3779c33383c3bb3818f3f57cf9f0a07c6beb13874f54b9d787ca8e0dc5a6209b

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 13:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
Size 616KB
Sample260804-p91zlsbc79
SHA256 3779c33383c3bb3818f3f57cf9f0a07c6beb13874f54b9d787ca8e0dc5a6209b
MD5 117b5a317db1183d9b446a601c519c09
SHA1 7a482f9fc07dc300124c64ffcbdbc9b7b414ff8d
SHA512 03cc3008e7d2bffa82a1f9009b251b21a3f1668edba46a1928e4a90ff711446de9bde29297cd54ba93ef0d9258171e9a0bc6512cf03d60b576276720059733a6
SSDEEP 12288:37MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:rxIFIyGibdPgHB/eYvu5s2aC+
TLSH
T1FAD42341C5BD9D28C214593199F72B32D0C2F4986C53EE9D0B92DE7D11E2907AC2BBDE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4432	alg.exe
4344	GameInputSvc.exe
6072	GameInputSvc.exe
5168	elevation_service.exe
5692	elevation_service.exe
260	maintenanceservice.exe
3996	msdtc.exe
3952	OSE.EXE
3392	PerceptionSimulationService.exe
5256	perfhost.exe
4944	ReFsDedupSvc.exe
2568	locator.exe
5696	SensorDataService.exe
2860	snmptrap.exe
4700	ssh-agent.exe
5632	TieringEngineService.exe
2484	AgentService.exe
4884	vds.exe
4540	vssvc.exe
4728	wbengine.exe
5388	WmiApSrv.exe
3448	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6c4ed48783806d8d.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaw.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000bb479ad51124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000057ea34d41124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c886f7d41124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b472cad31124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b165b9d41124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004cc749d61124dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
6072	GameInputSvc.exe
6072	GameInputSvc.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
Token: SeTcbPrivilege	4344	GameInputSvc.exe
Token: SeBackupPrivilege	4944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4944	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4944	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4944	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4944	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5632	TieringEngineService.exe
Token: SeManageVolumePrivilege	5632	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2484	AgentService.exe
Token: SeBackupPrivilege	4540	vssvc.exe
Token: SeRestorePrivilege	4540	vssvc.exe
Token: SeAuditPrivilege	4540	vssvc.exe
Token: SeBackupPrivilege	4728	wbengine.exe
Token: SeRestorePrivilege	4728	wbengine.exe
Token: SeSecurityPrivilege	4728	wbengine.exe
Token: 33	3448	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3448	SearchIndexer.exe
Token: SeDebugPrivilege	4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
Token: SeDebugPrivilege	4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
Token: SeDebugPrivilege	4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
Token: SeDebugPrivilege	4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
4248	2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 6072	4344	GameInputSvc.exe	92
PID 3448 wrote to memory of 256	3448	SearchIndexer.exe	114
PID 3448 wrote to memory of 3356	3448	SearchIndexer.exe	115
PID 3448 wrote to memory of 3720	3448	SearchIndexer.exe	116
PID 3448 wrote to memory of 4732	3448	SearchIndexer.exe	117

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_117b5a317db1183d9b446a601c519c09_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4248

