ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 06:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
Size 1.1MB
Sample260823-hfhslseq51
SHA256 ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa
MD5 706e2920d2304ce992f1267d3ee5b234
SHA1 eeab876f809382a31ff56fb057756737d60d770e
SHA512 d08d553d1b354d2d4f2417b0664f40a1e434f9ced528a4852c972c150271363e0cc874c5e86d5111a7c118d8503a74fc3f3a1477553f548c48b267c0f037edef
SSDEEP 24576:KHeWZZFFeUHFmlNIW4ZV8vBcGXhGfZZNVv6EbWDbDcbr:DIFF/HF/V8zROZ/DbWDkbr
TLSH
T1EA35F1C5BF5181B2F456133AC5666B327EBABA323B2392C363400E796E317C25D35B19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4292	alg.exe
1652	GameInputSvc.exe
2804	GameInputSvc.exe
2524	elevation_service.exe
5232	elevation_service.exe
4876	maintenanceservice.exe
2080	msdtc.exe
5328	OSE.EXE
4648	PerceptionSimulationService.exe
3060	perfhost.exe
4512	ReFsDedupSvc.exe
6016	locator.exe
972	SensorDataService.exe
3412	snmptrap.exe
2744	ssh-agent.exe
1912	TieringEngineService.exe
3940	AgentService.exe
3700	vds.exe
4264	vssvc.exe
5004	wbengine.exe
5736	WmiApSrv.exe
1488	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Windows\System32\vds.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Windows\system32\msiexec.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Windows\system32\locator.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9c812ac1c618523d.bin	alg.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Windows\system32\AgentService.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Windows\System32\alg.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Windows\system32\vssvc.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Windows\system32\wbengine.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Windows\System32\msdtc.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaw.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc152d6cca32dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c977266dca32dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000062fecc6cca32dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a29fa6aca32dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b0b5dfa9ca32dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000384496dca32dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008289166dca32dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081bfe06dca32dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ae08f2a9ca32dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
2804	GameInputSvc.exe
2804	GameInputSvc.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
Token: SeTcbPrivilege	1652	GameInputSvc.exe
Token: SeBackupPrivilege	4512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1912	TieringEngineService.exe
Token: SeManageVolumePrivilege	1912	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3940	AgentService.exe
Token: SeBackupPrivilege	4264	vssvc.exe
Token: SeRestorePrivilege	4264	vssvc.exe
Token: SeAuditPrivilege	4264	vssvc.exe
Token: SeBackupPrivilege	5004	wbengine.exe
Token: SeRestorePrivilege	5004	wbengine.exe
Token: SeSecurityPrivilege	5004	wbengine.exe
Token: 33	1488	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1488	SearchIndexer.exe
Token: SeDebugPrivilege	1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
Token: SeDebugPrivilege	1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
Token: SeDebugPrivilege	1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
Token: SeDebugPrivilege	1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1812	ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 2804	1652	GameInputSvc.exe	91
PID 1488 wrote to memory of 1792	1488	SearchIndexer.exe	112
PID 1488 wrote to memory of 2440	1488	SearchIndexer.exe	113
PID 1488 wrote to memory of 2516	1488	SearchIndexer.exe	115
PID 1488 wrote to memory of 5056	1488	SearchIndexer.exe	116
PID 1488 wrote to memory of 4948	1488	SearchIndexer.exe	119
PID 1488 wrote to memory of 3876	1488	SearchIndexer.exe	120
PID 1488 wrote to memory of 4912	1488	SearchIndexer.exe	121

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe
"C:\Users\Admin\AppData\Local\Temp\ef9032e704123b42dd538aaac280d25558b381b1e693ef6f23e72fd6bc9ab9aa.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1812

