5 aa86fe3e1313b2e8536ef3ba8891fc7b
SHA1 14f3c7a5977783df220696751d2881a330f6be3c
SHA512 91f6f1c625828ce0331d61eec151d560fd36b02a78babb34e0c35dc0424e5290829bba85f1ed51d38074bd0cd638a8bf4590c5caeb51b8555f983dc5e3b6b0f4
SSDEEP 49152:Rf+taZ3usBWOBr4tEGp0bqx0z+n217aau1gliJXVDktJ:Vu6JmTxd2d8ib
TLSH
T11FD59D13F1DA01E8D06ED478975A9233EA62BC490B34B6EF0A9073562E77EE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 944KB
SHA256 c2b5678e950ae789e6520acc3a030cefca48360cb48b8010e9d2ec7e6811ddf9
MD5 774b115d737e6fe3b70fa91db0b1b468
SHA1 1d1611ba9e02e27d096bb92d6b6740477feb0b57
SHA512 5ccc077392432334b63376eb501e7bdd753b07c1d28fe0fde4ff3a42ed9ae53cb9f7378032f238b3d7fcb5177c74328cf70da879317cc84bbd47e4ddf23e050f
SSDEEP 12288:gG00dU3fKTY4GSCCgra8IDxIhQH33SFb2JdK1T9F0hM:gJoUPz4Gqge9FHHSFbKKJ9F0h
TLSH
T13C251710B666D74FC6A940321E37D1CCA7B07D01EE45AB0372C8873FD576A58BAF6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 458KB
SHA256 2b501a86882a80234d5cae09f6dfb0f12a62cc46456bc8e8a80536076f992103
MD5 66821b037fa1bd5538a63d822a36e46e
SHA1 e75e9cda0c2a5afab52ad69dbdc9727f5a171812
SHA512 620c10d1d0a98e923d40a8ab8defcce37f02ff3afbb62c6fcf898496aadda03c2733236e9121792d98440c27b9767e89cb7960eb814ac52b70f32d35470d709f
SSDEEP 1536:ykDRH109kPNESuUKZYKZz8Df/jvz5jvwY8YOwyj6g4w/sujowhqSKnJpU:dNK2KMf/jV8tsE6O/jjTbKw
TLSH
T1F3A4B700B676F24FC0B660320B2A978D7778E813BB056F1777C4453ED85AB15A9BA3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 76e191abe926e354e5e0797773a559d28f5a955e1c1c6d6b506aecfae992f1c7
MD5 25b3a0808a14e4563b60b741aa35c181
SHA1 fd5df9ba7a9945ca01e6606646355fb59e857f89
SHA512 fd651b6805d679602d36406ed375710446bf1ef15b74e4d970377f13bd5aa5c368d46a6b7101117f1d07a06b6baf9d48675c1512abd11fadba2afb0f47c3c5c1
SSDEEP 12288:Ke7wTJd8wbba1++Eu9AK9wjNwMqKynwwdOBYD+m6Gy6dUIb3FflqsJ:9wNOwXuApNbawaAOm74UIbXtJ
TLSH
T119D423929B096E4ADC3705B181FE52D27376A1545F18DAF3AD44CB1E0EB3BA40CFE852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4847f63c914c6d66b45a73ee253be25e861877bdbfad5fb950768757aa831d68
MD5 009329872077d1d371dc0fc3dc16fec9
SHA1 d9ea0fd103f7f331cdad0e49693fb8f37cef7e17
SHA512 0e21faef35dd98b2f98594a2a62c4175e0a77bd27edbcf3aad6417c00851e2a50d3f8851d2b689682e30e1adbecd15454534b517a58dc68742f829f78dddc962
SSDEEP 24576:ngb6bmBIi49WNNFpg1rSvFv7bYXNOwXuApNbawaAOm74UIbXtJ:ngb4mBIBhGFCJXVDktJ
TLSH
T1B365AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D6DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 44a4a490e0cb2745c89f68679efd268d28478032ec7470aefbb9574d46d05d9c
