Analysis
- max time kernel
144s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/08/2026, 03:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe
- Size 616KB
- Sample260823-dysnbasdkh
- SHA256 d6f06510897b4187aa91965cb6062e3f1246791c47b16afdceefb0425a4232ff
- MD5 a426d9cefc2942919c230f3c7805bd5f
- SHA1 6eeae35c640fc8646168aa235a7f395fc968265f
- SHA512 4700194edc89ad8b54dde4666e4cd74fc32e0eb249b21aeb7a8e3506d1cd77de6fbe3321d9451a7139991c50ff4f83bef6fb52b5154716322d302c7750d80ffc
- SSDEEP 12288:k7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:oxIFIyGibdPgHB/eYvu5s2aC+
- TLSH T124D42381C5BD9D28C214593199F72B32D0C2F4986C52EE9D0B92DE7D11E2907BC2BBDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 1564 alg.exe 5852 GameInputSvc.exe 2980 GameInputSvc.exe 4972 elevation_service.exe 5180 elevation_service.exe 4860 maintenanceservice.exe 300 msdtc.exe 3036 OSE.EXE 5484 PerceptionSimulationService.exe 3064 perfhost.exe 4252 ReFsDedupSvc.exe 2680 locator.exe 5968 SensorDataService.exe 2012 snmptrap.exe 2700 ssh-agent.exe 3548 TieringEngineService.exe 1096 AgentService.exe 4348 vds.exe 5996 vssvc.exe 5020 wbengine.exe 5380 WmiApSrv.exe 4492 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe - Drops file in System32 directory 24 IoCs
description ioc Process File opened for modification C:\Windows\System32\SensorDataService.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\c64e30f2e62f061e.bin alg.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Windows\System32\vds.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Windows\System32\alg.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\locator.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags GameInputSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000eeaed525af32dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009834fe22af32dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000de520c27af32dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000071f7d125af32dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dae1df23af32dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2980 GameInputSvc.exe 2980 GameInputSvc.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe Token: SeTcbPrivilege 5852 GameInputSvc.exe Token: SeBackupPrivilege 4252 ReFsDedupSvc.exe Token: SeRestorePrivilege 4252 ReFsDedupSvc.exe Token: SeBackupPrivilege 4252 ReFsDedupSvc.exe Token: SeRestorePrivilege 4252 ReFsDedupSvc.exe Token: SeBackupPrivilege 4252 ReFsDedupSvc.exe Token: SeRestorePrivilege 4252 ReFsDedupSvc.exe Token: SeBackupPrivilege 4252 ReFsDedupSvc.exe Token: SeRestorePrivilege 4252 ReFsDedupSvc.exe Token: SeBackupPrivilege 4252 ReFsDedupSvc.exe Token: SeRestorePrivilege 4252 ReFsDedupSvc.exe Token: SeRestorePrivilege 3548 TieringEngineService.exe Token: SeManageVolumePrivilege 3548 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 1096 AgentService.exe Token: SeBackupPrivilege 5996 vssvc.exe Token: SeRestorePrivilege 5996 vssvc.exe Token: SeAuditPrivilege 5996 vssvc.exe Token: SeBackupPrivilege 5020 wbengine.exe Token: SeRestorePrivilege 5020 wbengine.exe Token: SeSecurityPrivilege 5020 wbengine.exe Token: 33 4492 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4492 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4492 SearchIndexer.exe Token: SeDebugPrivilege 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe Token: SeDebugPrivilege 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe Token: SeDebugPrivilege 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe Token: SeDebugPrivilege 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe 4936 2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5852 wrote to memory of 2980 5852 GameInputSvc.exe 91 PID 4492 wrote to memory of 4368 4492 SearchIndexer.exe 112 PID 4492 wrote to memory of 2840 4492 SearchIndexer.exe 114 PID 4492 wrote to memory of 5512 4492 SearchIndexer.exe 115 PID 4492 wrote to memory of 2040 4492 SearchIndexer.exe 116 PID 4492 wrote to memory of 1796 4492 SearchIndexer.exe 117 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_a426d9cefc2942919c230f3c7805bd5f_elex_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4936
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1564
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2980
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4972