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4292

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2804

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5232

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4876

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2080

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5328

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4648

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3060

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4512

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:6016

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:972

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3412

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2744

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1912

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3940

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3700

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4264

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5004

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5736

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1792
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2440
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2936 2928 912 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2516
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2716 2908 912 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5056
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4948
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2716 2908 912 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3876
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2936 2928 912 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 467eaa6d93654c2b5ac74d278b26f769360bd313553ec119f35be35ebe0f1550
MD5 116b9a915ac1c5c43e0ad2e6a5cfb004
SHA1 6286481f608dd0c5ac619d05f1551b6049380107
SHA512 d6c4444f414eb3cf692f88395b05e5cfeedcf77f9c1e7f78a89386724cd29b7a395d032bc2211ed25260b10031241640a3ea3beeffb12473a9aafe7ef4a7323a
SSDEEP 49152:ab+632BuPkFKRrdE6oh7stBhuXjfS4LWxn0V8zROZ/DbWDkbr:M3q6gjBrWK+De
TLSH
T108D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 d5024dd8dc23466298fa69bab975a0d9cb61b2ce5e2ac6802c9b888cb91806c1
MD5 61e114a253ff081cecedfa48ec08e508
SHA1 d0662164eae53071555c7a0587fec6408f118e1e
SHA512 3d9b5a9b3485e27e3f9d59c4bfddee952a6b3f3c2006ac3db50645605d7d27b9c84abcaa0ff00cedaa1601f73cc0711a53e922fba2d502eec9129ae838b807df
SSDEEP 24576:7XY7DiczAAlNIW4ZV8vBcGXhGfZZNVv6EbWDbDcbr:aicmV8zROZ/DbWDkbr
TLSH
T1FE05022C77A009F8ECB78279C9B28101D673BC5587A0E7DB03F489651F236991E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 c3f87f1bab85362952fd9a05bca95b12dc12f81db46de1efbaf1ae02f7342e3e
MD5 956922e7a066d365e05f5a44922540a3
SHA1 38d8ccb4d4846e7d8ace9b9fcf6c9e8da19f6488
SHA512 50ac4154af5425709136dd89f9fd3a10c17d121e9c2696a4b672f752f451df668d7f991d1bb266cf445486fd2da6f49eeb54a3c30e10ec0c700ac68546b28f70
SSDEEP 24576:UwusOWelNIW4ZV8vBcGXhGfZZNVv6EbWDbDcb:UwfOeV8zROZ/DbWDkb
TLSH