MD5 c122b171d7d28895a7f7331bb8818fb7
SHA1 c0dffa50a84836ddd2a3f75fd704eab1c2499109
SHA512 4326d5be51d9f7faba57f79deae3efbc6b768dfb924c4fc44f2b9b8b03c865ef05d5114226944290146e06dad136bf493eae3336df021d8b2f78ca101c520b47
SSDEEP 12288:mOGwTJd8wbba1++Eu9AK9wjNwMqKynwwdOBYD+m6Gy6dUIb3FflqsJ:NGwNOwXuApNbawaAOm74UIbXtJ
TLSH
T1E2E423A96B467998C83B467584BE11D3B2B171A057186BFF0DC0C63A4FA7AF01DBEC50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 9a4c55b766db4a683e70fade9955bcc0559a8d348876304667b914cf422b0f82
MD5 26c333457012dfc0174602bb1b85cac4
SHA1 2691279c5978d56308f156652ba40546e08c715a
SHA512 60aab7ad8c30261bd1f8af6fe72caee4bedfcfe41055f15e901a89f5eadf6d9c9d3e8ad961f5b66149ebb15a0ba9b74863124fe5c0ba950f8d2208dc9a6a0e5b
SSDEEP 12288:MgTJd8wbba1++Eu9AK9wjNwMqKynwwdOBYD+m6Gy6dUIb3FflqsJ:MgNOwXuApNbawaAOm74UIbXtJ
TLSH
T192D423D15B09AE5AC82705B681BE12C3B361915457189BF36D44CB2A0FD7BF80DFE861
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 7a8be221ff69528e659e3a7483c00fce76d6c2a80fa478c52cef14e2598b2513
MD5 daba5cf9d80778cce82776bc482f18b9
SHA1 67db906a17d363619bd6a878ac3f3d3deb1e36c3
SHA512 8275733e59ea6bde7764606be78a50fdf9f701622803bc5142cebeee84c596d5971d734a98cf2b71a000401d596bc888da9351c4bcbd571681f26453366b68f5
SSDEEP 24576:i578w8FpJqH1nzria7/mGNOwXuApNbawaAOm74UIbXtJ:ugvFPqV6a7/DJXVDktJ
TLSH
T1F635F16577D101F4D477D138899646A3F2B2B4250364EFEF0AA88B561F23AE40B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 f92a7602675c286018e91bf3b1038992debc75af257f9cb045a3235d2bca7d4b
MD5 919f966c990a3a8a2feca020d5312fb7
SHA1 aaf595d09d7dc8a31080e59a6deb9afc26c3dd0f
SHA512 457a3fea646136ba55d757f6ebfd5db10ded6f10df15303ab76b81d4ad12e7684ed9a42ad0b8662255ffdb2b9d84c3b418b9375832c334967de50551606b7e3f
SSDEEP 12288:SHvUrBFrEjwaQ7TJd8wbba1++Eu9AK9wjNwMqKynwwdOBYD+m6Gy6dUIb3FflqsJ:SPUr+NQ7NOwXuApNbawaAOm74UIbXtJ
TLSH
T18E05F16F269D1CE9E676A17D85964349F372B4620711D6DF06D0823E0F63EE86C3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 ac98fc249537268ff28188003feb1fac3562b40a040c88cf504b3de0118e9486
MD5 918889ccf50b1a83da5fdb140f90a0e1
SHA1 7b28a3c5242b396ffdc63d7c76cf0cdcd5f796fe
SHA512 89da9ace6296adfb8d129f074119f082131035cfd4a8f61f71bf939ffe3cd1b4ae349208c7cb6c33479fbdac478028f56c29f5f16460f0bb6abe482c7791771d
SSDEEP 49152:9BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjWJXVDktJ:GG05lO43bDib
TLSH
T111D5CF6A62EC11F9D0BBD17CDAC6460BEBB23425033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 76afa1cad7e7b47dd1eeaadd0828a4af82e80d990dfda731cebc346684f3a948