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5180
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4860
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:300
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3036
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:5484
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3064
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4252
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2680
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5968
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:2012
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2700
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3548
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1096
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:4348
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5996
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5020
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:5380
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4368
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:2840
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2868 2872 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:5512
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2900 2892 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:2040
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵PID:1796
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 f5e193e6ca38adb71201d0428687b7aab6dd966c54c9401024934c22051efa78
- MD5 9e2436fd59835b96e1d966d5724f8300
- SHA1 6f62b7b4e84329e3450f3692b43b8733ef2b4161
- SHA512 5b8a46c1e52d510a85c8749ea25fd0e0701f8f9b9b61b7591f59216acb261596ddafa434b7439a0ed9a0241f766b4d5548113ece1f790d5c6515af58e4428027
- SSDEEP 49152:YOr632BuPkFKRrdE6oh7stBhuXjfS4LWxniOI5Bh/e44s:A3q6gjBTOUBh2
- TLSH T1CAD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 849KB
- SHA256 b1e20371278110c549b9ca6c2488a616deb8bc772ae40aa5ab9c33c070190dd3
- MD5 c910675e33d830046535f4348208112e
- SHA1 e526bb6d270c376789c69872cd72fbe74375e65c
- SHA512 6d95c2b744e80da81925bc2d6a02b754854037d989974862c682d6ea22078ea2d7486ccc962b80546638d00e04ca2d726f8a7977b4b627d186a444ceace854b7
- SSDEEP 24576:hXYZDfczAkxIFIyGibdPgHB/eYvu5s2aC+:qfcPOI5Bh/e44s
- TLSH T1A8050228A3E408F9DD67813CCCB28511E673B8554760EB9F03E49A391F637895E3EB91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 7004624968ad0d310177c169597b6c20d2910f6a4e6618f2166f478ab71b4834
- MD5 fff846fc735395f17911997c8a9184ff
- SHA1 9412d4d3708917a936559e88a8cb60dfe12a6796
- SHA512 987c7338ed6e9861177e0d04b3e8715a4629ec6ed8cc054965fc44144ea73ca6c980a94390554baf181169e01c2fda5203216f278c42d4f585d733a77e5e90c0
- SSDEEP 24576:n0DevdK0P6xOrMjxIFIyGibdPgHB/eYvu5s2aC+:n9dK0yocOI5Bh/e44s
- TLSH T12C45AE16F6748735D073C0B9C5D2A69AE97230851B308ACB4286D77C3F67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 7c545abbcd2383103ac743285306a40217c18456fcda91c9db2efa4a9a4013da
- MD5 b63424b955df5dc961fbb805ad2f9c42
- SHA1 dcb5e35a5102fb9d7a6049ebaaf5cc64bbaace52
- SHA512 4759af3aba9b9766e936bc51e4f751fabb6ea95e2a6fdc7a019b16bb0fba2f47f8e44b453c233f4a7382e2c162e1619205cca9d317161c4c7e717357953e666d
- SSDEEP 24576:aJY/ezSC6vUyD/aqgrvW/6q8wyuRxIFIyGibdPgHB/eYvu5s2aC+:B/ezSC6vUzPvuHjykOI5Bh/e44s
- TLSH T1FE755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.3MB
- SHA256 16b19d6fb9a9c3df7c16bb9cba45654ccb68f74a67cc7999565f1e7783607a24
- MD5 93279c14eff198b2faa3b52bf3f10013
- SHA1 39d6d79b72cb923d90a9d8a0754d458dabf7c90b
- SHA512 e3c3ede67af26645a950327f314815b9677bf4b04000ebb3a65ff30749cc75691cc2ad11ca21cb0ef0ae1ba8a0a834e1ad2824e99aeeef92f4a3fbf8a5ed42a3
- SSDEEP 24576:cab+PHsZzv/l+dexIFIyGibdPgHB/eYvu5s2aC+:causZzXl+QOI5Bh/e44s
- TLSH T15F559E66F5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E677D6D63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 603KB
- SHA256 8b5dff5a283b3a6f6528a668166c6d76061c8347bfdbb6e6a3d36b720ec6cef1
- MD5 d44a34c255c74a4085b59d822d922beb
- SHA1 6d2745995e97da4fdbb87a621ef4475dee7f1a54
- SHA512 e3f5141fc304751360a2d4cf41f4c270343180a33a3ac60bf6ada341266009ca835c0d6f2abf4f2839a52014ae430a5326988ffa3452a147d74cea5529848680
- SSDEEP 12288:Abb7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:AbvxIFIyGibdPgHB/eYvu5s2aC+
