Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/09/2026, 22:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe
- Size 616KB
- Sample260908-2ntdvsyeph
- SHA256 836f8dc6f1853badb4e273ad05ced47483b6542d46db5117bfa4b9a254720f24
- MD5 78b52b635a0ca7feaef783edba89f3de
- SHA1 eb1c610a5679f45e56fee9cff726b4ba3893987e
- SHA512 dd5c6e2bc3969794a2efa153e91d090752a61718b329d94f4e834f48958c58f16567515004bdce7a5cc0ad374a7638efd7c92885ee6ec97c2724a993a19b4c91
- SSDEEP 12288:Zqu2za7mUDttbs8lTf6hJcj048UcCY8MqOYLGOR18aSA6+Mk81t0:QuOaBBtQ26kIfOR1JQt
- TLSH T1F2D42301F97F8C8AE2D5F67B751B227AA8A716729404072E77D7C69A283BFC05F01B50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 5112 alg.exe 1688 GameInputSvc.exe 4336 GameInputSvc.exe 4148 elevation_service.exe 4792 elevation_service.exe 1504 maintenanceservice.exe 5656 msdtc.exe 4728 OSE.EXE 5452 PerceptionSimulationService.exe 4860 perfhost.exe 1668 ReFsDedupSvc.exe 1600 locator.exe 2396 SensorDataService.exe 4428 snmptrap.exe 4880 ssh-agent.exe 2324 TieringEngineService.exe 1264 AgentService.exe 3248 vds.exe 3192 vssvc.exe 2532 wbengine.exe 5312 WmiApSrv.exe 3172 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe - Drops file in System32 directory 30 IoCs
description ioc Process File opened for modification C:\Windows\System32\ReFsDedupSvc.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Windows\system32\locator.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Windows\System32\vds.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\85c5dc3624febf98.bin alg.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe - Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags GameInputSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust GameInputSvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac959ca7e33fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000adcfbfabe33fdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004b2ca3a8e33fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c17f9ea6e33fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot GameInputSvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c4da0a7e33fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b081cfa8e33fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 4336 GameInputSvc.exe 4336 GameInputSvc.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 804 Process not Found 804 Process not Found - Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe Token: SeTcbPrivilege 1688 GameInputSvc.exe Token: SeBackupPrivilege 1668 ReFsDedupSvc.exe Token: SeRestorePrivilege 1668 ReFsDedupSvc.exe Token: SeBackupPrivilege 1668 ReFsDedupSvc.exe Token: SeRestorePrivilege 1668 ReFsDedupSvc.exe Token: SeBackupPrivilege 1668 ReFsDedupSvc.exe Token: SeRestorePrivilege 1668 ReFsDedupSvc.exe Token: SeBackupPrivilege 1668 ReFsDedupSvc.exe Token: SeRestorePrivilege 1668 ReFsDedupSvc.exe Token: SeBackupPrivilege 1668 ReFsDedupSvc.exe Token: SeRestorePrivilege 1668 ReFsDedupSvc.exe Token: SeRestorePrivilege 2324 TieringEngineService.exe Token: SeManageVolumePrivilege 2324 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 1264 AgentService.exe Token: SeBackupPrivilege 3192 vssvc.exe Token: SeRestorePrivilege 3192 vssvc.exe Token: SeAuditPrivilege 3192 vssvc.exe Token: SeBackupPrivilege 2532 wbengine.exe Token: SeRestorePrivilege 2532 wbengine.exe Token: SeSecurityPrivilege 2532 wbengine.exe Token: 33 3172 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3172 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3172 SearchIndexer.exe Token: SeDebugPrivilege 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe Token: SeDebugPrivilege 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe Token: SeDebugPrivilege 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe Token: SeDebugPrivilege 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe 2916 2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1688 wrote to memory of 4336 1688 GameInputSvc.exe 91 PID 3172 wrote to memory of 5392 3172 SearchIndexer.exe 112 PID 3172 wrote to memory of 1528 3172 SearchIndexer.exe 113 PID 3172 wrote to memory of 1764 3172 SearchIndexer.exe 115 PID 3172 wrote to memory of 5604 3172 SearchIndexer.exe 116 PID 3172 wrote to memory of 5308 3172 SearchIndexer.exe 117 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-07_78b52b635a0ca7feaef783edba89f3de_elex_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2916