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4432

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:6072

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5168

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5692

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:260

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3996

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3952

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3392

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5256

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4944

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2568

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5696

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2860

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4700

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5632

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2484

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4884

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4540

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4728

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5388

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:256
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3356
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2860 2864 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3720
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2948 2944 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2f0cb8349fd9b0c9dd396e76408b5ad1b116e6ee9a3f595989c264dd2e34c341
MD5 78865c81dadeeef552c156a501af9cd4
SHA1 cd5076a9811fce60732940da0364f41bf87c1b88
SHA512 7c4edc8a2394a2e1ca8a87eb51388df4afdcb8009791b98aed5b76da480a7339b484d8cc78e36399ab613158141cc9ead69367242ef911b831aadec9cf00e33c
SSDEEP 49152:gb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnzOI5Bh/e44s:K3q6gjBGOUBh2
TLSH
T12FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 2123452447b56b1abb831003600e7f874d6eec986f86a67d95a0c7b89954f2d3
MD5 cff8ca8e99d5f4efa724e4d0ec9e5cb9
SHA1 4c288c343fa49ce77d2d1f94546ae61f70a6df54
SHA512 49a56f1fbb178de903e3bd5a59dcad52aab6fee6bf861d8eface03e3a607545a74f9f404ae4990f33a0eeacbca903e451eee7fdb6bdb6d9366909637e3a98889
SSDEEP 24576:zXYipNczA7xIFIyGibdPgHB/eYvu5s2aC+:LNcMOI5Bh/e44s
TLSH
T1DB050228A3E408F9DD67813CCCB28511E673B8554760EB9F03E49A790F637895E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 9d59183b3876586f09380ac56f31ac6dbc842cc3d2bf773addb0aea7f48011da
MD5 8eb4b226f55ba7c9f0f60073cb6486e2
SHA1 1b2c3f2b61581fa1f1b74aef42c7ff3ad8a7a620
SHA512 da27f5d24766d93839da18348fab1e13c7b7c096670dad6e72b3c6e210fd7ca3ace226c32a6436483f747c18de275ef99be5e67c8aeb13337c1e6b2c122e0d1e
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+CR7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxn:uwuuOWYxIFIyGibdPgHB/eYvu5s2aC+
TLSH
T1D205F14676E81CF9E9674138C5978536F7F2B8012A21DB1F0760CA6B5F73212BD2EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 317b04191a7236ad4d605b6a8ef9a8b82ff0218b40d96806b6beef7227d636fa