MD5 12ddd16e528cb2a97c8ee3a9e97f97e6
SHA1 95786a3953d6a7228f07d7999238980f9a20e81c
SHA512 e103bfc7b4e1bb8c626356f8c351730c4cbe169ccb72478c9d3c60165078cc159cede3f2f61e6b7f569f9122b23b42b82287a6c44c8b1f4e02305035aa8c8e18
SSDEEP 24576:1Ma5POZ3dpbWVM50JicR2hG0lasx2+47eidnxNOwXuApNbawaAOm74UIbXtJ:+a5POZ3wJt2pasx2+mTJXVDktJ
TLSH
T11365BE5EA7EC01D5D57AD17DC583861AF5B1342253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 29beecd45d0fff114fad281de69dea0b7e6e2c04634cdb6eb4fb98ee989d1236
MD5 148025f2ae9e5d023825a4f040e7ef9e
SHA1 d65d202f7eea1aa5a899f00c226af5bea673f4b8
SHA512 c00d0cf5640e71df879beb200bca5d9e46340effc4b285eb4e0e5e2e45c759a50f4eccda8ec73bcb7448fe1d0de45c15f556bd259561137a84d7d6f0ff74e291
SSDEEP 24576:9NcwHdjbyQ4nLC18lb/EOjowL7FkoNOwXuApNbawaAOm74UIbXtJ:9Nc/zEOVHFhJXVDktJ
TLSH
T121858C1623E901E4E5BBE1BE897B9546FA71786513308ACF0291851F1E73BF41C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 cc356e138f6b74a61063cf6c2f53cf6d6c7d8684ce29823b43e7b46a3ce09580
MD5 7d39614459ad7f8296383922d1c30653
SHA1 98f668b61a2c8ef51ec956160514aba6cf9518b4
SHA512 6816645fdd7c50dc336983768599c459ae6d14555a9c721fffb6df4132027a5c8bdce332e8ccb1d66774f2a44d1973cebc51f50cedffd3782392910df39920b2
SSDEEP 24576:4JnJPbzB4SXNOwXuApNbawaAOm74UIbXtJ:4JnJv6SXJXVDktJ
TLSH
T15F15E03DD29810E8D4B7C2B4816A179AFB31386C2F2569C719B4D5353F12FE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 5aa44ddc6a9f8dbc6ef60930a12322667f84554bb40e9b25f7146015ba3ee376
MD5 9e52d5d55a766cc5850a59b4fbef2733
SHA1 7ddbb57b2358a2d1942be39a1d05a5b514c9ba2a
SHA512 1440e755c0f431c2f7611563684db1b8e7fcfbfa732bc72ce0eb1c93ea57a010b62cd31ffeab2623142d0d346bd4ffe29e82d04d036809c0744c31954513d2a3
SSDEEP 24576:ACLHGL0MoeVtFumTijCmlKQWDkcNOwXuApNbawaAOm74UIbXtJ:ACLHGeeV5ijCmlDWDkcJXVDktJ
TLSH
T168A56C05A7EB5184E8F3CAF5CA2694169A327C549B34F7EF4E80C96A1E32FD0D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 e3e4abe76dab984687f227a76c989476779bc837c3fe908e5073356c1cc85074
MD5 64e4ea243d6e8a7cc80d91f2d06a47a8
SHA1 ae6ee6a717edda0c91139a63a15b6de19e32ffe5
SHA512 4880186074a449e65043d046d7220308c31ed732e1e85062ea4b16aa1ad99d056b0906e665744694993687968afb5d10d1f1a0cd8f51a38560b78deb91f84f72
SSDEEP 12288:G1Hek6j5ZI7sTJd8wbba1++Eu9AK9wjNwMqKynwwdOBYD+m6Gy6dUIb3FflqsJ:s6DIANOwXuApNbawaAOm74UIbXtJ
TLSH
T142F4015D236A11F9D07B903EC6970182E2B2B0B087255AEF0A94C67E4FA3ED87D3DD51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 47b9fdeb0d051464be7153272e505e57fc603d38bbd2bea3823cd976d5021ca1