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5112
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4336
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4148
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4792
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1504
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5656
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4728
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:5452
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4860
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1668
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:1600
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2396
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:4428
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4880
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2324
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1264
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:3248
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3192
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2532
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:5312
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:5392
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1528
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2860 2864 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:1764
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2916 2900 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:5604
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵PID:5308
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 fdf0d5e451fc3d1bdaefba4df4017f86b9dd00ece6914aaa32319793f295509a
- MD5 d20329dc87b121202cd3b8e77bf66092
- SHA1 14460ea7acef5789b14063de47275e7bf1454abf
- SHA512 154028f1e7cf32efbd703da55ae241d4e89a2437d9060fdd9a16055db68020884f2231618194b713ac6a2bdd859a729399d5156c670150d7e515fbcab61505f0
- SSDEEP 49152:lb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnOub0n61+t:73q6gjBlVn
- TLSH T1A6D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 849KB
- SHA256 e5598ec9511c9dcc742825748d917501f7df938cf84c5c778c9d7782243b1ff8
- MD5 95a7c8a02373e7c30e646f6d055efe55
- SHA1 d2f0a67f7632c759ab1fb0aad8b2d22c3c035689
- SHA512 543556c79b4247477946775ccb3d5c86b290e0de7148ff8def92a23757f9fef4a5b815049d7f4f6a295e87e4527a44bb9487301a3cd224c73333ddcca290639c
- SSDEEP 12288:v1XLsPjFFxS2lRq2czApqu2za7mUDttbs8lTf6hJcj048UcCY8MqOYLGOR18aSAt:NXYrdNczAguOaBBtQ26kIfOR1JQt
- TLSH T141050124B7E508F9EDA7C23DD8628512EA7378614750E79F03E4CA661E237C85E3EB50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 e4ece8b01311d78b61c96533be61a005eab3f54ac574ead8079c59c1546114b8
- MD5 35a8893d3ac9efc64b0d398230aad38d
- SHA1 c7e364216ad471a4abc34077c23499ed044a93bf
- SHA512 71c070e0610085189fb7b0614b42acc5c2056bd31fc047884e59adb2a8367faef45639eef8d6dec727b0f7b799cfdf434ffaed03648ce039297603874a5d4107
- SSDEEP 24576:a0Detcb0hZxOrMTuOaBBtQ26kIfOR1JQt:aDcb0noyub0n61+t
- TLSH T1D3459E16F6788735D073C0B9C5D2A69AED72308257308ACB5286C77C3E67BE68636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 5b1daad3c583feea814fe8d69dd8af47aca192690d0d501a497e6979a4b65125
- MD5 a4b94b75a0bc0452863d1d7921af5133
- SHA1 ebcaebc31a13a7d3c82d0762a90f174d6ab34519
- SHA512 388b54f03293d751395c97b5dba740b872170d64f0e324b2ad25b22fa8ee8348555705fbe50398c811fd5d560ee0ee396194a1e79943e3a8f8c6458421201793
- SSDEEP 24576:aRX/ezSC6vUyD/aqgrvW/6q8wyu06QewCSfg5qCPUAXPTOk1:a/ezSC6vUzPvuHjyByDjj/j
- TLSH T14B756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.3MB
- SHA256 ba1c94d93d102748317275786571051f45ed7724558825a60c02a62168ffc231
- MD5 34cfc3ea9b26d0af3e1981ff5e5e0ca5
- SHA1 0819bf082e03deeb21625155d5fd81b4b5e51f8a
- SHA512 0287e13a52264b5792b73d568dc9cc727f56efb41412212f9000fa1b53eb8a214d0492c6ba4429c406d966a69daceb49941a7c1287199fbf5ba68a4123de03e7
- SSDEEP 24576:QAbUPpf2nv/l+dK6QewCSfg5qCPUAXPTOk1:QAif2nXl+UyDjj/j
- TLSH T14F55AE66F5B48331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677D5D63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 603KB
- SHA256 5e464c94f5e040f24ecf5ff31347c4c0028d20b88a034fb45f5b1a4face2b62f
- MD5 7f6c65107abab6dc0f791b4bafc7ffc1
- SHA1 b837cee02a132792f158addfe528bef348459ad8
- SHA512 fef9e4ffceb2ab4f76c84334c99528e99c1edb3588fe40ad79c7b0de7f2c1bacc11906711f787f85a4bdc21c497f86116649eee2cb1b8f1995db7c421bc1d696