MD5 9324b04b00a13908785fa5f8034d7e56
SHA1 70ecee0dfd3e4ff437496e1d8129239ac0945dfd
SHA512 735d7c6fa36d9a42c06fe6ad7f1edcdfb00baa56a6aeb7405e760d46e214073df9e4bff9e57cc6b83f562863729a5dd0cd1a371cb6e0da18d0d7b1507f4b0c80
SSDEEP 49152:Me+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl09OI5Bh/e44s:Vu6JmTxd2d09OUBh2
TLSH
T11ED59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 22453b349485175a98b1309b66d7a75ae4b2a59c03f2c0211cffaeefdcbfa7c0
MD5 b9941f2c468e78e85cc82fd6b6ed396e
SHA1 ee4aadcbae8f6d20c70a72b34e5eb4ab9246e15f
SHA512 075ff99e2fd83d17b4fd0086feaab73db89ac875d6de3cb67d84868de9fc53eb187071cfa15fe7cc84c084cfe8c14cc7d196bd2c5a562bf2f3f80c8d06a83c29
SSDEEP 12288:sZ7d77MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:81xIFIyGibdPgHB/eYvu5s2aC+
TLSH
T1B0D42342C3BDAD18C178153099F72731A082F8986E02E9DF5B515B7811E2983ED3ABCF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1c94845147b4f50454b163bec3266e22c24d9ce0c21318689fabf2d39026fd54
MD5 8a881af8e94a81a4d1655f078cfa6d71
SHA1 cd22bdde01325979199457e3f4b88e160394f063
SHA512 58afa65c1b5d80ea420b0aa054df30f6459cbd8a0f370ea29fd1d9fbf3b7e8c3aaa00a38dfaf02c09afe0b0f86a9229ada738641d8b9efd40e84daf8eada2eac
SSDEEP 24576:2gb6bmBIi49WNNFpg1rSvFv7bYXxIFIyGibdPgHB/eYvu5s2aC+:2gb4mBIBhGFCOI5Bh/e44s
TLSH
T169659E1E22EC02F5E0F9D2B89DA64417D6B278161732D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 5176dd3331b9a27478af8459e726c12642b830583af923a557b53bece7a755af
MD5 b3a08bcef61af9e1faeb983a9d365e2a
SHA1 3a4829f34e85cd8250919ace6814d9d875693130
SHA512 153ec891d6f0660039f3d8ea7af5d67780bd3077bed85ec64ee074e52bdf4b73497b4757fac8323260906f9baf2dc12725c6952ab86efbcf4365ffa345b19609
SSDEEP 12288:vxG27MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:ZGqxIFIyGibdPgHB/eYvu5s2aC+
TLSH
T12FE4235D51FD7498C139863598B21632F0E1B4902B11EAFF0AE0DA394BD19D3B93EEC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 107fb7538dec3234cd37ab8c62cd8fcad91de5e8b275dcbe78bb604a5ec14ae1
MD5 36ff59bba159ee678b78d48b887e87dc
SHA1 61a63cd3ad891a6f36f2165d082d255ce28996d5
SHA512 40342646f922c29d0095226d1466e7802a8cd6d4d003e5502afe924ae64fd72526b02a7505667df68cc87e370e0c70f467b28166146aadf9cb0d8b1ce46f8987
SSDEEP 12288:7G7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:7axIFIyGibdPgHB/eYvu5s2aC+
TLSH
T177D4238582BDAD58C254153199F32B31E0C1F4986F43EEDF06919A3802D69C3BD3BBDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 05bd154b62fbe6d334a1d44295d37d53ecfb9e5b76bb07c4fba57dd02044a2d5
MD5 bad92c23139e6a0882a38a0b88caf935
SHA1 af1a66ff60c7e56d2a753e91d34c2aee86fb8848
SHA512 7c8158312adf251ed9167dddb824ec08240c0c3ecbcf6b086eb6141a83338dcd405b8e94a1f12fe2d9777896206ac76c2560d0c5a9c3d20749277881b42f6b2f
SSDEEP 24576:IDh808eeJqH1tzria7/mSxIFIyGibdPgHB/eYvu5s2aC+:mG7e6qVUa7/DOI5Bh/e44s
TLSH
T1F635F165A6E501F0D47BD13889920663F6B2F4251360EFDF07A88B651F23AD64B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 f4ce4969d1a10420467bbd6effc7b54738c9ba9b878cc1f7563d0f3fd6752c82