MD5 c774adff04bfc88f4b78e35184603ca2
SHA1 e8e1c67311508aa0b9aec720b10e62e7d3cfe26c
SHA512 303316beaaad4edd9990bda7696bbe8a92e8c5b3b0626d859667fe0e53bf7034fac04da81a71a39c50ff4425f0e4c8aa4aa9b127f19b47de229b7a3a930e2d49
SSDEEP 12288:4G6ky9TJd8wbba1++Eu9AK9wjNwMqKynwwdOBYD+m6Gy6dUIb3FflqsJ:Zty9NOwXuApNbawaAOm74UIbXtJ
TLSH
T1E8F41241674465D9D83B06788ABB42D2A331BC205B2497EF6990DB3F0F77BE41CB9B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 61abb18f9d2ccde2c38e092239ffad62bf77d9aa55b2c5e6be7d24a4cefc7825
MD5 0e5d167516df2107e186414d9862f2d5
SHA1 d4450901b683115bb220c0d25f9cc82899561e90
SHA512 f3a72ea1a541bb2b46cbcbc12a6cbcc40fb103e0b6b55e865a6e588314e8645aba75f7fe8d88b59ee76240e498bc6e797a77d705f29387bff0e4a9d35c3216d7
SSDEEP 12288:serTJd8wbba1++Eu9AK9wjNwMqKynwwdOBYD+m6Gy6dUIb3FflqsJ:NrNOwXuApNbawaAOm74UIbXtJ
TLSH
T13CD423D96B067959CC2709B581BE12C3A371A1641B189AFB6DC0CB3A0FA77E40CFEC51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 05fa5a6ec2d9280048c5a38ca19e45f050833243f85a71c7b32b10699d4a62ca
MD5 89d76f6ca998fdaefb8034cbf058ddbc
SHA1 2367b14a9fa3d9471a33fe5525f67173cd76f6bf
SHA512 17b0e11c646088ade9110ff11c0ad86fc8975f1989d55a5234c49b15530385a5853625ca3b40ac1d9a3042f9512bbed1124b71742e38d4a632de6f20d75b8e39
SSDEEP 24576:+LgOVoTfaidZVGNOwXuApNbawaAOm74UIbXtJ:sgTTrZ4JXVDktJ
TLSH
T1E4559D1DA7EA09CAE2B2D275D8721493D633B4315771C6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 e3ef59d032c1e48aaa884ee98e4160ad152f921f2b6f8291d0cd347572c95d86
MD5 c511913ef1301709bd7b779b85a9a9d1
SHA1 6635abd7d1a46e413156fe3d1e724cb3400c482e
SHA512 58e26a563440f75f205313d7b856dbdd5ad38472da6e23681aca13eeef491cb197e21cb451e2d80e7aa028af768415000ce613cc5668b08f52db2c198ce019d8
SSDEEP 12288:BpJcm8CNLTJd8wbba1++Eu9AK9wjNwMqKynwwdOBYD+m6Gy6dUIb3FflqsJ:BrcmRLNOwXuApNbawaAOm74UIbXtJ
TLSH
T1CE05F05EB76E00A6D077817CC9964286F2B3B070271167EF06A0C73E4E67AE93D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 3835ccb1c7184f2ace64720f371c8252c30b10fba6be39bf5c966fb4e07ebbb6
MD5 98501e185e43318f9f32cd8d42b438cf
SHA1 30de5c320a86affbed429557b463e3f016bf8952
SHA512 94d506739d6a2233ebc6d7d2437905667f535f18fc3ff6cd91dc6abdf7fded53798ce3b0b82206f04279d9a704d23566eebcf3bc6ab3557ac86c8066aa78b1f1
SSDEEP 49152:bDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3hLJXVDktJ:Q3Upow8sBIib
TLSH
T1E6A58C3DA2E810A8C9AAC379C54213A6EA71742E3F3015DB0174C578BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/768-224-0x00007FF7AFE60000-0x00007FF7B0330000-memory.dmp