- SSDEEP 12288:AlmvjtFCpfme+mTcCSfg505CyCChUUAXPTMJZEkhDo1wsbT:Alm6QewCSfg5qCPUAXPTOk1
- TLSH T1FAD423CF46DC2C14FBE65433BA736E5EB6A1CD665B00AA15E4E1CB851C32610E7EF284
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 863KB
- SHA256 58c5a18fd1242ef4e27b62f1e0a15e05c9e9124fe44c5297a141ce31644c9140
- MD5 705b5ffc37616e6f797d8777c0697fa2
- SHA1 876b29459e4eab583107f698f8cf5b98b784a0b1
- SHA512 a226e4c5ca2e61d4209d1bce04d8ebee33fc4dab671cad1cb329443730d513e1a39a5ea3e54dcc5222b252e69c4b6fefaafeb91362d15f4d646cee61b7f8b19b
- SSDEEP 12288:TeBNUbTVO86UWvjtFCpfme+mTcCSfg505CyCChUUAXPTMJZEkhDo1wsbT:TJIUW6QewCSfg5qCPUAXPTOk1
- TLSH T1EE15DF7BAE68FCD1C27A8DB95AA18600E77278314F11A3CBD175C30E9E235E05E7AC15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.7MB
- SHA256 6872e963e9d3aee34d4d57561b1d9ceca1c2b8c9805fabac39408b399c75154e
- MD5 fc5b5431ae88b10fa8e8c7518fcbcfc6
- SHA1 25ed614d69ef2bf0a1b23dcf42d8c44517adb737
- SHA512 ac04447592344d87185711ff0e779dc35b2b385fa056906d368473cc8f0bafdc82075fffba2c8082aed6995d373b8c5610a474d956bd80ba5d35e3fb7ae8f9e0
- SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ99DN5J8NRV3TH6:jQvGAdlCEL8c/9RNw5C9b
- TLSH T1ED367C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 932KB
- SHA256 1f246aee420cc85f77f52571a570a5a32883e4248604766ce755c0de9b1a3986
- MD5 9e335cbe66c5f2553a471832a0340646
- SHA1 b5c27e094f1e08f8055a1d6c6bc8372befad68e0
- SHA512 59fc6afa8b3f4e03cce0fb30140a124dd106af77ca2ed876afe3c72a3434a7459ae6d6982200849c96805207c72e16f6a234c3f8afb4cca3a03f7cedf9c850c8
- SSDEEP 12288:2WwSfxL/2Dc3bDLLmt0LDQewsAjBvjtFCpfme+mTcCSfg505CyCChUUAXPTMJZEb:lmewsAjB6QewCSfg5qCPUAXPTOk1
- TLSH T1BB15E031FEB8E436C7BB0DB21B36D71A547DA9204F511AC3E3E88E8D59302D12776A16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 cbf4cc05e5d31d136246f8e5b0bbb316af30b8fbe4d11aa1644eac7e627a9a31
- MD5 61bd3a7c49970952d1c0f8f813732b61
- SHA1 dccdd0634c7fc1161e133ba16f72a4eefb556ea8
- SHA512 d53eec367f5e29c2a3afddb2f315153afafe2b42d682f74fd44aa006b58c1d0937b4e4ce381eb99fac98bcdbdbec6ba655154df370b7100cb1c278bd210a2e2b
- SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyXFldPlbuJH:lUEtQevvqc2W1cpV2XF32
- TLSH T1A9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 a036f6125172b7b59750ab54c979e2b571170e638fce995e16537936f959e471
- MD5 6fe0ed849b92f9f935234a81a58e6eb1
- SHA1 a15ca62f82457f367920d95bfef7f51603eca81a
- SHA512 d06dba815a4285dc5bdb86ea8ed3797d062bd5efa40ee01654294003a04ca8e6365b9a1b2a37177e3dcb8feb2ac287f468a07f39dd7eb77b690cb04ec110a21e
- SSDEEP 49152:L7bRquA/m2yL5zMfFiV+XenmE3/ziyDjj/j:zoq1VjnmEb
- TLSH T1B9D58D0A76B881E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33BD58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 c02715e2ba8f3bdd6abef245cb30dce274a4007a0fd153cdf28b2c2ef794bd2d
- MD5 f279a4ec017a962f648390531a1770e2
- SHA1 ba84c113de02ecfad614b70b27ca1d48b2ad04f8
- SHA512 9b7e50dee9755f3f6d74eed7f5a229c9e8b8ef913724037da9ea496af4eabbfbf7c8c431cc44652ffbc44dbd154c08e7f5235cf52850f9f0436dbd9f0e49fc96
- SSDEEP 24576:RAhGLvhFoiwtA5l7S53+N6QewCSfg5qCPUAXPTOk1:RAM9Foiq5uNyDjj/j
- TLSH T12B459D81E7F955D4F5F3AA7899B69571EA76BCA65E31C20F2160C20F0E33E409D24B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 829KB
- SHA256 244b662a969a28cc8b89c7caedc28cf79101b965c4613049df3f0ec518db505f
- MD5 bb3396e4461ab21769f073aa8ecc7b86
- SHA1 be71580022f1427d73ee6c0221b27ad9b148622c
- SHA512 8c06d48e1d5b139e57d90b2df95829be7120a8539ee427619812554e6a43fa4dc9e24f8e7c599bb1adf2a250bb9eea69247bf0eaa83633ca4e25aeccacbfd293
- SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+Cequ2za7mUDttbs8lTf6hJcj048UcCY8MqOYLGOR18+:uwuuOW8uOaBBtQ26kIfOR1JQt
- TLSH T1D405F14676A90CF9E5A7923AC5578136F7F3B8112A11CB1F13A0C65B1F37790AE29B20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 679KB
- SHA256 3a5ee69abf286ee07b9712febf54791c92acffe3aaaf28be0cc435089164ad26
- MD5 a916acaba389975110f13fd9c6403aa0
- SHA1 bd705f572140a3cc4c07037b137f7e396618db96
- SHA512 6fdb556c92bb79b75de860e0fe84cfeee6e744aaaacc7a488093c1e55d409f3ea75132c4ffd8469cc2033e341b90d65e08e3597e637e260a0770ddda521724a9
- SSDEEP 12288:90j1ISzvjtFCpfme+mTcCSfg505CyCChUUAXPTMJZEkhDo1wsbT:ejuA6QewCSfg5qCPUAXPTOk1
- TLSH T1D0E4128F22EC3478E6A3513AD9F25A49E7B2B867173183CF51A086552F23BC15E7E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 96310495554909e8195e065cb2ac417108e158b6e1e0c9f750ac6a7139776ed8
- MD5 928757fe88cc918b80d45c4a6505b4b5
- SHA1 9c274289a415970178bfcbe3a0fed6484aacc0a9