T19805F14A76A41CF8E5B7523986978136E7F3BC052A61DB1F07A0C65B5F332226D3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d50a97f8738529b3f70e84db3e52d54c0fddc7e21753a5af3ec10cafed8522fe
MD5 2439af40b515dc4b250794c96cc24511
SHA1 d2679c503d847efbeb6ab45d5b1e4d0f18fa8622
SHA512 abad8c7089d0d0bab9f6883d5527c6c2aa280417ffebaefc163a2966bbdf573bc805a51c13b1958da2e4fb0bf6e60d309c767f0444b0e3a8459a971d4bf2346d
SSDEEP 49152:BQ+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl+V8zROZ/DbWDkbr:Gu6JmTxd2doWK+De
TLSH
T119D59D13F1DA01E8D06ED178974A9233E962BC490B35B6EF0A9072562F77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 5867566f7d761652fc8df1ab90406f38939590d723f266c030ce07b6771fed6d
MD5 d099de8be55c27114aadbf3a70c562ae
SHA1 0866a73a422afcef5f817231bbaa019114fc3650
SHA512 6d138737d8757c888d66532fb9e4942e44f861e68d0f02a3a43a5b81f7584db8bd15967c405f55479394181590862403aeafdc1ec0721560d990aebec958eeed
SSDEEP 12288:KU7h8qlNIW/gZvqaNaBvbvpeU4LGX79GfBzL1NYav6EwjmWFx7PHjUdbp1:TLlNIW4ZV8vBcGXhGfZZNVv6EbWDbDcH
TLSH
T180D4231EEA251968F0F9227102BA4115447FFE6DCF8097EBED9508A26BA1C534E35C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ebe78d36ac872b85b01957312611f37b0ba01b96a47710a843153a03f19c9ab2
MD5 0035409de6a9437ebd32300f33acbe49
SHA1 cf19f6c7424ea859c0e80290d97a099c0fb5de27
SHA512 2fec43a7369e6532259e4bedc9bf3f6f1ccfc211ee05d1d3c97c851e540323507ea8ee60dbe50973eb14d7779570070f412f5502ea6a17e7f22868fe0b1260fb
SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bYdlNIW4ZV8vBcGXhGfZZNVv6EbWDbDcbr:Kgb4mBIBhGF9V8zROZ/DbWDkbr
TLSH
T14A65AE1E22E802F5E0F9E2B88DAA4417D6B378164731D2DF1251427D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 98aab44283ae617d3b3f7b7c6afd6bee61f52e3ac85d675995486c08da21b598
MD5 7ed4317ec9e2372e0e37557dce90af17
SHA1 3031a7772a132c30d7fd44e0ced69b937b90f3f8
SHA512 edea3724fc3851c698479a94e1b34ee6523c16f0bf3ed5d7967e7c354d6c68cf14bb38b782e7802b0e150c112846860c0a8cd03df0645b1925956f55bba51151
SSDEEP 12288:xaGXP8qlNIW/gZvqaNaBvbvpeU4LGX79GfBzL1NYav6EwjmWFx7PHjUdbp1:8GXtlNIW4ZV8vBcGXhGfZZNVv6EbWDbq
TLSH
T1D2E4222E797531A8E0F9937185B60107B8B6B968CB4027FF8DE544719F91CE22B38C79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 538e950ba2221bc4e11f2bfa8fabc3f87f2510362fb21428b1f83e3f2d0d82f2
MD5 8b0d62b0f0effe7227193989b1424a4c
SHA1 11a9ecbc1171504c09487bf59c40380847902a2d
SHA512 8986049bf0dd30064d27f8629bc07e4ce962e265d036fba2db7cb4ad75864a13b41d77bd33295d5f356e154c05940b408764493848148a079fa033b61458dac1
SSDEEP 12288:dW8qlNIW/gZvqaNaBvbvpeU4LGX79GfBzL1NYav6EwjmWFx7PHjUdbp1:dilNIW4ZV8vBcGXhGfZZNVv6EbWDbDcH
TLSH
T1F4D4231EB9251578F0F9237142B6120544BFFD2DCBC517EBADAA08A25B91CE30A35C7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 8948e6de460b42ce027401c13ed68e9fc7f8272906e83151546da95f184eed74
MD5 9ca091d4569eb871a9a5e6dad999e3da
SHA1 55ad2dcf96d329b01084c8ea0f9d577e521db9b8
SHA512 89e8bcba02cc2ec203cd961d7a58f5cfe42c8b1c8214cffe5ddcb432389854e848a341a7f9615ceb847b4dbbc74615302f6c1a6b0b7ce819556568bc5b73b213
SSDEEP 24576:o0Y8u8FpJqH1anrUa7/m3lNIW4ZV8vBcGXhGfZZNVv6EbWDbDcbr:RnZFPqV/a7/DV8zROZ/DbWDkbr