Download

memory/768-198-0x00007FF7AFE60000-0x00007FF7B0330000-memory.dmp

Download

memory/768-194-0x0000023EC1FF0000-0x0000023EC2056000-memory.dmp

Download

memory/768-193-0x0000023EC1FF0000-0x0000023EC2056000-memory.dmp

Download

memory/1008-219-0x0000020031400000-0x0000020031466000-memory.dmp

Download

memory/1008-245-0x00007FF751BC0000-0x00007FF751CEE000-memory.dmp

Download

memory/1008-218-0x0000020031400000-0x0000020031466000-memory.dmp

Download

memory/1008-217-0x00007FF751BC0000-0x00007FF751CEE000-memory.dmp

Download

memory/1216-229-0x0000023D3A870000-0x0000023D3A8D6000-memory.dmp

Download

memory/1216-227-0x00007FF6F0E00000-0x00007FF6F113E000-memory.dmp

Download

memory/1216-228-0x0000023D3A870000-0x0000023D3A8D6000-memory.dmp

Download

memory/1216-248-0x00007FF6F0E00000-0x00007FF6F113E000-memory.dmp

Download

memory/1872-153-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1872-104-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1872-105-0x0000000000960000-0x00000000009C9000-memory.dmp

Download

memory/1872-110-0x0000000000960000-0x00000000009C9000-memory.dmp

Download

memory/2360-44-0x00000224199C0000-0x0000022419AF3000-memory.dmp

Download

memory/2360-45-0x0000022419BD0000-0x0000022419C36000-memory.dmp

Download

memory/2360-47-0x0000022419BD0000-0x0000022419C36000-memory.dmp

Download

memory/2996-0-0x0000000000400000-0x00000000004A4000-memory.dmp

Download

memory/2996-6-0x0000000002490000-0x00000000024F9000-memory.dmp

Download

memory/2996-37-0x0000000000400000-0x00000000004A4000-memory.dmp

Download

memory/2996-1-0x0000000002490000-0x00000000024F9000-memory.dmp

Download

memory/3132-250-0x000001DCDF620000-0x000001DCDF686000-memory.dmp

Download

memory/3132-251-0x00007FF7EC530000-0x00007FF7ECC73000-memory.dmp

Download

memory/3132-118-0x000001DCDF620000-0x000001DCDF686000-memory.dmp

Download

memory/3132-172-0x00007FF7EC530000-0x00007FF7ECC73000-memory.dmp

Download

memory/3132-117-0x000001DCDF620000-0x000001DCDF686000-memory.dmp

Download

memory/3132-116-0x00007FF7EC530000-0x00007FF7ECC73000-memory.dmp

Download

memory/3156-69-0x000001E533330000-0x000001E533396000-memory.dmp

Download

memory/3156-62-0x00007FF7C3520000-0x00007FF7C3688000-memory.dmp

Download

memory/3156-64-0x000001E533330000-0x000001E533396000-memory.dmp

Download

memory/3156-71-0x00007FF7C3520000-0x00007FF7C3688000-memory.dmp

Download

memory/3156-63-0x000001E533330000-0x000001E533396000-memory.dmp

Download

memory/3308-17-0x0000022927F40000-0x0000022927FA6000-memory.dmp

Download

memory/3308-16-0x0000022927F40000-0x0000022927FA6000-memory.dmp

Download

memory/3308-15-0x0000022927F40000-0x0000022927FA6000-memory.dmp

Download

memory/3308-50-0x00007FF7CED80000-0x00007FF7CEEA2000-memory.dmp

Download

memory/3308-14-0x00007FF7CED80000-0x00007FF7CEEA2000-memory.dmp

Download

memory/3632-147-0x0000025C66760000-0x0000025C667C6000-memory.dmp

Download

memory/3632-199-0x00007FF639570000-0x00007FF639623000-memory.dmp

Download

memory/3632-145-0x00007FF639570000-0x00007FF639623000-memory.dmp

Download

memory/3632-146-0x0000025C66760000-0x0000025C667C6000-memory.dmp

Download

memory/4188-216-0x00007FF7F5BC0000-0x00007FF7F5E4A000-memory.dmp

Download

memory/4188-186-0x000001F34D850000-0x000001F34D8B6000-memory.dmp

Download

memory/4188-184-0x000001F34D850000-0x000001F34D8B6000-memory.dmp

Download

memory/4188-185-0x00007FF7F5BC0000-0x00007FF7F5E4A000-memory.dmp

Download

memory/4700-87-0x000002E701020000-0x000002E701086000-memory.dmp

Download

memory/4700-88-0x000002E701020000-0x000002E701086000-memory.dmp

Download