MD5 860e614cfd9a0e021169823b988c302b
SHA1 471170600779ef16a3347daf83771754dc426c9c
SHA512 57c2f7958ad2eb4d80ab4cb170c58234f9fb63c8f738914a0993b399f20bb1fe1ff94c1cf81a2226ce174f5786d5f969b736784c25ef38129eed7b0b1ac844ec
SSDEEP 24576:yPUr+NQDxIFIyGibdPgHB/eYvu5s2aC+:yJQDOI5Bh/e44s
TLSH
T10A05E11F62ED1CE4E676A13D89924719E272B4621712D6CF02E0817E0F63ED9BD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 e557ed9f6ce5a0aec69f0baf3d441355b615f581cd1b033da3eddf607451e959
MD5 be5b9ff58f8dc97bbca9d02e26ebda7d
SHA1 9b101759f452c0111d10aba164653a3153e9fa6b
SHA512 918ee05d02cea0dcf13edb3bc60bc1f374724212861d3510235e432636f5de5c14a2c460f0fc90acd628d936a96c651040bab809c81be1bf6655e5744a31fbcb
SSDEEP 49152:GBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjoOI5Bh/e44s:pG05lO43b7OUBh2
TLSH
T15AD5CF6A62EC11F8D1BBD17CD9C6460BEBB23415033556CF02A486A91F27FF4A97E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 632e3cf6301f31db47e1b71344043ae6908604bbb23c3637d734ffc35d0d514e
MD5 5548294ff3d4a333653a8188fdca59ba
SHA1 0384fbe7d622384e594b9bffcde401638839ae86
SHA512 cbb66325f06a8f23bfbb45d7533f2859e19e073552baed162bc4018e9c01339ea71129f8086ffa7fa4d064e458dcd421a3c34d9df07bdb281e926bc1b8745d90
SSDEEP 24576:lba5POZ3dpbWVM50JicR2hG0lasx2+47eidnIxIFIyGibdPgHB/eYvu5s2aC+:Ba5POZ3wJt2pasx2+mCOI5Bh/e44s
TLSH
T1C265BE5EA6FC01D5D1B9D17DC5834A1AE5B1742153329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bd5a278488dd8f2e626e42ca6f5903ff662df1391a130ee2b9e5bf14faa6ada5
MD5 d7572ce2f00385fe996a97e74eb9c4d7
SHA1 3413b4f341d2edec124f80feb9fd20605c065b10
SHA512 700479dfaa668868d897ee0027f12aa242e0f2d909f55ca898cca289022d985ba35ff22ef5d3d718d485a1acaa718c2e58010f8bf5605a8735dc82b281d8e949
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7FkUxIFIyGibdPgHB/eYvu5s2aC+:VNc/zEOVHF5OI5Bh/e44s
TLSH
T15C858C1623E901E4E1BBE1BE89779546FAB1786517308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 76fd752aab6bfd8905c9037df5675b68531aace433194a2c5734918fe7d87515
MD5 f24f86e7f09711c19727c6a759e82429
SHA1 d15769f5d12222675d6a026d254749538be0a987
SHA512 2854bedebacdde27e12e4af8ad18b06cb91a2907e3996d09530cd54ffe2db0c0c4305d3c5d92ec70008c96e58d097bd1405313ac1f5cf013cc66899b00a0394c
SSDEEP 24576:lJnJPbzB4SdxIFIyGibdPgHB/eYvu5s2aC+:lJnJv6SdOI5Bh/e44s
TLSH
T1CE15E03DD2A810E8D4B7C274815A1B6AFE71387C2F2269CB19B4D5343F52ED0A939F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c1361be37113d5a76ae15a6bc0861d2a59d956cbad15d2c2d3e8d1f36b021e75
MD5 62efb295a318911bace20e31481d1ee7
SHA1 9b7e3a007b87c917c2d083e87a5e0fce960e0c80
SHA512 0075d9815b918cabc6af9ad72d88dad5678e439a0d143b651728e5985f1a483dec5befe813ee47e4a4e3c10aa6e28406003345045f0f2c40baf4043dbe8b722b
SSDEEP 24576:VCLHGL0MoeVtFumTijCmlKQWDkcxIFIyGibdPgHB/eYvu5s2aC+:VCLHGeeV5ijCmlDWDkcOI5Bh/e44s
TLSH
T1DCA56C05E7EB5184E8F3CAF5CA2294169A327C549B34F7EF4A80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 f8c89b500fcddeddfa12ec8a0d4682dfab1f0b4fab4dc45f2a1fce53a718b0cd
MD5 f7a2494ec287219a9e054e7102e20c15