TLSH
T1C835F26577E101F0D4BBD13889964663F6B2B8250364EFDF0BA88A511F23AD50B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 a993dc149f99878937cff372525b9a7611b557c1649107b1b97dadb193853fbf
MD5 b7eb093342bf67bfabf5aaacb330d789
SHA1 a33c2548ed3dc1f91d2a1d38d872039376e5a970
SHA512 171186aa4f04572ed3e22f681ec64699d93da772f83b5020ae32e6e2276a0eff3498a0aef516813a05c8c68ef3b51d35816e8ff89db5e633ccee82052a4f6f1d
SSDEEP 24576:YPUr+NQclNIW4ZV8vBcGXhGfZZNVv6EbWDbDcbr:YJQtV8zROZ/DbWDkbr
TLSH
T17105F21F76A818E4F6BAA17D85924309E772B866471293CF02E0417E4F63DE87D3DB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 3c4059a756ca23d459c6deb16c6e1345f125ebbc60a5381f594c39ea48624f7b
MD5 06a9196652af29b15a3560c24ef91e73
SHA1 e6f51e621ad4e0f9059f7d21077f67c9cefac0ec
SHA512 4a72fe6df5f9a979f3d85e62ad3dbd0894a68f6d314b32ae3a250c7b634d1756932df42e670933a439b2e950cf5c8245f45a19c528eb657f42e83381c20b9b86
SSDEEP 49152:zBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjuV8zROZ/DbWDkbr:cG05lO43bzWK+De
TLSH
T1C1D5CF6E62EC11F9D1BBD17CDAC6460BEBB23815032556CF02A486A91F23FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 8420630807441bbba09271637690440a342960a9a0c8e0bb7b4adf3e08a64b02
MD5 4e124962cccb4f067d8d535eb1a2227c
SHA1 1ce3532e973c064fa4bc64a6f8df8928d0c8099e
SHA512 cd051b0c90606051edc201350e77ab3ff53ee7390cc410a02606e892f20cd6e7b0b93ead8e55ec7268be11049778a6465781e6455263bc34fa0cc6b61127fe09
SSDEEP 24576:EOa5POZ3dpbWVM50JicR2hG0lasx2+47eidnZlNIW4ZV8vBcGXhGfZZNVv6EbWDe:9a5POZ3wJt2pasx2+m6V8zROZ/DbWDkH
TLSH
T1ED65BF5EA6FC01D5E1B9D17DC583461AE5B1342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c84e149a56a552e80c779283b679791bd8f30806e379863b308abe96bfe688e7
MD5 d2055b83eda603c183d77f284902958f
SHA1 73f27ad3777fb80621f401fe16c61817ecf8d01e
SHA512 b509e6b9c6c5aade962499112ba0dd10a64de4a7a026902009ee6a256593d2b876eb81345e6e617dffeec925ca29b19caddb54f704c26411a3141d041e3e9c16
SSDEEP 24576:gNcwHdjbyQ4nLC18lb/EOjowL7FkLlNIW4ZV8vBcGXhGfZZNVv6EbWDbDcbr:gNc/zEOVHFDV8zROZ/DbWDkbr
TLSH
T1CA857C1A22E901E4F1BBE1BE89779546FA717869533086CF0291851B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 0ae776c90865d0eefa28a0d846f24df029ffd1b6262781a6718bee4e9e93d28f
MD5 8026eb183eac2c924fe4134d24dd829e
SHA1 0373c870f4342e7475aa5b22f865fdd81593c851
SHA512 2abc384d06212ff1c38411831ab8a7a769223bae242d7b450be53808746554ceb12389df60a111a0adb70492d3ca3cb69ae025dad8d77d9a5545d28c70c54be0
SSDEEP 24576:vJnJPbzB4SNlNIW4ZV8vBcGXhGfZZNVv6EbWDbDcbr:vJnJv6S0V8zROZ/DbWDkbr
TLSH
T1A315E13DD2A810E8E4B7C2B4815A175AFE71387D2F2169C759B4D4353F12EE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 1a8cd0407ff27941fc66e7c81f74079487e8a1065b5263ef914d0db9177a47ac
MD5 ee4c54bad70754df1ea410f3ced60e68
SHA1 c9cc8b4038ccdcbe531ded5745c94d04c0629393
SHA512 c319fab72f57d905bb62d718f9b34c4b7844babe5b2c1445a045de08cd53222d5080cb4f3bca4df52b11f4dfe706da84475fd9400ced413732719e67a7961c3d
SSDEEP 49152:PCLHGeeV5ijCmlDWDkaV8zROZ/DbWDkbr:aKWK+De
TLSH
T191A56B05A7EB5184E8F3CAF5CA2694168A327C549B34F7EF4E80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 91d061b61995151e0f08d7be438e1396345523a04e4faf0d7104a970e3bf278c