- TLSH T175D42381C6BCA964C7651430A9F72A32D0C2FC846C42EE9D07A1AF7D05E5947F82B7DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 863KB
- SHA256 e530dd3a3b365117c5170af92459b9de4908d34bbfffbcd84d73bbc53548201e
- MD5 2b61f90019fc4046b20b407acdb9c2fa
- SHA1 90bd80593ed9e4b302df9e23df244d508437590e
- SHA512 23048c4bb481c295c0891c400335d1b964c05267c712e5876c52a1990dc5d483d8004e58af6b930ee19d82604e7f8eea442e519794523a6709ffdc58a5aaa6b8
- SSDEEP 12288:tDBNUbTVO86Ug7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:tiIU0xIFIyGibdPgHB/eYvu5s2aC+
- TLSH T1F815CF3BEE38FCD2C27A4D785A918700D7A2B8704F52A3CBD165831E9E235D15E7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.7MB
- SHA256 4646e1af58e60d3957649da8327ca912a4c1ec4e13df725a938ec8a138e8209b
- MD5 b8a036913520c645f404edf245ed82ff
- SHA1 3c0d9046248603191e8ebf444fc4fd7dcd706845
- SHA512 360d0b529ed2c7c938916858cab35a466dc2b59f6e0a14873cd19db2db58fd9b5332692a3eb8dbcb3d5bc9d3bf4e3d5196800b2d37481e9db17fc63def321a1d
- SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ99DN5J8NRV3THP:VQvGAdlCEL8c/9RNw5C8OUBh2
- TLSH T190367D656BF880F5E0B7E138897A8572F7B678421D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 932KB
- SHA256 c18d1eea02f299bd2c5220cd876a47fd724e91531554ece4582aa7e260c5f3c3
- MD5 1c3c21c054a8c37c0408aa8f0c94618e
- SHA1 d469c5ae45f4dd306c5aad68d63df3d3a9618607
- SHA512 0197c94d7509aa85263d18b800047debb0182782bb5beb9321e7bc57a36ead8836cb8b870a817b179f904c396d2141e4ca5137778bcdb944065924ed1cfcc0a1
- SSDEEP 24576:vmewsAjzxIFIyGibdPgHB/eYvu5s2aC+:eljzOI5Bh/e44s
- TLSH T1F415E031FA74E436C3BB0DB21B36D716546DB9204F521AC3E3E88E9D49702C26776A1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 14.9MB
- SHA256 01459d9b91d78b72324c96549e9c21f27f2a101d6b680fcddc17346f62071eba
- MD5 ed600a774829922818fb9d39193e0761
- SHA1 44afddf7b6eda2783279960e510db98e26d887c5
- SHA512 fd9d4576ff6769b99cb04b30e29ecd9d18d41a01b0b2b107dcc3abdb19179e3d2b0ad444cb3feac7b7a0c9c038e763b3c1681e1cc1335e1d37a75a8a39317338
- SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyXFldW:HUEtQevvqc2W1cpV2XFe
- TLSH T15AF66C9667F802E5E077E978C6A68573FFB178410A31972F02A1C71B1F3B6A09D39721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 21a9c05f9db46e918ee966ab6be18c303a57606aafd2f563be1ba0c36e39946e
- MD5 7bdf8276f815cf5e518c8a4a669c60a7
- SHA1 411bb9ca6c29bbdfd2d17549dc2154ffc3fa72e3
- SHA512 5844c0b94f1f9af9bcac6e16b36c84e8c1c8d1e29e09dc5fc3ad3795844174e780a7d6816bf0324ce609d53a6ff809c5ea0f0846ecc2ed56c4a2e26e3d83659d
- SSDEEP 49152:blyRquA/m2yL5zMfFiV+XenmE3/zKOI5Bh/e44s:Eoq1VjnmvOUBh2
- TLSH T10CD58D0976B8C2E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AD58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 f6063db4c390a0ea7ba813707dde151a43c3b925029eccc1a6838a39eefec9cb
- MD5 51508751a6e5973696b1c3bb61815b51
- SHA1 62406b69c00cd5048f1d235f5854e0f4bde1a99a
- SHA512 1a0c4aabde9c2d87039f7d5b44268bc400b8091ae5bb6b84fd97906dfe9752b721119b57cb664d5ec739a049e511c2eb70367aeb46d851cf178cb7c8613ef54f
- SSDEEP 24576:RAhGLvGFoiwtA5l7S53fxIFIyGibdPgHB/eYvu5s2aC+:RAMiFoiq5POI5Bh/e44s
- TLSH T13F45AE81E7F955D4F5B3AA7899B69571EAB2BCA95E31C20F1160C21F0E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 830KB
- SHA256 cd6dd1ad136cb7730bdc19141e219a2fcb8d73749129901092b05433b10bc66f
- MD5 308230d7b1bfd1d9606ad8c8038e3a5a
- SHA1 691bf291bbe82c2412e3e47c97551629421cc5ec
- SHA512 3eadf9a3e5b0ec6cd4692e7aafd247b634ce4baf558715c35e3a75b256ddc4fb0a97ba494406f7ab960602ab74d7518e076334b75285acf7b6f6b7a95bc87915
- SSDEEP 12288:Vmw5HEjsChNXBFgl0WDm+Ch7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxn:QwuuOWQxIFIyGibdPgHB/eYvu5s2aC+
- TLSH T16805F14676A81CF9E9674138C5978536F7F2B8012A21DB1F0760CB6B5F73212BD2EB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 679KB
- SHA256 b72fb75c7566a6f6fd3801451864e478b8c676b029c9847ca212bf61a619d1ca
- MD5 c565a3e981dd42a3b11c7593b45fe20c
- SHA1 983a83c965620eb7e50131a1ac11f6cf47c22c65
- SHA512 53aabce7ec26ca9864aee560ed88ccfeca522919786c048a96169f364a5b9783d58f9a78429bed4f147535bbc803c43eca1c656734fde3d06ca526da1878c76b
- SSDEEP 12288:ymN1IlEO7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:DNuFxIFIyGibdPgHB/eYvu5s2aC+
- TLSH T16AE4128A23F864F8C1A65138D9F21615D3B2F4552732C7CF06604B791FA3AC3AD3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 9994537852420b505e3957b88891b882650789d8e7da6aa7bbe7ee9d54cf81c6