SHA1 da25766979f1bf1de81aa3708bc203778ab6bc37
SHA512 79ca62580dae9f0b8cb6859f928006025bc709cc836e6b7928d6e362aad6e8b7fe4854a50d545b0a50ffe532d5cc9c1146c4df7ef1c175309b96d6520d0a3323
SSDEEP 12288:L1HskHj5ZI7Z7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:THDI5xIFIyGibdPgHB/eYvu5s2aC+
TLSH
T11305F15D63BA10B9C16B903DC6930612E1B2F0B097529ADF0794C97D4EE3EC9B93DE81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 765330c92d2e6d4a6fb68d5f17eb0b481bb45c5fa2de2b6615b020f2dba56d66
MD5 9887ecc89f6e3fc34cdd1fe75fab593d
SHA1 3dccd64d3c2b9de020acf1ff390ad0b4c802265a
SHA512 004ddd137988217e81c8af171dcdc78c241114602621aa2202f1c913c8eeb17e3c0a42c13e0c9326ba2756d632cc0447a910ada22cba09cd29a35947f11ac27c
SSDEEP 12288:aG6kyC7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:zty2xIFIyGibdPgHB/eYvu5s2aC+
TLSH
T1E2F4124593A86494D6B90634DAB302719971FC206F12D7DF0690EB3E1FB2BC2BC35B96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 592f24c5689664957cbf3791034c8f256ffb3d917a0a6ae99ccfcaa9b62207f2
MD5 a92497a8cdae57d61ef532ffd006beb1
SHA1 5092a6bab396ae0cab33d4964f79acd1efe977d4
SHA512 3e9b3e5802d59f13edce2d600500c1825c6af13c4f648dbd2ff7a18a7213bffcef126105a5a2f06e9bfc04f8fdbeec843c0ce74c477a7e564d80ab52410d087b
SSDEEP 12288:sCg7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:90xIFIyGibdPgHB/eYvu5s2aC+
TLSH
T188D4238992BD7958C554153495F32B32D091F4A42F13EAEF0AD09E3806D69C3BD3AFCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 027962f46d68f4f2c76eb2a74e906db196f6e1fdc5fe1d33b5484b6b8f0741ef
MD5 e03d2aff8d6356f36a7dce2b3b0cb1b1
SHA1 89d68a4c879fa77309a59394d3bf447a46925cf5
SHA512 4d37b20e4d3b60f7cb3c9266da966bd7114b09467fcaced353d2dce6810bc1a09256a045bc2e3ecf240b9fcb3c2f23c92c3013bc93d7588e7fe47f3e05a6de51
SSDEEP 24576:utgTPoTfaidZ7xIFIyGibdPgHB/eYvu5s2aC+:Sg0TrZ7OI5Bh/e44s
TLSH
T178558C1DA3EA09CAE2B2D635D8721493D633B4315772D6DF2448C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 98ca6d8cde0d6535b30bf16c9f95d5ffe8b6bb8405388659c8376bd2bad69b6d
MD5 8033fc4888ed2fe86b481460de960147
SHA1 b43097b320753414be89284ce3081419ec653d84
SHA512 e19279911faddd2003f71420ea59c9840fd80e5ee258d6f86a91211da9302e04c29c0e2b3b789b78b45aa65be328db228479dd9acc90ba7c01e5a8f5aa8e4946
SSDEEP 12288:ApJcm8CNO7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:ArcmRyxIFIyGibdPgHB/eYvu5s2aC+
TLSH
T1DA05F14EB2BE00A5D1B7913CC9920616F2B3B0702712A7DF02A1C77D4EA79DA7D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 dfd1072ca9bb125a2203b40f6ee2c11f926c89fe8e5d93668dd5fdd7e363bf46
MD5 1579fd5b301748d7a33f1cc0efcd9b8e
SHA1 79beff055af5d50775fd2189b857aa6837dc7ffd
SHA512 a874ea6c1c3cae4553df92df9b334f9fa3b993e8457b01175aaa2f7a5da16ff1bd39044463f99fda837f89fa4551557547ae09125ebd0e85ccf9658a11c8aa76
SSDEEP 49152:bDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3tOI5Bh/e44s:Q3Upow8sBWOUBh2
TLSH
T17AA58C3DA2E800A8C9AAC379C54213A6EA71742D3F3055DB0174C578BF1BDF29A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-72-0x00007FF7E86C0000-0x00007FF7E8828000-memory.dmp