MD5 139518ade8138b6b29461ab4b5e74cb8
SHA1 8ae6986b9d3356b0519545022a66aa3eedd78e43
SHA512 8e037792cc444b91ef7fdbf9549379fabf972a5319ff89290c9a97614029e192d923a17162231239b3d98462d7712362bb54e249ebec1ab2d5478bd459d4566f
SSDEEP 24576:P6DIPlNIW4ZV8vBcGXhGfZZNVv6EbWDbDcbr:P6DIGV8zROZ/DbWDkbr
TLSH
T1E2F4011D737A10F9E0BBD03A86930102D1B2B475C7521ADF4AE484BA5FA3ED9B93CE51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 fd6057f56eb070f14d02b88675fe18dcc1e1ca47f71c8b1e4d70aaaa27652d41
MD5 7c54b099a49170cebc6159001050b583
SHA1 13c7504dae0b6a16af4d4f0398fc8266cdd92eac
SHA512 6072700856985ddc119bc054cf35fe0c3cc0db0c086b8799ca48e6ed13390872f2a937147f04120dd56877bff5ae2ae2a58e6ee0e5ed2d7094b21d3d816c5a4d
SSDEEP 12288:lG6kyss8qlNIW/gZvqaNaBvbvpeU4LGX79GfBzL1NYav6EwjmWFx7PHjUdbp1:ctyLlNIW4ZV8vBcGXhGfZZNVv6EbWDbq
TLSH
T1CFF41209636420E8F5F912748AB342518D7AFC24DB5153EF59E1893E2F72BD26D30F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 002edd4017d351e57712c1d41d3a32d339ed30e5334e4b403f1efe9d0ffefeac
MD5 3456f1c5b98a1bc813370b39151941f8
SHA1 35d446ce8335c90735b201126a277f723d5de3db
SHA512 5a817d8bf45679c5b7cc1cd9b40723ed9399bcf32ac6eb03b14e1aac26ed10e675cfb3f22fc0b4703fd44509d36946252fe328ebc92d93ed29242d261abfa12b
SSDEEP 12288:D8e8qlNIW/gZvqaNaBvbvpeU4LGX79GfBzL1NYav6EwjmWFx7PHjUdbp1:IKlNIW4ZV8vBcGXhGfZZNVv6EbWDbDcH
TLSH
T1CED4231DB9252578F0F863B142B60206847BBD7DDB8217FFADE508B29B518D30A35C3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 424ac2da7d841bb534f73ca79a82779d27612b7b06fa6327e9252da5c94daf58
MD5 9ba2472cb9aaf07d269d07a39e05bf90
SHA1 774e25b3f018d1eee2ca6f922fea0f25501ba574
SHA512 e7cbca47107174eb066c2d96e7c4695e2cfd72e7a195cb1dfe03e243818b751686b33358e6a5a300553097cad46d8c272c8ee3fecf8a907966e68347445c41de
SSDEEP 24576:MDgHLoTfaidZ6lNIW4ZV8vBcGXhGfZZNVv6EbWDbDcbr:Gg8TrZ7V8zROZ/DbWDkbr
TLSH
T1E7559D1DA7EA05CAE2B2D275D8721493D633B4315772C6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 6982872a85bd250b00446ac69863bab625d5a8244c2ff468a42406e032b1dfe5
MD5 0d8adfeca5020b4b72899e10877b6e82
SHA1 d74e519ab68fd3009764b0d029632677cd34a09c
SHA512 a487683c67ae5175ee6692e8626406b20023de80427205a68a65696fb1bad881784d672538141a89c20d96366b8d3d04a0d3c8badb0ef44e4992ff6257c668b5
SSDEEP 24576:6rcmRYlNIW4ZV8vBcGXhGfZZNVv6EbWDbDcbr:8cmRBV8zROZ/DbWDkbr
TLSH
T10F05010EB26E00F5E0B7923C89920206E6B3B434975267DF46E1877E4F539EA7D34B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 c42899b190ad5998e697c54225f510f5c075e1b963c18edaa3cd4578559cbccc
MD5 167326c03846aa3fa092722cd4349229
SHA1 2b9f93e04136a736e877223b383f5cb512d81a54
SHA512 1d0192d4b8b5b23c4743df10c60adf066f5e8204a700ea1fc8fc1232e3a1da0d76778d30c8ed82ddb13fb8bc26688e61d551374c51eb7874f3bf7ec0c9b08ef7
SSDEEP 49152:QDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS31V8zROZ/DbWDkbr:93Upow8sBAWK+De
TLSH
T1E1A58C3DA2E800A8D9AAC379C54213A6EA71782D3F3015DB0174C578BF1BDF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/972-136-0x000001D9CDCF0000-0x000001D9CDD56000-memory.dmp