- SHA512 611f8dd3c8b46548ff50897056ccbf31abdd178f22edde8f328ffa795784c0a8017d7af716b1c6430cd5de6308c0168ceab3d3b5de81fd341920525df09ca760
- SSDEEP 49152:P56dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Uy:mQRQyi36YOcP8Lvw2gAf+PN3eb
- TLSH T14C667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 a1c08595065ba6780b5290bd4ed49badc724646f72ecee36af3466c5281e9138
- MD5 32e1fce9ae8310ec689d93f900dab8d8
- SHA1 5885682a387721236f7b04ce5d2e6afc43480698
- SHA512 f1b4a1cb95342b067b7a76e7ac9b66ed0ef1d6926dde8259c01ed99dac6375ba19c2d0064d76c8608f1206f7835e145074b3422902cb0862fea40ba8fc439365
- SSDEEP 49152:P56dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UU:mQRQyi36YOcP8Lvw2gAf+PN3RSb
- TLSH T186667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 551691ad68088cb341c636b7bcad4f104ca341480ffb616ae697c617c8b6b5cd
- MD5 d4a883012288811003785df0db35e8f7
- SHA1 d930e1f86051d134c2bb12800bc542d61c020c28
- SHA512 299ed6b4111074b1beba59af431797504b9eed57b04009809a092b2e8396a6730593a5d70bd8b14db2c63760149051649d6eb726a3588a69d662f20020e97a09
- SSDEEP 24576:FwvbGf6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0pH6QewCSfg5qCPH:v68Qg55nhMeWu7PNU3/6HyDjj/j
- TLSH T195B55933B2F600A9C44DE1769F4A872196D27C758FE0E3DB855172061FB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 83f53b6bbce3661f4adda67a6ef3bec898cb2f67cf22c94f5473a67bb15e90d1
- MD5 42cf3cc7a50d597aaf51da861b061e03
- SHA1 070952a61420b6d25d051a1ffbb6b1a3fcb7a1b9
- SHA512 dc3a5c1f2b681c822cf4848e960638dd39ad83c36e14f47fa151e1b051e409fa5d9448cb6bf0973ac9b4676d22e7d38d3d31589fc04a9aa70cbff5235d44f653
- SSDEEP 49152:t3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99c:8y5112gYy5azzVv569nLKnhZrb
- TLSH T159167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 ae7f9d8762ece2664b363d426b29cf158135c1cb2926b3711d3bca8e3e66c709
- MD5 f75ccf229a4a272161daeac0c7e78f00
- SHA1 53aca681d08d628141a4db1e4394902658a0dd1b
- SHA512 fc7e101a7e95f41a47209954a67e25f04dcf328bcb49dce1125053628b048abd51f198d5a50f72d3c2801b460bc98550b34da4ded9a745dc4e3cc77ae4f81d7f
- SSDEEP 49152:3q+taZ3usBWOBr4tEGp0bqx0z+n217aau1glkub0n61+t:qu6JmTxd2dkVn
- TLSH T176D59D13F1DA01E8D06ED179974A9233E962BC490B34B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 cb23e218caf758c1694288f901f8f4a833c460fd5d0df7138c9d05cbf48735c5
- MD5 c74223446ba9dd141004388dfdefe3bb
- SHA1 aaab53e0fb7fc832fddda6ebc341123835c4b268
- SHA512 b624086d2b57c7e6f32737640f2267c0bf45b6f3509659adbf6d86d8de2fb20de3568e3bbf6f62ee9a707d98e9ba38ed5afbd3534dacd186019f2094211c3ed7
- SSDEEP 24576:shv/E1hps0+ogd2z615uCMVF1Agz6LUQ1zNOgLLwH7ReaQXx3B6QewCSfg5qCPU6:f1hpsNoJpF1A6UU44CwH7R4xxyDjj/j
- TLSH T15EB5BE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 211d42b6915eec11fd951911f30a7aa9b6b5702513638ddde673ae6fa72d91a4
- MD5 ef7820786e27cf4cdeaa9ae3be102742
- SHA1 47484b9d3949b568b977ee0b5da3c231cb46c805
- SHA512 37ba3e055846ecee15c9c36f0af734863c2c6c5438b22bff7cf5e0a40bfad727482f7a86fce86a2c0ffbd8e0cef35972b351ccd9f10e129e2ca78936be82502f
- SSDEEP 49152:eSuZQIY0Be2K6RVtOnks6NMHqByDjj/j:w5dKoi61Wb
- TLSH T1CCC5BE03F2E900E8E0BED6748B669636EA72BC464B34A6DF064072551E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 cd104e93bd362688188b965b9a93dc95cad9d6772eff33807956ee35b5569b61
- MD5 161eedfa0c64473f9981a86a6c8e5230
- SHA1 a96a8942e496a4dbadeb52ea1a86999ac38a19b7
- SHA512 3322a540b504ce5f37515010f854a043379e68023094ec624e8b9b739527b2f05acba01f7d6041234a054cdbfb34e1d5908a8d45d53e30ab6ad349aa6823b555
- SSDEEP 24576:3OiavrPSLT8EARn+FgyUgd0fJY6BTi3iy9CTn0AP5+2QLj6QewCSfg5qCPUAXPTv:3OJSn8EApI0figTgiDn0AP5wXyDjj/j
- TLSH T14FA5BE13F2D900E8D05ED175C7568632EA62BC160B34BAEF0A90B7561E7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 602KB
- SHA256 4981c6938bc49d067e56d6726733819b8c05b3094f2af74e1474a59ee0d8caa2
- MD5 82399c266a6462ee8f5ae3549af65727
- SHA1 37d020a5d50e7c65318d985f92624a7775d2c1d3
- SHA512 80468f4f697279aa7ebed6ae1ce2fe266c25467297cc39cf8276e684761008a83a5ab06cfc6c981dedd177669944d2956ea102a00c636330712c15c2d0268bd6
- SSDEEP 12288:TwvjtFCpfme+mTcCSfg505CyCChUUAXPTMJZEkhDo1wsbT:Tw6QewCSfg5qCPUAXPTOk1
- TLSH T1CFD423CF45DE1C14FBA19473AA732A4EF6A5CD5BAF01AA29E1D1C6012D2371067DF2C8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 602KB
- SHA256 75037d38ad9bd16f1635b923185324f8c841c4e0c18728f4fb4917faad4ab82e
- MD5 6445f1445154975617e1a4ddd4c5b0b0
- SHA1 57ee63a83a54047c34fb231abcc1037c96710a33