- MD5 28a546fcf4e9432d94d600e0b58f39e5
- SHA1 4c398ad60cb5570bed2b56b35f911586d9115c9d
- SHA512 6d00191f31c8579a7e9daa5ff0c38e01fcec543022c75b1baf911d030ba9de1d61752da167976ab505a8cfcd4ffbea5bc1e6a7b7ec3938f36247eccff83ce363
- SSDEEP 49152:6bAdh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U9:pQRQyi36YOcP8Lvw2gAf+PN3hOUBh2
- TLSH T1A4667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 ed8d9028d6c24fe6310e8a6fa68dfb1ccf63ce50f8e421ba202c735bc6b49273
- MD5 4916de23273674bdf9cbd42d2c39ef9c
- SHA1 d7422fb2f21e870ae99d25111752dd7fcdfc23e5
- SHA512 5656194c7d982715c702d584512ac47323afd01b9eb251e9ed683e55cc46de14d0f651b0d20e99058b8019b0396d00a4d905d34bd140620368219f1f3b5707d7
- SSDEEP 49152:6bAdh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Uk:pQRQyi36YOcP8Lvw2gAf+PN38OUBh2
- TLSH T19D667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 a4d4b1fec07566332ad992ed8e7db323982a3c440f9579cfb81c96c034cad867
- MD5 7e7f46c210e97aebebf614439284e867
- SHA1 5e5537d2eba6518afa5f093834e019dfe23d0cdd
- SHA512 e71b6d5ff627e525c1a7a48075b5775e0f641d9183bef033eea7f2153d6a64b4bc644deb420bbd242e01852e7f5c03ff29b717ce6e15705415a7d05462673035
- SSDEEP 24576:cwv3Xf6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0JxIFIyGibdPgHB5:F68Qg55nhMeWu7PNU3/2OI5Bh/e44s
- TLSH T17EB55A33B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172161BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 54a0c0e4872bffeb3ea23e81b9fbf913a84c2bfb227292ad985fe2b20f2848c9
- MD5 9dad44a435ac10d60be9fab578542ad6
- SHA1 36878933f07f434a25e14bdae5b221493e767ad2
- SHA512 9f27dea8c002564aa58516a5e0de506c882f4d556c8e97f6a40096341bf981d370aae989d5591ea4134cf1534ac4828ab0dbe1a6a4399e337443e4f5bb158259
- SSDEEP 49152:83aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk991:5y5112gYy5azzVv569nLKnhZaOUBh2
- TLSH T1E3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 67565146f70cb91530ffe00a1fa5d8349e425b0ebd09258b575f30fcb5331eaa
- MD5 0a7fecea1a8412b3de68a5eb9418be81
- SHA1 07439fa5664227b62f51046a5bf1267c15f85d2e
- SHA512 27d402e47a50e7e74ae694bf7ee44d80c8af9d02a5f44d0b4433ddf0c90ae060e042e142b0d9a83b7c9c7dbd00d51232a82086ab0a7ba73c3a0c2c57851fb54a
- SSDEEP 49152:66+taZ3usBWOBr4tEGp0bqx0z+n217aau1glCOI5Bh/e44s:vu6JmTxd2dCOUBh2
- TLSH T18CD59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 e13c6dd6c32f519afb16ab053d12965d751074c812908efd1883150d40b1f09c
- MD5 d6b1abe2d99ae5caf14734760951aa1e
- SHA1 2e3b1552e19dba16307f3c6777011ddec50cc7ef
- SHA512 80010d6f773712aba7fc5c6487d087cdd9cddfcb83a6879e2b648a4d714ae3f737a41f6534f288b9ebd6069c3d0dd5963a2edd0e5054d62cb603eeef45d22106
- SSDEEP 49152:G1hpsNoJpF1A6UU44CwH7R4x+OI5Bh/e44s:GmifPbRROUBh2
- TLSH T135B5BE13F2D900E8D06DD17887569232EA62BC450B35B6DF0A90B7961F7BAE46F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 5084cf2f31c34886edff7bf65364b9b86c37e0f7fdb1168bdc9ca1421be52a34
- MD5 276fd33866c48d3eb03a2b35fa25c3d9
- SHA1 343d784634cb19c8d6e93addb06c78f3080cfc26
- SHA512 bcb121dd5dda04d773980298904b19fd13adae39d47b0cddfc51a0cd17cef685671509499c8fea40f4b0393bad2f3dc2440f4567698be4e4f559e0779e90fcb2
- SSDEEP 49152:gSuZQIY0Be2K6RVtOnks6NMHqtOI5Bh/e44s:65dKoi61tOUBh2
- TLSH T1D9C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 2fd9addd19dcad007c00a5e9ef00077f2c686a7c18e12258430915277ccb98bc
- MD5 5324c1f061436983f3b0616cbb1a1fc6
- SHA1 b94914b0a68529b150858ece0f239761b2634aba
- SHA512 c3e982df29a5dfac25992b7a33d56fd59bff4715ed6f5acd84029f77ae8bad0db895f8d287cebea7ed02032323f5dececdfbb6c692e589a99640aa659e169178
- SSDEEP 49152:UxRSn8EApI0figTgiDn0AP5wQOI5Bh/e44s:JX2iyphfOUBh2
- TLSH T124A5BE13F2D900E8D05ED178C7568632E962BC150B35AAEF0A90B7561F7BBE46B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 602KB
- SHA256 aa595df3a5dd7bc32e91b18f7f5cde53f3dc72e0385de4e4cca4090091db646c
- MD5 810be515043580def84cdda68265fa27
- SHA1 63abae08e40effff1d08ff5e0bd3df656c4a28b2
- SHA512 87ddfc4249b54bbdd6b4d748a3d0f53d62dfe6a4f9aca6e501e6ace7f6dcbd2d5638e5e6c15d2c1b0c67f14eb0832a5b0d8db0ef50c3a1ebd8a9356c0cb29849
- SSDEEP 12288:4b7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:4vxIFIyGibdPgHB/eYvu5s2aC+
- TLSH T1CED42385C5BD9D68C2541531D9F32B36E0C1F4887C43EE9D0BA59E3802D2907BD2BBDA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 602KB
- SHA256 12362217791e3b6242564cf8a9d7253c74560276c08d7c44b32a89ecd8c4858c