Download

memory/972-137-0x000001D9CDCF0000-0x000001D9CDD56000-memory.dmp

Download

memory/972-239-0x00007FF61C300000-0x00007FF61C716000-memory.dmp

Download

memory/972-135-0x00007FF61C300000-0x00007FF61C716000-memory.dmp

Download

memory/972-216-0x00007FF61C300000-0x00007FF61C716000-memory.dmp

Download

memory/972-237-0x000001D9CDCF0000-0x000001D9CDD56000-memory.dmp

Download

memory/1488-224-0x00007FF7DB460000-0x00007FF7DB79E000-memory.dmp

Download

memory/1488-223-0x0000021C153D0000-0x0000021C15436000-memory.dmp

Download

memory/1488-225-0x0000021C153D0000-0x0000021C15436000-memory.dmp

Download

memory/1488-251-0x00007FF7DB460000-0x00007FF7DB79E000-memory.dmp

Download

memory/1652-31-0x000002B4AB2C0000-0x000002B4AB326000-memory.dmp

Download

memory/1652-63-0x00007FF6F8050000-0x00007FF6F8118000-memory.dmp

Download

memory/1652-28-0x00007FF6F8050000-0x00007FF6F8118000-memory.dmp

Download

memory/1652-29-0x000002B4AB2C0000-0x000002B4AB326000-memory.dmp

Download

memory/1652-30-0x000002B4AB2C0000-0x000002B4AB326000-memory.dmp

Download

memory/1812-1-0x0000000002450000-0x00000000024B9000-memory.dmp

Download

memory/1812-7-0x0000000002450000-0x00000000024B9000-memory.dmp

Download

memory/1812-6-0x0000000002450000-0x00000000024B9000-memory.dmp

Download

memory/1812-0-0x00000000025F0000-0x0000000002780000-memory.dmp

Download

memory/1812-23-0x0000000077C20000-0x0000000077C30000-memory.dmp

Download

memory/1812-24-0x0000000077C20000-0x0000000077C30000-memory.dmp

Download

memory/1912-165-0x000001A3FDED0000-0x000001A3FDF36000-memory.dmp

Download

memory/1912-163-0x00007FF75C0E0000-0x00007FF75C274000-memory.dmp

Download

memory/1912-236-0x00007FF75C0E0000-0x00007FF75C274000-memory.dmp

Download

memory/1912-164-0x000001A3FDED0000-0x000001A3FDF36000-memory.dmp

Download

memory/2080-76-0x00007FF750790000-0x00007FF7508A9000-memory.dmp

Download

memory/2080-78-0x000001DABC090000-0x000001DABC0F6000-memory.dmp

Download

memory/2080-162-0x00007FF750790000-0x00007FF7508A9000-memory.dmp

Download

memory/2080-77-0x000001DABC090000-0x000001DABC0F6000-memory.dmp

Download

memory/2524-47-0x00000244AB8E0000-0x00000244AB946000-memory.dmp

Download

memory/2524-46-0x00000244AB980000-0x00000244ABAAE000-memory.dmp

Download

memory/2524-48-0x00000244AB8E0000-0x00000244AB946000-memory.dmp

Download

memory/2744-156-0x000001B222D10000-0x000001B222D76000-memory.dmp

Download

memory/2744-155-0x000001B222D10000-0x000001B222D76000-memory.dmp

Download

memory/2744-154-0x00007FF6AFF10000-0x00007FF6B01B3000-memory.dmp

Download

memory/2744-222-0x00007FF6AFF10000-0x00007FF6B01B3000-memory.dmp

Download

memory/2804-38-0x0000018D76F20000-0x0000018D76F86000-memory.dmp

Download

memory/2804-39-0x0000018D76F20000-0x0000018D76F86000-memory.dmp

Download

memory/2804-40-0x0000018D76F20000-0x0000018D76F86000-memory.dmp

Download

memory/2804-37-0x00007FF6F8050000-0x00007FF6F8118000-memory.dmp

Download

memory/2804-94-0x00007FF6F8050000-0x00007FF6F8118000-memory.dmp

Download

memory/3060-191-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3060-106-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3060-112-0x0000000000780000-0x00000000007E9000-memory.dmp