- SHA512 27d02edf6489186020b11b2ad95a1dd7da2a4fa10550ec39a349b9b6e292a9ba495572281d69597ba372549c30ff27daa54a9a3ec4fbc017d0c53ce7d68cdaee
- SSDEEP 12288:FpvjtFCpfme+mTcCSfg505CyCChUUAXPTMJZEkhDo1wsbT:Fp6QewCSfg5qCPUAXPTOk1
- TLSH T1B0D423CF45DE1C24FBA19473AA732A4DF6A4CD5BAF01AA29E5E1C6012D1371067DF1C8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 602KB
- SHA256 ca1ca56e9d9c5c9e5ed71fef8c3ac2cfc570ff7252ec679ca1b66530d43e6f58
- MD5 9651a06239629932cd5b4a9e16732730
- SHA1 7e2943cfd0d70eead20518ebfd661b214d1b5014
- SHA512 1ffdcb0187609b4b2d182f2fd9352ee337590bdca7a916f3c888cb67ca88a176b19281d433e4d85f88cb8af607e335b104aadb2a26fcf9e82ab9f68e835a8061
- SSDEEP 12288:7qvjtFCpfme+mTcCSfg505CyCChUUAXPTMJZEkhDo1wsbT:7q6QewCSfg5qCPUAXPTOk1
- TLSH T19BD423CF45DE2C14FB919473AA732A8DF6A5CD5BAF00AA29E5D1CA012D1371067DF2C8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 623KB
- SHA256 7de34f9a009719f3d7b0a7a8a0701979741ba0ee36475dc003e0899dd970e9c1
- MD5 a6534283fdc6500e180e25cc97c8a84a
- SHA1 0ad48de8e40b40ef3ee6471d059b858e02821ebc
- SHA512 a755fc9d064e3b6ba749d3d5b2ab4e01ebc1e20db7973c64ea15ca463ffa2746438071b388cfe575ecd57c4f063a8640ec8a3ae639d17f57bdd7a9aced86108d
- SSDEEP 12288:mlEvjtFCpfme+mTcCSfg505CyCChUUAXPTMJZEkhDo1wsbT:V6QewCSfg5qCPUAXPTOk1
- TLSH T122D4238F07ED1810EAA2D177D9732A4DF3B1FC579B21AB1FE590CA451D227006AEE784
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 602KB
- SHA256 1feb9c6322a6fa897c29ab5b4b12f5c7664150bef10f9d4db7c679b6493f3c8f
- MD5 7c9d22d547a3c77afe4fac0da699530e
- SHA1 88d23d76a6220ee608e4cafeb74ea0ef807b85a8
- SHA512 745236a0e6711261280ed81ea77e8673fb92177565cdd2e5b5efb5b8ec69b087d9e671a87c336e0e27b7c53753830666f7aa3f42d7ea95c91c52baf037bef341
- SSDEEP 12288:6tvjtFCpfme+mTcCSfg505CyCChUUAXPTMJZEkhDo1wsbT:6t6QewCSfg5qCPUAXPTOk1
- TLSH T1BCD423CF45DE2C14FBA19473AA732A8DF6A5CD5BAF01AA26E5D1C6002D1371067DF2C8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 602KB
- SHA256 975e9d6cd82f37263c91b5ecadfcfd9356b6fa42f5a619c9769ecdcd63e9fd3d
- MD5 11ceb65264229ab33fb1f47fc1537dd4
- SHA1 40db67bc8494121f9a0cddf76f4661313453f639
- SHA512 6849349a93d74f95c477ffa1eaf57f759ac29633cc194a4e5293e21b8cd7c3383cb3c3b5cbee5584fb3d39fb002b4a1bc9021e027c59b5ae916d9de9a1c3026b
- SSDEEP 12288:JYvjtFCpfme+mTcCSfg505CyCChUUAXPTMJZEkhDo1wsbT:JY6QewCSfg5qCPUAXPTOk1
- TLSH T1D5D423CF45DD1C14FBA19473AA732E8DF6A4CD6BAF01AA29E5E1C6012D13B1067DF188
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 603KB
- SHA256 bee0f9e53e3df4874e5393c5a5219a290bcdef1e781f3a34c4f4c0e87b081b8f
- MD5 cc9c1d2187bd93aa8700938bb3253c03
- SHA1 7f19a7db6d9214523aa503623f8c3217e00d7f6b
- SHA512 9541287d790ffaff770748492d2f7f6dedbf3bddb209ca4264fa9f29fbfbfc381b8a5fbdf0d59a71bdfd83ead78315772e7e88cbf631d9c77ffd8558a4738e0b
- SSDEEP 12288:As6vjtFCpfme+mTcCSfg505CyCChUUAXPTMJZEkhDo1wsbT:AV6QewCSfg5qCPUAXPTOk1
- TLSH T1F3D423CF45DD1C14FBA14473AA732E4DE6A4CD6BAF00A666F5E1C6412913B1067EF2C8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 864KB
- SHA256 6ce65214038cad77b214703cfde63e4fed9983304d4b380167e4234a1df70ddc
- MD5 808b0f74e6fe9be2cfde2d48a7284e62
- SHA1 42c89fa1e55f9d55b6696c7897394b733d616cd3
- SHA512 df756d5ce514c5733bc62c5fd17e493bfe7ec338eb6e9178e88877980860bb41252d1e294e871198cd700fd24a3d4926eddba256e17344c005d8a72e9de06eec
- SSDEEP 12288:uiZwbVAzFKES5cPvycvjtFCpfme+mTcCSfg505CyCChUUAXPTMJZEkhDo1wsbT:RZM6zFnS1c6QewCSfg5qCPUAXPTOk1
- TLSH T1CF15029A73941CF4EDA3813ECD22990AD6B2BC5A0B60C61F13F476561F333601D6EB99
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 603KB
- SHA256 88721fcb5b6dfacd2e3e63e8282c7576c4398fd0456ce75760ca7ab839e7f3d0
- MD5 42b16baff07adfbb07c58145fdb213bb
- SHA1 e4cd0919f84105aa79b76867297473de88e0ba46
- SHA512 f12cba74200ab97dfc934fd9c36967b2c94ef2132c700e56e50d8dbbc242498cbe88f811bbe531c22e6563d0136169814479521d9bb0ae66e997fa4b9fe6d7f1
- SSDEEP 12288:U7vjtFCpfme+mTcCSfg505CyCChUUAXPTMJZEkhDo1wsbT:U76QewCSfg5qCPUAXPTOk1
- TLSH T12ED423CF45DD2C14FBA14473AA732E8DF6A4CD5BAB01A666E5E1C6012D1371067EF2C8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 603KB
- SHA256 430141ff065c2a1e243f2f570640f0725a6b2910d7b829d51652e5ab8b3dd2b5
- MD5 279eca72486342f2188bae3f53b34bdc
- SHA1 c42d6c35c20c6d7f6cc3226e9e4aec0677151483
- SHA512 1908d3c22a933f72f031e1a4e2c243ae322e94c804be6c62a56e0295e19bcb7b8c900c6425f0289758c8a2b182c2c956842764eaca9cdb89de581597488179d7
- SSDEEP 12288:uKXvjtFCpfme+mTcCSfg505CyCChUUAXPTMJZEkhDo1wsbT:uc6QewCSfg5qCPUAXPTOk1