- MD5 29881e9a32098d411588567e00474f6e
- SHA1 a86ba074cd56fca1dcf92d91e41bed229b7e6cb3
- SHA512 d3ad9332efe6db5aaf86760072336f7b24edd03347f7af6ed03827b0d33d13cc3cb883e67eece3e667dbc6342bc5a959862cf4603ddfbaccc1e7dabd605f8437
- SSDEEP 12288:u+7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:uCxIFIyGibdPgHB/eYvu5s2aC+
- TLSH T1BFD42385C5BD9D68C2141531D9F32B32E0C1F4887C43EEAD0BA59E3802D2907BD2BBDA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 602KB
- SHA256 0529391ba7c47b70d3ca5ca3c220c90c634dca36c5ab5683fd0f322059db8895
- MD5 e0638bdb6f97b060f2d04b3feaa742a1
- SHA1 fd217b299904b30dd1f52e16e278965d5c48e590
- SHA512 29961fd68c971688c17ebb212f24c72d3447ce5647f7af12b6d83b9e6ea73ae8d8f0de82465ff019efd0bd4fb8c11c719b81d8bc1718606f2b66a21d0bb7db7a
- SSDEEP 12288:AY7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:AcxIFIyGibdPgHB/eYvu5s2aC+
- TLSH T137D42385C5BE9D68C2541531D9F32732E0C1F4887C43EEED0BA59E3802D2947BD2BADA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 623KB
- SHA256 e15cbc4c1fc0c0589914dbcaa135874db0f0e93bc20be4bc033aae621db6195e
- MD5 e216411d6f8959d5c4b2136bf82dc1f1
- SHA1 b1e08654e5b4ce6238c19f6b5b1c7b388b4c1762
- SHA512 644f6ee89f04ad7754cfabb0c5a72b41b0b1a2a6effd282491c5e5288d09b1cb3a4a62d371a6032baf7e357d7af7bab2d5a81cd0ec73540b6df60e467f33b177
- SSDEEP 12288:xl47MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:wxIFIyGibdPgHB/eYvu5s2aC+
- TLSH T1F7D4234197BD59D4C1619534C9F32631E0E2F894B923EBDF0B504E390AE2647BC3ABDA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 602KB
- SHA256 9700235ffcfe5a837040e546f094252b9a1187127fddec82f306f7320f017b6e
- MD5 c6889144b6edec86ac429ea634f38add
- SHA1 1c05cfc2f9082efce0d4fbde629496d6cb012e35
- SHA512 ce8b005070904a272057d27cf0e600cfa604252f07a3d1fe74b60ab0c2654716f13421ad6a7120e1751232d20f84113b922e0b306ba752dff6a6c954ae9a1805
- SSDEEP 12288:PN7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:PhxIFIyGibdPgHB/eYvu5s2aC+
- TLSH T1ECD42345C5BE9D68C2541531D9F32736E0C2F4887C43EEAD0BA59E3806D2907BD2BADA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 602KB
- SHA256 406888b0b5916d84e1e8df0e51a28de253df201d392a99f5927b15e18b4d017f
- MD5 d3a1023e7b69d1c598bb0f820f80a2bd
- SHA1 835c728717d519d4e4ebf86eb2c5fa081e74b9b1
- SHA512 c70b6c9ede6d27e53e72ba655e077f72bd8e8d32f171955afc862f4b5eecdd12886b95e9d91be4a8dc9829b831e448275e2651ae5315b43ce53908aba8a70135
- SSDEEP 12288:Mh7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:M1xIFIyGibdPgHB/eYvu5s2aC+
- TLSH T143D42385C5BD9E68C2541531D9F32736D0C2F5887C43EEAD0BA59E3802D2907BD2BADA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 602KB
- SHA256 c0021611180926d18cc8389ade89f110980412c98192a334dcbf07546ee6ca64
- MD5 84856fb87bb47bfa32ddbedefb425155
- SHA1 07cd5ce43ad761fb1c98d574d8279ef7891387fa
- SHA512 61cd32e071ff9c03c30458069c78cfc3aeb707ef647791d49ee736d0ff347a6381cecf5be1127da94750bb7a83a2250d4251b50707efa5437fd617a32ecf38ee
- SSDEEP 12288:dI7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:dsxIFIyGibdPgHB/eYvu5s2aC+
- TLSH T188D42385C5BDAD69C2141531D9F32B35D0C1F488BC43EEAD0B659E3812D2907BD2BBDA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 864KB
- SHA256 d3f3b7ed758d33ea90c53430a1f50a9ebf84420b007cd91d74ab56c42ba42578
- MD5 d17bac9e33cc2e6991dfaa80083e6c0b
- SHA1 a8d471fafcb4faf5b914cd26a33b151211f8ba98
- SHA512 da9c8e4ee7ae8d93a10661839acafee71b35473e0cf0c18a68cfa5af50fc7549fb2b2749f5ce9094cc9d72415b9d8ceb4cf148ea483473b1f825afcf54dcbde1
- SSDEEP 24576:RZMwzFVS3LxIFIyGibdPgHB/eYvu5s2aC+:RZMwzfiOI5Bh/e44s
- TLSH T15D150195B3A41CF8DC67813ECD665916D1F2BC590A60CA1F03A4362A1F733525C3EFAA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 602KB
- SHA256 f67e4b42060594f7bdf5eba962ef95994c01fc4276968285fd777a2f777b2d19
- MD5 350a37059d630dd2cbec2c3e2daea073
- SHA1 000cbbfc19b96a9264a88d1ef1607d06506cbfb1
- SHA512 79c9085a8d39e79f106b5b74447437ff1f9e80d0b9da6f1c6ecdcaf1639dc7892625516c6e68018935be397832f712735460e0ecfa669f080b856583f6a433a1
- SSDEEP 12288:ul7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:uJxIFIyGibdPgHB/eYvu5s2aC+
- TLSH T143D42386C5BD9D64C2541531D9F32B35D0C2F8887C43EEDD0B959E3812D2907BD2BADA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 602KB
- SHA256 546c71c8dff64d0ff1812759a56c513b6ea69616ec9d3aa11ad2b7d02deda029
- MD5 2ac159141186ecb87859fe6efb10ad05