Download

memory/260-65-0x00007FF7E86C0000-0x00007FF7E8828000-memory.dmp

Download

memory/260-64-0x000001EBEB150000-0x000001EBEB1B6000-memory.dmp

Download

memory/260-70-0x000001EBEB150000-0x000001EBEB1B6000-memory.dmp

Download

memory/260-62-0x000001EBEB150000-0x000001EBEB1B6000-memory.dmp

Download

memory/2484-182-0x00007FF76E7C0000-0x00007FF76EAE1000-memory.dmp

Download

memory/2484-180-0x000001B721030000-0x000001B721096000-memory.dmp

Download

memory/2484-178-0x000001B721030000-0x000001B721096000-memory.dmp

Download

memory/2484-175-0x000001B721030000-0x000001B721096000-memory.dmp

Download

memory/2484-174-0x00007FF76E7C0000-0x00007FF76EAE1000-memory.dmp

Download

memory/2568-127-0x000002C209230000-0x000002C209296000-memory.dmp

Download

memory/2568-126-0x000002C209230000-0x000002C209296000-memory.dmp

Download

memory/2568-171-0x00007FF76F880000-0x00007FF76F92E000-memory.dmp

Download

memory/2568-125-0x00007FF76F880000-0x00007FF76F92E000-memory.dmp

Download

memory/2860-146-0x00007FF7E8110000-0x00007FF7E81C4000-memory.dmp

Download

memory/2860-192-0x00007FF7E8110000-0x00007FF7E81C4000-memory.dmp

Download

memory/2860-148-0x000002653C1F0000-0x000002653C256000-memory.dmp

Download

memory/2860-147-0x000002653C1F0000-0x000002653C256000-memory.dmp

Download

memory/3392-96-0x00007FF6DD6E0000-0x00007FF6DD82A000-memory.dmp

Download

memory/3392-145-0x00007FF6DD6E0000-0x00007FF6DD82A000-memory.dmp

Download

memory/3392-98-0x000001FFBB3F0000-0x000001FFBB456000-memory.dmp

Download

memory/3392-99-0x000001FFBB3F0000-0x000001FFBB456000-memory.dmp

Download

memory/3448-227-0x00000195123C0000-0x0000019512426000-memory.dmp

Download

memory/3448-229-0x00000195123C0000-0x0000019512426000-memory.dmp

Download

memory/3448-228-0x00007FF77A450000-0x00007FF77A78F000-memory.dmp

Download

memory/3448-250-0x00007FF77A450000-0x00007FF77A78F000-memory.dmp

Download

memory/3952-89-0x00000207BE2E0000-0x00000207BE346000-memory.dmp

Download

memory/3952-87-0x00000207BE080000-0x00000207BE1B3000-memory.dmp

Download

memory/3952-88-0x00000207BE2E0000-0x00000207BE346000-memory.dmp

Download

memory/3996-134-0x00007FF733280000-0x00007FF73339A000-memory.dmp

Download

memory/3996-77-0x0000027E62130000-0x0000027E62196000-memory.dmp

Download

memory/3996-75-0x00007FF733280000-0x00007FF73339A000-memory.dmp

Download

memory/3996-76-0x0000027E62130000-0x0000027E62196000-memory.dmp

Download

memory/4248-1-0x0000000002460000-0x00000000024C9000-memory.dmp

Download

memory/4248-0-0x0000000000400000-0x00000000004A5000-memory.dmp

Download

memory/4248-7-0x0000000002460000-0x00000000024C9000-memory.dmp

Download

memory/4248-6-0x0000000002460000-0x00000000024C9000-memory.dmp

Download

memory/4248-37-0x0000000000400000-0x00000000004A5000-memory.dmp

Download

memory/4344-26-0x00007FF7A2FB0000-0x00007FF7A3079000-memory.dmp

Download

memory/4344-63-0x00007FF7A2FB0000-0x00007FF7A3079000-memory.dmp

Download

memory/4344-27-0x000001F885950000-0x000001F8859B6000-memory.dmp

Download

memory/4344-29-0x000001F885950000-0x000001F8859B6000-memory.dmp

Download

memory/4432-16-0x000001BA301A0000-0x000001BA30206000-memory.dmp

Download

memory/4432-17-0x000001BA301A0000-0x000001BA30206000-memory.dmp

Download

memory/4432-51-0x00007FF768440000-0x00007FF768563000-memory.dmp

Download

memory/4432-15-0x00007FF768440000-0x00007FF768563000-memory.dmp

Download

memory/4432-18-0x000001BA301A0000-0x000001BA30206000-memory.dmp

Download

memory/4540-243-0x00007FF6E5EB0000-0x00007FF6E6381000-memory.dmp

Download

memory/4540-197-0x00007FF6E5EB0000-0x00007FF6E6381000-memory.dmp

Download