memory/4700-86-0x000002E700D80000-0x000002E700EB3000-memory.dmp

Download

memory/4780-25-0x00007FF7742B0000-0x00007FF774378000-memory.dmp

Download

memory/4780-61-0x00007FF7742B0000-0x00007FF774378000-memory.dmp

Download

memory/4780-28-0x000001D094C40000-0x000001D094CA6000-memory.dmp

Download

memory/4780-27-0x000001D094C40000-0x000001D094CA6000-memory.dmp

Download

memory/4780-26-0x000001D094C40000-0x000001D094CA6000-memory.dmp

Download

memory/5000-180-0x00007FF6CF1F0000-0x00007FF6CF510000-memory.dmp

Download

memory/5000-171-0x0000015C252A0000-0x0000015C25306000-memory.dmp

Download

memory/5000-174-0x00007FF6CF1F0000-0x00007FF6CF510000-memory.dmp

Download

memory/5000-173-0x0000015C252A0000-0x0000015C25306000-memory.dmp

Download

memory/5000-178-0x0000015C252A0000-0x0000015C25306000-memory.dmp

Download

memory/5056-211-0x00007FF6F5010000-0x00007FF6F5426000-memory.dmp

Download

memory/5056-209-0x000001B6D6210000-0x000001B6D6276000-memory.dmp

Download

memory/5056-134-0x00007FF6F5010000-0x00007FF6F5426000-memory.dmp

Download

memory/5056-135-0x000001B6D6210000-0x000001B6D6276000-memory.dmp

Download

memory/5056-136-0x000001B6D6210000-0x000001B6D6276000-memory.dmp

Download

memory/5056-192-0x00007FF6F5010000-0x00007FF6F5426000-memory.dmp

Download

memory/5508-55-0x0000025AFB690000-0x0000025AFB6F6000-memory.dmp

Download

memory/5508-53-0x0000025AFB430000-0x0000025AFB563000-memory.dmp

Download

memory/5508-54-0x0000025AFB690000-0x0000025AFB6F6000-memory.dmp

Download

memory/5656-156-0x00000218F42B0000-0x00000218F4316000-memory.dmp

Download

memory/5656-202-0x00007FF796730000-0x00007FF7969D3000-memory.dmp

Download

memory/5656-155-0x00007FF796730000-0x00007FF7969D3000-memory.dmp

Download

memory/5656-157-0x00000218F42B0000-0x00000218F4316000-memory.dmp

Download

memory/5732-124-0x00007FF66D650000-0x00007FF66D6FD000-memory.dmp

Download

memory/5732-125-0x0000024C1CC80000-0x0000024C1CCE6000-memory.dmp

Download

memory/5732-126-0x0000024C1CC80000-0x0000024C1CCE6000-memory.dmp

Download

memory/5732-181-0x00007FF66D650000-0x00007FF66D6FD000-memory.dmp

Download

memory/5764-203-0x00000290BC650000-0x00000290BC6B6000-memory.dmp

Download

memory/5764-204-0x00000290BC650000-0x00000290BC6B6000-memory.dmp

Download

memory/5764-208-0x00007FF767390000-0x00007FF767896000-memory.dmp

Download

memory/5764-239-0x00007FF767390000-0x00007FF767896000-memory.dmp

Download

memory/5856-38-0x000001C852170000-0x000001C8521D6000-memory.dmp

Download

memory/5856-92-0x00007FF7742B0000-0x00007FF774378000-memory.dmp

Download

memory/5856-34-0x00007FF7742B0000-0x00007FF774378000-memory.dmp

Download

memory/5856-35-0x000001C852170000-0x000001C8521D6000-memory.dmp

Download

memory/5924-165-0x0000017A37280000-0x0000017A372E6000-memory.dmp

Download

memory/5924-164-0x0000017A37280000-0x0000017A372E6000-memory.dmp

Download

memory/5924-163-0x00007FF614270000-0x00007FF614404000-memory.dmp

Download

memory/5924-212-0x00007FF614270000-0x00007FF614404000-memory.dmp

Download

memory/5988-76-0x0000025EC8D50000-0x0000025EC8DB6000-memory.dmp

Download

memory/5988-75-0x0000025EC8D50000-0x0000025EC8DB6000-memory.dmp

Download

memory/5988-74-0x00007FF6E89B0000-0x00007FF6E8AC9000-memory.dmp

Download

memory/5988-133-0x00007FF6E89B0000-0x00007FF6E8AC9000-memory.dmp

Download

memory/6064-96-0x00007FF7F1AA0000-0x00007FF7F1BE9000-memory.dmp

Download

memory/6064-98-0x000001593B7D0000-0x000001593B836000-memory.dmp

Download

memory/6064-144-0x00007FF7F1AA0000-0x00007FF7F1BE9000-memory.dmp

Download

memory/6064-97-0x000001593B7D0000-0x000001593B836000-memory.dmp

Download