- SHA1 7b954be72f0805529e21153755d1522a7fab0ed9
- SHA512 c5d6bac5b88fa0c6aa374546857509cb3445983a6d569e80a2236162191ddaafe62ddb52bd11dfefcb922c1f71effcfc6c71decea440fec903fdf65f8101a35a
- SSDEEP 12288:gQ7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:gExIFIyGibdPgHB/eYvu5s2aC+
- TLSH T1DFD42386C5BE9D64C214153199F32B35D0C1F9887C53EEED0BA58E3812D2907BD2BBDA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.1MB
- SHA256 3fc3820f39fa5187104031439f8c38e839d189e11d0f4cc1e006acea77ea2a35
- MD5 3c2dbc768898238b966934284c13b2ec
- SHA1 cc2a540b4e4d3236ea37f54bb6cba756fcc2ab7f
- SHA512 1ea90935d6e4260da9acca18f5fc04dcc39d7fd49cbc2948d02c554b5069ad256932bfa2924086589c559ca52dc154d92ccd30173b2422c4527b68ab432c138c
- SSDEEP 24576:c7wvtk9RX6wkyAIwxIFIyGibdPgHB/eYvu5s2aC+:pMnYIwOI5Bh/e44s
- TLSH T15635D029EBDC44E5E177913C99B7460AF2B1B8581B31C6CF029A536D0E37ED4AD3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.6MB
- SHA256 4532d33a9100c7b87ecc15bf9e502f1a80d1a00007ee86ccac7e2abdcff3e35b
- MD5 2ab34ae50e3b4e690633963ac86ada18
- SHA1 277cd388625bc2a0c734fe757d88c5b075582b30
- SHA512 fa4dafa4970ad662a612c9e3838813925ab66dd457039d974324303bcb5c90a1c7674c7b503761c0d338a47b4896a0ee23120d6eff0e949a6b5d64271b52a1b9
- SSDEEP 49152:zYxZNpsykNC7zu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0NOI5Bh/e44s:CySzP1OUBh2
- TLSH T18D067D56A16801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF0AE3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 8fac47500dcf103ed3b7a75e434f91e6ecf95ac38834860b42e5d7bd965b828d
- MD5 5408369e3851358978aa8e8c7c1e38e3
- SHA1 fdccfd2c5221307cfeaa6e8e84defcd9d1ddfb1f
- SHA512 08db5b244ca7d23ab88ec5501f7a3916d5a6abf41d8af69863d22940d42d9be171d082e6ee0757e9f3a069a428ac45d7e9e54b443747173fd1aa759a2db6b6a5
- SSDEEP 24576:CL7Jb1aQZRXLfOrIhnjFN8rnDHU2+fF/AY6xIFIyGibdPgHB/eYvu5s2aC+:CL7JUQjXirIhCnDHUPfF/MOI5Bh/e44s
- TLSH T1CD65AE1EA3EC01E5E1BA923885554A1AEA71742D1F32CACF1270837D6F63ED49F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 722KB
- SHA256 1408ac16a3282d301644cbbe3acf21863be62f6701ebac053f6938b599e41052
- MD5 e75501fcb7b5bf7c9edcba498090e512
- SHA1 174778fc1e5caaa063f62b903b724846e1d92cc9
- SHA512 339604016e3204bf8254f33ac22f94d2d0bb064b0eacbcabc2f552f55f03ddaca5a7886e26448068c712f17ec58a7c4ce81e0bd691f5dfffa03ce9d8e6d68464
- SSDEEP 12288:itTf47MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:S8xIFIyGibdPgHB/eYvu5s2aC+
- TLSH T102F40109D2A852E8C06E5135C7921A11F373BC6456E2D7CE17D0F93D0FB6682ADEAB43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 610KB
- SHA256 e62d17f49d17bd3fe090bb6ed6819071b5ed6a417c055ecd891630bdbbf37551
- MD5 0a11fce19c3e6577d7f3b3ca09ff793f
- SHA1 87ad7fe6f07f6d846f90568e4a4160910424632a
- SHA512 496bbfc21e2049933c108288514aabb8cffbd4146352d0c43d5648aaf2b11b0c32732ad9fd4eeaf1755135cf63ba112302d6d7bda07ac03dd2af93e55713c905
- SSDEEP 12288:sP7bE7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:CsxIFIyGibdPgHB/eYvu5s2aC+
- TLSH T1FDD42342C7BDAD18C178153099F72731A082F9986F02E9DF5A505B7815F2983ED3ABCB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 863cdb0376c7837c64cdb637d673e82690469f83b9717845b8545cf17aabb00e
- MD5 19ef220766afb48c062bf6b8770c8c8a
- SHA1 b988ec372b62af84e1db7b1fc7c3a8f07fb58abf
- SHA512 a94a1db335ea71b145dc36e23c2adcebb4c5644b3399e77ac217927654aa752e57803de26c1068568dc99fd49050bcd2369d865e151c61d45e10c4d7013e00c8
- SSDEEP 24576:agb6bmBIi49WNNFpg1rSvFv7bYuxIFIyGibdPgHB/eYvu5s2aC+:agb4mBIBhGFjOI5Bh/e44s
- TLSH T1FB659E1E22EC02F5E0F9D2B89DA64417D6B278161732D2DF1251423D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 664KB
- SHA256 e4698230c8383718baf4908b1b2ebe8a8394e923b33679722dfcdd2564bd6cb8
- MD5 bf4dea44304517857eba97f40ab07b52
- SHA1 93a38f8f8acd9c677e618ee786dcebf3e882ece0
- SHA512 597e0e97c608b820b691ac3db03b389e2f0a663b9fbcf259fca125ae78348b5a68a62f4a59318be2f33adb4143469d25bed7fa95627c5ef4aff1db261aa496fa
- SSDEEP 12288:O2G37MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:1GrxIFIyGibdPgHB/eYvu5s2aC+
- TLSH T162E4235D51FD7898C135863498B22632F0E1F4906B11AAFF06E0DA384BD59D3B93EEC9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 628KB
- SHA256 597aebf03ec9840d6ff87951cccb926bca123d82ca8c7201b5fbf624704b8c0e
- MD5 fad663e9aaa773c160dfa5cf51c65c09
- SHA1 a5673af8f78237045bee91a25eb6757e029b9473