- TLSH T1E6D423CF45DD2C14FBA14473AA736E8DF6A4CD6BAF01A666E5D1C6012D2370067DF288
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 740KB
- SHA256 d77ec85bc56df0d1637a9abf5343729a6594dc4cb4d9b2a94dc6bb8a3216ce89
- MD5 45ef6e79e50d3e56f0d75c2592577dae
- SHA1 91ae242e48a9a6d384b6d43fe23d2cfd8f8c5183
- SHA512 3e856746d6b8d05a61bd3e479c6928bfaffd72ce249b48256dfa2600d90d739f39ebd6519a45f83754239c17db667bb49f2078900d1d153c78368c441b8be874
- SSDEEP 12288:KxPV7LJgyvjtFCpfme+mTcCSfg505CyCChUUAXPTMJZEkhDo1wsbT:QV5gy6QewCSfg5qCPUAXPTOk1
- TLSH T1DFF4024B63E930F8E5769135C9731A06F371B8364B209B6F53A087762E23750AE6F760
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.1MB
- SHA256 d3618257f7d6b9e8b33d358be070d0440b200e5f497c33a6197761304cd68cfb
- MD5 512cc023a27d88b01e010e95ee2da67e
- SHA1 877690fe59e8f02529f6cbc59071bdbd578e1aa9
- SHA512 8a7665c6bd2fc84c240ae53b5d6aa14a919d5bc4b1372fde16cbb26282bf9aa32b714ed0b7a5542463c0c5a169a7af3d41fa37fb057b52bb5c9d95c2bf0ee00d
- SSDEEP 24576:/swvtk9RX6wkyAIyuOaBBtQ26kIfOR1JQt:dMnYIyub0n61+t
- TLSH T1C635DF29EBDC44D5E1B7D23D99A7460AF6B178691B31C2CF129A43AD0E33ED05E39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.6MB
- SHA256 51a9769720d5cd3b7578b4bdc9de0695317c24f1c756aee3d14a150ec4766aa2
- MD5 fadbe8c6e6b7dba8ffa79aade01c8c87
- SHA1 1476e1d1cd619859fa8e3055598b56f2a57170b7
- SHA512 bc64f55cebea2b4294c02e38d2861d0c72f160e9298808e5a4fd7e5e2853e0709ad30250ec78fb6c798b7623816bf388ff001d038712a87ce698b4fb9efe8247
- SSDEEP 49152:6YLlNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Eub0n61+t:FySzP8Vn
- TLSH T1EB067C56A16841D5C1B9C1B98F1BCC1BFAB134090335ABEB03E546935F6BAF0AE3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 1c9fbe03489bf674269469b88a7508162ef2aea037c4055fffdc9c2a8955c0bb
- MD5 74ae31cd595acb1746200fa4c503fc7a
- SHA1 0a958eb063b1e9c4a5b490bd872e28adc8b77482
- SHA512 8698ceeb7263775138c583c34a0dd6c0756f9f0079702c565303b396ce097d97ca38d6fd1d4708125b476c8fa2a25ddee88f5599b34d84b0d9017db8c7be720b
- SSDEEP 24576:4K7Jb1aQZRXLfOrIhnjFN8rnDHU2+fF/AYBuOaBBtQ26kIfOR1JQt:4K7JUQjXirIhCnDHUPfF/Xub0n61+t
- TLSH T18C65AE1DA3EC01E5E1BAD27885154A5AEA71742E1B31CACF22B0837D6F23ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 722KB
- SHA256 5318312792eca7bf063d16cef6b9bb527c47a0df1b30cb9039b118df6e3f2eaf
- MD5 b0a1df42d9b3243f62aa48e3c83ce527
- SHA1 34d38897d9d12d6e1a19dd5b7b3179f3a52aa57e
- SHA512 22af972ce0fedda0d3121c15fdb103f57253321f20306b9c35e316b683dffffff5a4be3a2eb0bf9ea4004b0089da5eeeac4bfe15e441132f4634ebc0c5a327af
- SSDEEP 12288:b1LfnvjtFCpfme+mTcCSfg505CyCChUUAXPTMJZEkhDo1wsbT:hn6QewCSfg5qCPUAXPTOk1
- TLSH T176F4014EC29811A8D1AE6176CB625A45F3737C2687E1D3CB92D0F53E1F326409EEA743
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 610KB
- SHA256 f0b57d4b34379ddccee5b5dd2d687c6cff2304b82cccb244273356f696098584
- MD5 0b3328171b6fba8e3b4b1dc770214945
- SHA1 be86d8433aa051c09be313b166dd17e7f88c4242
- SHA512 0b7db12c88b55bef99c75e3488fe65b83d7d3780d07b082e9c716a17838510f90bff47c23c899840a598d1b97646c00702e9a4c87c5f543581ec886cda6fe861
- SSDEEP 12288:sC7uqu2za7mUDttbs8lTf6hJcj048UcCY8MqOYLGOR18aSA6+Mk81t0:jnuOaBBtQ26kIfOR1JQt
- TLSH T107D42301F66E8C86F1F5E27FB51F1225B4AB27719A0046AFB796C6A61837FC06F11B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 e32e629c9abaaa992e2b6a7b5281008f453d4407081c85c2296d9a80cc7e6774
- MD5 8baf2f5ea4e7484cfc1e19b007c5556d
- SHA1 858949da9adfa3fb998e031f4c4e8139027b2653
- SHA512 af7eea11610f7aa74cc092653909229399685c81dfa7183eddbe998596be159c55ac55bced64e94d8486956ccf755c5489b80f35b9ec5692c2f2b15a7db69001
- SSDEEP 24576:Tgb6bmBIi49WNNFpg1rSvFv7bYEuOaBBtQ26kIfOR1JQt:Tgb4mBIBhGF7ub0n61+t
- TLSH T13C65AE1E22EC02F5E0F9E2B8DDAA4417D6B278160731D2DF1251426D2F3BEE89D39B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 664KB
- SHA256 b5555ac3ed9a64f6d5bc89599b5d51089340fd7a1d6cc6638150eabc6b9ba065
- MD5 9e0cb798ffd5aa90b2983e92cf1b968d
- SHA1 e284da313bbcad4692675890271509e7e5faaf06
- SHA512 a35b686267aacc508ddea3fb9283520c8280ee020ceb5064d7ce64c6759a6ee86fcc3744187779cf4a210a31f4f3677246c07b5d614fbaaeae5cf70113df608c
- SSDEEP 12288:0RGVWXqu2za7mUDttbs8lTf6hJcj048UcCY8MqOYLGOR18aSA6+Mk81t0:AGVWauOaBBtQ26kIfOR1JQt
- TLSH T1B9E4120575BE68C9D1BAD27FA82A2167B8B23670970006FF27D2C1761D26FD06B39F50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 628KB
- SHA256 4d8da4897762dbcede9eaeaf8c6f11d760cb53ab759cec4488cdbaa27a3d7344