memory/4540-198-0x00000265BFB90000-0x00000265BFBF6000-memory.dmp

Download

memory/4540-196-0x00000265BFB90000-0x00000265BFBF6000-memory.dmp

Download

memory/4700-156-0x00007FF7D2D20000-0x00007FF7D2FC3000-memory.dmp

Download

memory/4700-157-0x000001256EB90000-0x000001256EBF6000-memory.dmp

Download

memory/4700-158-0x000001256EB90000-0x000001256EBF6000-memory.dmp

Download

memory/4700-195-0x00007FF7D2D20000-0x00007FF7D2FC3000-memory.dmp

Download

memory/4728-246-0x00007FF64EF90000-0x00007FF64F497000-memory.dmp

Download

memory/4728-209-0x00007FF64EF90000-0x00007FF64F497000-memory.dmp

Download

memory/4728-210-0x00000202185E0000-0x0000020218646000-memory.dmp

Download

memory/4728-208-0x00000202185E0000-0x0000020218646000-memory.dmp

Download

memory/4884-186-0x00007FF7052C0000-0x00007FF70554B000-memory.dmp

Download

memory/4884-187-0x00000191A70D0000-0x00000191A7136000-memory.dmp

Download

memory/4884-188-0x00000191A70D0000-0x00000191A7136000-memory.dmp

Download

memory/4884-224-0x00007FF7052C0000-0x00007FF70554B000-memory.dmp

Download

memory/4944-117-0x000002527F730000-0x000002527F796000-memory.dmp

Download

memory/4944-253-0x00007FF61B050000-0x00007FF61B794000-memory.dmp

Download

memory/4944-251-0x000002527F730000-0x000002527F796000-memory.dmp

Download

memory/4944-165-0x00007FF61B050000-0x00007FF61B794000-memory.dmp

Download

memory/4944-118-0x00007FF61B050000-0x00007FF61B794000-memory.dmp

Download

memory/4944-119-0x000002527F730000-0x000002527F796000-memory.dmp

Download

memory/5168-45-0x000001B7C0D70000-0x000001B7C0EA3000-memory.dmp

Download

memory/5168-47-0x000001B7C0FF0000-0x000001B7C1056000-memory.dmp

Download

memory/5168-46-0x000001B7C0FF0000-0x000001B7C1056000-memory.dmp

Download

memory/5256-106-0x00000000008F0000-0x0000000000959000-memory.dmp

Download

memory/5256-152-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5256-105-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5256-111-0x00000000008F0000-0x0000000000959000-memory.dmp

Download

memory/5388-249-0x00007FF6D8F60000-0x00007FF6D908F000-memory.dmp

Download

memory/5388-219-0x00000212B8C20000-0x00000212B8C86000-memory.dmp

Download

memory/5388-218-0x00000212B8C20000-0x00000212B8C86000-memory.dmp

Download

memory/5388-217-0x00007FF6D8F60000-0x00007FF6D908F000-memory.dmp

Download

memory/5632-166-0x000002344E4B0000-0x000002344E516000-memory.dmp

Download

memory/5632-170-0x00007FF6F8580000-0x00007FF6F8715000-memory.dmp

Download

memory/5632-205-0x00007FF6F8580000-0x00007FF6F8715000-memory.dmp

Download

memory/5632-164-0x000002344E4B0000-0x000002344E516000-memory.dmp

Download

memory/5692-55-0x0000026EDAAC0000-0x0000026EDAB26000-memory.dmp

Download

memory/5692-56-0x0000026EDAAC0000-0x0000026EDAB26000-memory.dmp

Download

memory/5692-54-0x0000026EDA860000-0x0000026EDA993000-memory.dmp

Download

memory/5696-183-0x00007FF6CD860000-0x00007FF6CDC77000-memory.dmp

Download

memory/5696-136-0x00007FF6CD860000-0x00007FF6CDC77000-memory.dmp

Download

memory/5696-204-0x00007FF6CD860000-0x00007FF6CDC77000-memory.dmp

Download

memory/5696-202-0x000001C3568E0000-0x000001C356946000-memory.dmp

Download

memory/5696-137-0x000001C3568E0000-0x000001C356946000-memory.dmp

Download

memory/5696-135-0x000001C3568E0000-0x000001C356946000-memory.dmp

Download

memory/6072-36-0x000001F1E8820000-0x000001F1E8886000-memory.dmp

Download

memory/6072-93-0x00007FF7A2FB0000-0x00007FF7A3079000-memory.dmp

Download

memory/6072-35-0x00007FF7A2FB0000-0x00007FF7A3079000-memory.dmp

Download

memory/6072-38-0x000001F1E8820000-0x000001F1E8886000-memory.dmp

Download

memory/6072-39-0x000001F1E8820000-0x000001F1E8886000-memory.dmp

Download