- SHA512 7d7424ae9d6afd96d5cd6ef7fc9c26ad5de25aea434d4dc0ef937ba474d90a7e61f71100c8413fc692916b10e749cf9b49687b7bc86e7eee91e88608b303c295
- SSDEEP 12288:ae7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:aixIFIyGibdPgHB/eYvu5s2aC+
- TLSH T1C2D4238182BDAD58C254153099F32B31E0C1F4946F53EEEF06A19A3901D69C7BD3BBDA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 4710b77a93bde7b6606daadd8333049ccadbc953043c252c454de1a4aad995c6
- MD5 88bb66d75eeed630f52f355385e8a190
- SHA1 a1d3b5f6d74d4379a97aa423c2896ab65d0c49aa
- SHA512 cde63f103eea6d6d4074dea32f40222fc1fce3bc1816d414a0d4abb08f9feddc1234eed95874da48e25673853c1d3f8184aeee46d6f6d05533aecf8ffb39e1bd
- SSDEEP 24576:m0p8u8FpJqH12jrUa7/myxIFIyGibdPgHB/eYvu5s2aC+:fOZFPqVDa7/jOI5Bh/e44s
- TLSH T1A035F165A7E501F0D47BD13889920663F6B2B4251360EFDF07A88B651F23AD64B3FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 832KB
- SHA256 368294adb9f465ea5338db80cdfa8609f73bf010c6f2b5a857be6bf268accf47
- MD5 ee6cd022e5b755c2a0b0b3af8a782028
- SHA1 9fa05517768ac623767c7b03335c12932340355e
- SHA512 20735d1b752f94a3118f214b203cbb911cc24e1d9d77cf939164149a3db9b771970dd0ede48146e01eb6c3da522ce9d9e20ffeb6fe310116ee925f3d318c785a
- SSDEEP 24576:aPUr+NQyxIFIyGibdPgHB/eYvu5s2aC+:aJQyOI5Bh/e44s
- TLSH T1DC05E11F62EC1CE4E676A13D89924719E272B4621712D6CF02E0817E0F63ED9BD3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.7MB
- SHA256 2c03a94e4865ae60e6f3d606b9eff347a9cec9be7a625c947ebe971673b5901e
- MD5 0a2a5f99424a00d032f9b5480bf8346b
- SHA1 80fc8dd891947920b09a4157bd11783daf2eeaa4
- SHA512 25d8f9465856a5cb1ad09250697fb6e6cb6b62862eb75437cfb682969a0593bf6e6553b4f92cd70edb7fe59893d84b1ed6cae0288e08e9f520598af8a0c5daf6
- SSDEEP 49152:3BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjyOI5Bh/e44s:oG05lO43b5OUBh2
- TLSH T14BD5C06A62EC11F8D1BBD17CD9C64A0BEBB23415033556CF02A486A91F27FF4A97E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.5MB
- SHA256 861069397ce03c6e84799122224862000c5fc1375984e7d450d64cb07cda4aa9
- MD5 3aa748aa3a0cf83fe41e50af321df495
- SHA1 9b8a50638e05f835e50c8e98c753f7db65d656e8
- SHA512 51719c01c671274575c487866d270eda6d05f42f5fbf9863678bf73185910ee9eb06389c7dfed57660c776ef784fbdd2545dd89680dd54d04f75cf5a8ee86b67
- SSDEEP 24576:0Fa5POZ3dpbWVM50JicR2hG0lasx2+47eidnAxIFIyGibdPgHB/eYvu5s2aC+:Ga5POZ3wJt2pasx2+maOI5Bh/e44s
- TLSH T1C565BE5EA6FC01D5D1B9D17DC5834A1AE5B1742153329BCF022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 89758d34f0dc4b07071261ff7c45987fdf477f7bd2c53da27014b0548ecbce9a
- MD5 7d127fbbf2e248feca7a91f76e4b977a
- SHA1 379c1285e014adff33b100b1cad3deadf3d32609
- SHA512 cb8f7c5d611234dbae2a5da5795d3c7342012882c52d216b5a7465c1f41a08b32255bada3b039ad874a4b066b712a4276ef67e6ee477ad8ad67c849f779d68b9
- SSDEEP 24576:oNcwHdjbyQ4nLC18lb/EOjowL7FkvxIFIyGibdPgHB/eYvu5s2aC+:oNc/zEOVHFaOI5Bh/e44s
- TLSH T16C858C1623E901E4E1BBE1BE89779546FAB1786517308ACF0291851F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 936KB
- SHA256 68924147566559886741d1adde66b7fd902df5a8816875fe031a5b3d884cbc16
- MD5 8e566f97160c932a9433d1ee5d11a56d
- SHA1 4c173c49a8c65aed808e8815a4821fca56b6695f
- SHA512 a21409e9523e888a91bfb03f78bb92e6ca7a73a970e79b87c74e266b6b24e95e5fc6401e0b7279436c87caa3b725113d7d2c47d1d743165f6c7378efc3bc9a77
- SSDEEP 24576:lJnJPbzB4SKxIFIyGibdPgHB/eYvu5s2aC+:lJnJv6SKOI5Bh/e44s
- TLSH T1B615E13DD2A810E8D4B7C274815A1B6AFE71387C2F2269CB19B4D5343F52ED0A939F58
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 6a525beccca0b0f8b6197debfcdc773c2a7c17b624f974f6f9ed3e90757bd5fc
- MD5 44c5ed0baf0a9fd58aee9442fd3c1104
- SHA1 bd3cb7a376eeafad50795f0b0c9524850919efd4
- SHA512 fe02ca17cf0aadde8e339adfee246b239d1914b4b09cb2fb20cd154763301f59e5f166035f48addb0229ce8594c1684b8a9d3af690f3c0ea04c3d0ce94196e5a
- SSDEEP 24576:nCLHGL0MoeVtFumTijCmlKQWDkhxIFIyGibdPgHB/eYvu5s2aC+:nCLHGeeV5ijCmlDWDkhOI5Bh/e44s
- TLSH T1FDA56C05E7EB5184E8F3CAF5CA2294169A327C549B34F7DF4A80C96A1E32FD1D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 780KB
- SHA256 ec9160313e1d8cd754dfa4dcc74b627620c582c89867101f60f7eb5e209ae2ca
- MD5 073ccdb144c1efd9f70b6efb109a668c
- SHA1 daae8e9689835003b8e29d8809dbe227fc8f35bf
- SHA512 0ade27beb06a1c90f7cf60c1717bdfa85d741e8652c3fefbeb27d5d2b7a114b652f0a0eb5bb03c1783309dd7b724f3166c7f8a394dc4ccdcefdf0288a4b17534
- SSDEEP 12288:3tHck6j5ZI7q7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:76DI6xIFIyGibdPgHB/eYvu5s2aC+