Download

memory/3060-107-0x0000000000780000-0x00000000007E9000-memory.dmp

Download

memory/3412-219-0x00007FF741010000-0x00007FF7410C3000-memory.dmp

Download

memory/3412-145-0x00007FF741010000-0x00007FF7410C3000-memory.dmp

Download

memory/3412-146-0x0000014375AB0000-0x0000014375B16000-memory.dmp

Download

memory/3412-147-0x0000014375AB0000-0x0000014375B16000-memory.dmp

Download

memory/3700-188-0x00007FF744980000-0x00007FF744C0A000-memory.dmp

Download

memory/3700-184-0x000001D946DC0000-0x000001D946E26000-memory.dmp

Download

memory/3700-183-0x000001D946DC0000-0x000001D946E26000-memory.dmp

Download

memory/3700-243-0x00007FF744980000-0x00007FF744C0A000-memory.dmp

Download

memory/3940-182-0x00007FF743010000-0x00007FF743330000-memory.dmp

Download

memory/3940-177-0x0000025B89540000-0x0000025B895A6000-memory.dmp

Download

memory/3940-173-0x0000025B89540000-0x0000025B895A6000-memory.dmp

Download

memory/3940-172-0x0000025B89540000-0x0000025B895A6000-memory.dmp

Download

memory/3940-171-0x00007FF743010000-0x00007FF743330000-memory.dmp

Download

memory/4264-192-0x0000019656D90000-0x0000019656DF6000-memory.dmp

Download

memory/4264-246-0x00007FF711240000-0x00007FF711710000-memory.dmp

Download

memory/4264-194-0x0000019656D90000-0x0000019656DF6000-memory.dmp

Download

memory/4264-193-0x00007FF711240000-0x00007FF711710000-memory.dmp

Download

memory/4292-18-0x000001DD59CD0000-0x000001DD59D36000-memory.dmp

Download

memory/4292-17-0x000001DD59CD0000-0x000001DD59D36000-memory.dmp

Download

memory/4292-52-0x00007FF6B85C0000-0x00007FF6B86E2000-memory.dmp

Download

memory/4292-15-0x00007FF6B85C0000-0x00007FF6B86E2000-memory.dmp

Download

memory/4292-16-0x000001DD59CD0000-0x000001DD59D36000-memory.dmp

Download

memory/4512-201-0x00007FF7FC910000-0x00007FF7FD053000-memory.dmp

Download

memory/4512-118-0x0000014F05940000-0x0000014F059A6000-memory.dmp

Download

memory/4512-123-0x00007FF7FC910000-0x00007FF7FD053000-memory.dmp

Download

memory/4512-253-0x0000014F05940000-0x0000014F059A6000-memory.dmp

Download

memory/4512-255-0x00007FF7FC910000-0x00007FF7FD053000-memory.dmp

Download

memory/4512-119-0x0000014F05940000-0x0000014F059A6000-memory.dmp

Download

memory/4648-97-0x00007FF7299F0000-0x00007FF729B39000-memory.dmp

Download

memory/4648-99-0x000002113FDD0000-0x000002113FE36000-memory.dmp

Download

memory/4648-181-0x00007FF7299F0000-0x00007FF729B39000-memory.dmp

Download

memory/4648-100-0x000002113FDD0000-0x000002113FE36000-memory.dmp

Download

memory/4876-66-0x0000019457A50000-0x0000019457AB6000-memory.dmp

Download

memory/4876-64-0x00007FF6CED80000-0x00007FF6CEEE8000-memory.dmp

Download

memory/4876-73-0x00007FF6CED80000-0x00007FF6CEEE8000-memory.dmp

Download

memory/4876-71-0x0000019457A50000-0x0000019457AB6000-memory.dmp

Download

memory/4876-65-0x0000019457A50000-0x0000019457AB6000-memory.dmp

Download

memory/5004-247-0x00007FF754820000-0x00007FF754D26000-memory.dmp

Download

memory/5004-200-0x0000026902300000-0x0000026902366000-memory.dmp

Download

memory/5004-202-0x0000026902300000-0x0000026902366000-memory.dmp

Download

memory/5004-203-0x00007FF754820000-0x00007FF754D26000-memory.dmp

Download

memory/5232-57-0x000001268CF20000-0x000001268CF86000-memory.dmp

Download

memory/5232-56-0x000001268CF20000-0x000001268CF86000-memory.dmp

Download

memory/5232-55-0x000001268CCD0000-0x000001268CDFE000-memory.dmp

Download

memory/5328-88-0x000001FD141C0000-0x000001FD142EE000-memory.dmp

Download

memory/5328-90-0x000001FD14410000-0x000001FD14476000-memory.dmp

Download

memory/5328-89-0x000001FD14410000-0x000001FD14476000-memory.dmp

Download

memory/5736-217-0x00007FF647260000-0x00007FF64738E000-memory.dmp

Download

memory/5736-211-0x0000019DA9510000-0x0000019DA9576000-memory.dmp

Download

memory/5736-212-0x0000019DA9510000-0x0000019DA9576000-memory.dmp

Download

memory/5736-250-0x00007FF647260000-0x00007FF64738E000-memory.dmp

Download

memory/6016-128-0x0000016CA3600000-0x0000016CA3666000-memory.dmp

Download

memory/6016-207-0x00007FF7CDE20000-0x00007FF7CDECD000-memory.dmp

Download

memory/6016-126-0x00007FF7CDE20000-0x00007FF7CDECD000-memory.dmp

Download

memory/6016-127-0x0000016CA3600000-0x0000016CA3666000-memory.dmp

Download