- MD5 13ec8fcea5eea068a8b4a846f3c5fe69
- SHA1 d79aff6166b09fb7c6c049f84e08338434277a23
- SHA512 c328960be7f107066c6a6308ff7979cc89f57a0c4f87222e19e9edd265bae8b25ff66e3f20a160db2aaf78d6cd5d6bb69b43728ffb6e66eb7aa561e56ad01375
- SSDEEP 12288:7uqu2za7mUDttbs8lTf6hJcj048UcCY8MqOYLGOR18aSA6+Mk81t0:7nuOaBBtQ26kIfOR1JQt
- TLSH T115D42301B56E8CCAE2D5E27FB51B265AA4971731970507FF7397C2A2182BFC06B31B60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 f2b93b2c8d9e8e313bc15633ec2af2754dac9b602d82cc46ad173fa3ad01a7b0
- MD5 3336bf4c8089cd42a799c940261b59fb
- SHA1 d6979045587ab3271c8d8534fdc9ef388af56361
- SHA512 c61e6f0d4bd2ff4ff2f65da62168afa3f8c5ed73cc4f563abe93469c96bbe4faafef40c172733b2909e17897d54e46bd08d0c7ecf5d40021c423f33e073cd21d
- SSDEEP 24576:o2U8Z88lJqH1Taria7/mVuOaBBtQ26kIfOR1JQt:XzC8bqVLa7/Sub0n61+t
- TLSH T1CB35F161B6E501F1D4BBE13989464667F6B2B4211364EFEF07A88B511F23BD44B3EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 832KB
- SHA256 bec27faef0725b4c5539c5504e6132446ed75f5190b75609a722beae88be1258
- MD5 6e03455055ef3626a909a4a58e05e0e2
- SHA1 9773d420e95ce98fd1379c8167f570b8ca1192bd
- SHA512 7c571df1126de068fe87481aab8bbe54868ca132a7b3c2cd834a4e80952cbfc015f3e4afe6522018c4ee3ecd3f8130fdefd9ba138ef536fa6cbf45a66f73d290
- SSDEEP 12288:aHvUrBFrEjwaQo4Fqu2za7mUDttbs8lTf6hJcj048UcCY8MqOYLGOR18aSA6+Mkr:aPUr+NQo4kuOaBBtQ26kIfOR1JQt
- TLSH T14105F11B72AD1CE5E6BAE17D99464709F7727462130292DF03E1817E0E27ED8BD39B20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.7MB
- SHA256 af4a62f8f15395d473001b80000fadded2ed826ae86545081b113eb8396687c0
- MD5 0abd4945311c844de32c9e363c018e32
- SHA1 e2fc559c5c82690d90d183c332ad7f5764e25971
- SHA512 af2d4fecae4be03d5ef095f0b85f1822b5425fd47a6e23659786b45bf7c16f22266bf881b3d244f5207c0d5f19b69c6a3ed34c8a8da13d4e2ed76a412af04011
- SSDEEP 49152:rBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjzub0n61+t:0G05lO43bOVn
- TLSH T1ABD5C06A62FC01F9D1BBD17CD9C6460BEBB23425032556CF02A486A91F27FF46A7E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.5MB
- SHA256 302a25523a94dd0d594faa7128ac7f477ad452b77ca5345b353fbded874f1bfb
- MD5 deed30e225e27166e99e85bb2650a0ca
- SHA1 13e9911bb6d679547e857f01a0104f95f8c369a1
- SHA512 e48fb02e2de4e548fad025d6ffe43893f4c4a776dd433bfab63ea91f53f8bcdd9ac292e39be89abfe6964bf04a2c68986ee9775b69be427f73cdfd46bee7f414
- SSDEEP 24576:cNa5POZ3dpbWVM50JicR2hG0lasx2+47eidnruOaBBtQ26kIfOR1JQt:ia5POZ3wJt2pasx2+mRub0n61+t
- TLSH T1F265AF5EA6FC01D5D1B9D17DC583461AE5B2342253319BCF122182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 fc992c4a290ca9079da6de577afcb846329761c0735dc2529d17f7537bd11f46
- MD5 b9568e6d4ca834c6f6c278a65eb3a572
- SHA1 73845a83f44c131e12d842fb3e0219e0f7c31095
- SHA512 52357522dcfead1326705ba666682a6f5fb23a23554c36b5e9898b47a46f7464b78617760db71c2d4fc006cd473391a7f1972317abe10522ff4c5c9649534b9d
- SSDEEP 24576:FNcwHdjbyQ4nLC18lb/EOjowL7FkOuOaBBtQ26kIfOR1JQt:FNc/zEOVHFJub0n61+t
- TLSH T106857C1623E901E4F1BBE1BE897B9546FAB1786553308ACF0291851B1E73BF45C3AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 936KB
- SHA256 c7b30ab1156be72f4ce13e32b732fd7d63fd7c6060b051a09ba90564f33e68d2
- MD5 27215ee3862f4de3a8513b6b4e5f8f82
- SHA1 0250a45cea846c1b619d1f128cb9c130d61891e0
- SHA512 c30992a09a13dfe563e3aa8cd70dc0688c9ef2e0750cf4793d5964d2c6f10a20388facb8379cfc05129b18507916ac50804accd0acabe4af4879ae364f3c2af8
- SSDEEP 12288:w3HPJnJP6szeCs6Rl28dr6Uqu2za7mUDttbs8lTf6hJcj048UcCY8MqOYLGOR18+:2JnJPbzB4S6uOaBBtQ26kIfOR1JQt
- TLSH T1AE15E02DD2A810E8E4B7C2B5811A175AFE72387D2F1169CB29B4D5353F12FD0AA39F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 06562e9d3ae09e5279d7e154fc1624cc301300cb04a6fb20cdfebae922e3271d
- MD5 1cc60f681a0e3521cea9ad57674ea9f6
- SHA1 980eb2e9c5e17c69cffda5fcea5467c2fb010447
- SHA512 c265656a2ed07f86661d0be47c1d0e2f8ef02dab2c9d2b94298bbb81ffd582d2b6c242ff254d00fc1fe3a2da36a63879f9f8b0ec3ba8a3edd286fee2c3d44858
- SSDEEP 24576:H/CLHGL0MoeVtFumTijCmlKQWDkzuOaBBtQ26kIfOR1JQt:H/CLHGeeV5ijCmlDWDkzub0n61+t
- TLSH T1D5A56B05A7EB5184F8F3CAF5CA2694169A327C549B34F7EF4A80C96A1E32FD0D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 780KB
- SHA256 bde09e04876f35f2c1e18137be0cfd10d0b86c1da3622667d7e9733ccdcd1ae8
- MD5 a79a1c2898a05be2718f1cf33e3d802d
- SHA1 eba511da40d91c41e0dfc53f49fc3a0bd671bd76
- SHA512 518166094c5dabd97a4bfc4551fffb97a2b89ae19539b1c58c90b238af1987f8804430ce5cfbeaa22eaac602e681a15eed0d0ddde3b88a0084befabbc010bc8e