- TLSH T1FC05F14D63BA10B9C167903DC6930612E1B2F0B097529ADF0B94C97D4EE3EC9B93DE81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 764KB
- SHA256 becafc843862f38c67d6c4d6fc39f2aa61faaebaed3c58e3347f26d13a8428ab
- MD5 448830af5e629b1abaa863fd43b95892
- SHA1 cd25bc9255af0b4626294d7cdf7be52d17d5f321
- SHA512 16d7f66b464984e336bd49cfe8c174e0c513c0cbd0e87284e5929b112cd5b64708134795fbb92d0e7e02dd80814b59602141f4ceb115dca6954bc1e72e92fa38
- SSDEEP 12288:7G6kyZn7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:6tyZxIFIyGibdPgHB/eYvu5s2aC+
- TLSH T1C2F4120593A86494D6791634DAB302719971FC206F12D7DF06A0EB3E1FB2BC2BC35B96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 636KB
- SHA256 82cd3fb582ab8c15180e65495405f0e61782a6f94f39a22d5b2d71ceb13cf83e
- MD5 ea0e82a18911ffb6b15106390940c3de
- SHA1 d3de7080cae65dd5d4057d631c6294b86f7c95f1
- SHA512 967a97a1c3fcac5751046fa7139f9096b3496025044d786b160df42bc1588604de07f36cfdaf26fe070e8cdbf7990f019fa1cbf23e3a4f04e2a884c6e5aafde4
- SSDEEP 12288:k6W7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:hKxIFIyGibdPgHB/eYvu5s2aC+
- TLSH T1D0D4234982BDB954C514153495F32B31D091F4A42F13EAEF0AE09E3946E69C3AD3AFCA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.2MB
- SHA256 90edf8adab131fb5f89598ee71a75a8f03df0623dd7ffb47f0e91f6431e3492f
- MD5 121fc671af935be8cebb65651421ca62
- SHA1 f7febf1062a19a9e724f1e1ba26bf0ac291c0301
- SHA512 ce5b8c282c30aa1a14c00b3e6d36e886739e0df63634f69b40e9728a679043c171b44726b1f1302f38ee7866d160e9aefaf6f41bb7406fa6f24115ccb92d1d29
- SSDEEP 24576:WDgF2oTfaidZ5xIFIyGibdPgHB/eYvu5s2aC+:wgRTrZ5OI5Bh/e44s
- TLSH T183558D1DA3EA09CAE2B2D635D8721493D633B4315772D6DF2448C03A4DABED8AE74F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 796KB
- SHA256 1d3a36ee1c30ff77391f8bc8c8610abf6b8dca317f150492c682b6fa2b08a78f
- MD5 1417599eda13fb5a877388eed85cefda
- SHA1 a898178d574b47ec136e7abadb31df53887e6167
- SHA512 5425510062a4e26c93ff866076c3fcf745ac560aeeac95e7834c968c896d123cee270ca9a0f4df58c564fe9a8066f57e1cfa435e64664ca68dfd986a13f320d7
- SSDEEP 12288:dpJcm8CNog7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLC+:drcmRVxIFIyGibdPgHB/eYvu5s2aC+
- TLSH T1B205F14EB2BE00A5D1B7813CC9920616F2B3B0706712A7DF02A1C77D4EA79DA7D39B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 f159ef00c03e891ce7da2626f941ebfc5764b0f53f2a4ba59481e87edc43834c
- MD5 4728d277885e8117b096407f61474e72
- SHA1 ea79b6afc7f368e086c364b526d22bab97be058c
- SHA512 ee8c4d46ed32b07f4f17f384d4c74c712b53876c0d289074c8052a889f05c84a2e0bbbcced6da55328ca5a1b2e387265654f1221dbd87a7218a12d50f45cd9d1
- SSDEEP 49152:RDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3xOI5Bh/e44s:i3Upow8sBKOUBh2
- TLSH T16FA58C3DA2E800A8C9AAC379C54213A6EA71742D3F3055DB0174C578BF1BDF29A39F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 0cc1a703bab1e1100264879c232dc907850b64d4b62301cf845a9e675bb0c69c
- MD5 a29609999614b31d0dd9314ddea7d185
- SHA1 9100eed8caea23c8b968313a4391f3a2061674fd
- SHA512 a078d77462a989b959be9adc8aa6c94d0be9e019c98ee05c6cb24b3f75d99f515239a21e296adea01e9e035f4e783d865bde112aa055905c0dda013227145525
- SSDEEP 24576:RTkNvNnaFeYhJNtmZBmuxIFIyGibdPgHB/eYvu5s2aC+:RTMwBtOmuOI5Bh/e44s
- TLSH T11955AF6EAAF846E4D1FAC6B4CD238512E6727461173293CF5390C13E0E679D89D3AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 992KB
- SHA256 d7563497ff4eb3f42b0eb7daa58c2afcf41a71f09c3285bc3a2c322f4455de78
- MD5 e574915d2a995ae3b57d9b46a5108b30
- SHA1 6c3d3cd702a5330a31871a4a8261de31844b10b5
- SHA512 033c78d43edbcf1fb1689265c73b999b25a80fd9740a3497e4f600859313f10097b0b6d51d378df260084c59f59f02199633e8aa534ee1e069196a93f6debe1f
- SSDEEP 24576:oD3FHshBIYQgA+xIFIyGibdPgHB/eYvu5s2aC+:oDVHeBIAA+OI5Bh/e44s
- TLSH T12425E17DE6AC04E4D57AD17CDAA34A06E27178A8032266CB02D4C1B91F5BEE47D3EF50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 772KB
- SHA256 d978b949fb53373ac9b1e5ecf108f4ba1e50077c5c0fb1e81f5de7b090282351
- MD5 20fb31df3e05118e541256c80304461f
- SHA1 a3574fe8591bd9a43cd1b6561772a2206a81a61a
- SHA512 21d3ece2d1465ba6e98c16635880dff6a629e9942ea5302e29a94c94c90018ae92dfa61cf41d4dbd0577345fc4b0b74d91300be064d0fc84dcc619ca4514bf10
- SSDEEP 12288:yAv6b3IkxjbBzu7MV20iV4FcK4yWcgM8nqYei0dPgH1v/eGFdOousxAhSX2eSCLd:v6UqjpSxIFIyGibdPgHB/eYvu5s2aC+
- TLSH T1E3F4124D52E868E8D0794130D9B2023580A1FC711762EAEF26D4DA7E4B72EC6E93FF51
- MD5 SHA1 SHA512 SSDEEP TLSH