- SSDEEP 12288:S1H5kmj5ZI77Diqu2za7mUDttbs8lTf6hJcj048UcCY8MqOYLGOR18aSA6+Mk816:JmDIfDTuOaBBtQ26kIfOR1JQt
- TLSH T1ED05F10D737A10FAD1ABE03E95430512E1B2B17197121AEF17D5C5BA5EA3EC8BA38F40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 764KB
- SHA256 fabb489db8a94ac4776240bd3632ac56b54b32258620387f74b97bb2e021f8eb
- MD5 d6f9328bdeb3fad1c1f8e388e79bac74
- SHA1 46954ceb1b326bc4b9c96f16c9e4889c3970a6a1
- SHA512 c2ee73e9de84c63d00e45f22bbc59d95d81d41dc188e5005e8ce9da0ab83da2db7ef4cdefe6d4943c5b546aecddcdde581f4597cfa22a8fa5d8be56dcd62e10a
- SSDEEP 12288:mG6kyiqu2za7mUDttbs8lTf6hJcj048UcCY8MqOYLGOR18aSA6+Mk81t0:vtyTuOaBBtQ26kIfOR1JQt
- TLSH T11AF41200B3A994C5E2F9927AA9270265E9767D309B0147EF67D1D67E2D37FC0AE30B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 636KB
- SHA256 15b393a71fb7ea0d86da4fab61b190158e3ed77b948ef0daa9f3815287fc2760
- MD5 a3746e53f4002edc1ec17380d73e04d6
- SHA1 ab39417f39d06b85c9bf5f20465f6f7bffc878f9
- SHA512 498174c6e95dc191a328be43b53400bd25a9952ed9ec884d37c2eec4806d8c033b5f79f6af789201dfc99b4e112cdd88632403e12b30cdc7dc9d16bfcd088984
- SSDEEP 12288:T/zqu2za7mUDttbs8lTf6hJcj048UcCY8MqOYLGOR18aSA6+Mk81t0:rOuOaBBtQ26kIfOR1JQt
- TLSH T1BED42301B66E98C6E1D5E27FB51A1656E4A7363197010AFF77D6C6B2182BFC06B30F10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.2MB
- SHA256 87ac0e9e15f17a16e73c01d635731f305678fdd7fce64434974ec33a3b4e73e4
- MD5 79b1502c4331c4e1305a6bd7de1038e3
- SHA1 e0e08a90bd61f8d7ab221e78342693e6b8a13802
- SHA512 9c87ff99ddab70d29c8b400e12651ff8bbfc0e39a6eebfb94a26548a68042cdcfebfe68098484134d8bbba0508e750b3920cee127839707d694786df7a6480ea
- SSDEEP 12288:V1gGuZyFDK3tT5Tr7aVLIH9lH3cVqu2za7mUDttbs8lTf6hJcj048UcCY8MqOYLf:V1gGLoTfaidZ1uOaBBtQ26kIfOR1JQt
- TLSH T135558D1D77EA05CAE2B2D279D8221493D633B4315772C6DF2548C03A4DABED8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 796KB
- SHA256 cbad8e72c396a069abc846bf15a977a3d154973526c85147b2c0d6abec19ea49
- MD5 68de2a0ebbd484e503181b2e9040380e
- SHA1 a1be9898d3c8e76a1cba984f7405e66c4d0f4b11
- SHA512 6c255088737424f9239d2c20165085a0e48f0b976219ebf36af6f60950daf23a1fb5918a31e743bb2a82cbe77287eb45f21e359d52e8a443a5fa92ecb1c3a387
- SSDEEP 12288:MpJcm8CNzqu2za7mUDttbs8lTf6hJcj048UcCY8MqOYLGOR18aSA6+Mk81t0:MrcmROuOaBBtQ26kIfOR1JQt
- TLSH T1DA05F10AB6AE00E6E1B7D27DC8460656F6B37031670257DF12A2C77E4E27AD87E34B50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 0d5bac84083587cd1cef43c0d83e56190549505bb723122608378b74c935ed2b
- MD5 190c651e2fbc942ff1d5e786dfc2525e
- SHA1 e8a0f17664322e6873e5e25a7790a24ff3da156e
- SHA512 6ec9c21851992f55d97d6d192f2c83cf1b62587acef3d9bb31510d304c89bcc43112df71792b085d7d5439082df6787d479bc31e4784ede58ffec44fbf841bea
- SSDEEP 49152:0DL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3vub0n61+t:x3Upow8sBOVn
- TLSH T118A58C3DA2E800A8D9AAC379C54213A6EA71742E3F3015DB0174C578BF1BEF19A39F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 7c1daae4f655a3aa49f18490259a92e9b163cd7fe02ec03a6496a242d4d13802
- MD5 2d2f5a9732b4b172b89d9ba1a40ecf5c
- SHA1 a8139490c4f1e0defd1b79fddf3a95f1bd3e96c5
- SHA512 54e15d18ad2b7c14d2c7636b60010f393404e73a0c928fad8629eaa9113b7cc129ae6bece115b33b3d67d3912b22b9c6b0c120fecf6ae29c901ffec385a6496a
- SSDEEP 24576:FTkNvNnaFeYhJNtmZBmzuOaBBtQ26kIfOR1JQt:FTMwBtOmzub0n61+t
- TLSH T1B655AF2EBAB846E4D1FAC6B5DD238512EA727461173253CB5390C13F0E279D89E39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 992KB
- SHA256 ba53a279467e4b324b8ddeeec25c5061f999b021f42fcf5acd0d27a89b7350fc
- MD5 5e18064cb4c0000bd25c1617007fe05d
- SHA1 52ad99b254bcfd94aabdce630df87d607544b65d
- SHA512 a5b70b106d35e202da2f3657505d4466acb30c92d7c0c65198fc02efdf01948446167937e454a02ec37731c525b6a0492f022e207a7ea187421257295b177f2b
- SSDEEP 24576:/D3FHshBIYQgAPuOaBBtQ26kIfOR1JQt:/DVHeBIAAPub0n61+t
- TLSH T16925E13DE6AD04E4E57AD1BCDA634A06E67238A9032156DB12D4C1B61F2BFD43D39F10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 772KB
- SHA256 27448e14b1e08635852c27e053889e6eabfd9636984b99712abc6c45ee031f41
- MD5 885ee7e12ebd0a3dbfc8e6bfea8ac32a
- SHA1 56554441767e4cc2b46a988db23147be4fb1610c
- SHA512 6a7456b96aef741fd462d05a1973b4edb6721cb8e45f10856a9e91ad7e5f1f1fdc9412c50175d314347733a799441f13f04a6472c58eb214ae9411abfef76e75
- SSDEEP 12288:yyN6b3IkxjbBzRqu2za7mUDttbs8lTf6hJcj048UcCY8MqOYLGOR18aSA6+Mk816:r6Uqjp4uOaBBtQ26kIfOR1JQt
- TLSH T1C5F4120976E958D9E0B9D239E9260126D4B67D32171506FF33D9C67A0E37FC09A3AF20
- MD5 SHA1 SHA512 SSDEEP TLSH