d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 15:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Size 8.9MB
Sample260905-tcsdesvthx
SHA256 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a
MD5 554ddf0a7b0af3a4a423008e0b60aa67
SHA1 308b901858bb10ab09f4a25bc44d0ab1822b84c2
SHA512 c566317f9d1ac02cd816c9bd3a72211d8632e1df30b8f358b010c4b0dd48ace940d5328d87b21ed609db6d268ac2771b85aa8a2416e95cf4312e489d1d866977
SSDEEP 98304:PIBNooU1GgK+rvwkieXjg2g8Y1r3DFG4Acgmgx7aS9:PIkoUYv+7wkiEjpg8kr2cZgtaM
TLSH
T1EA964C24E601850AFCB700F79AFED95D305CB6605B2C50D361892FFEAE696E23D32593
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1240	elevation_service.exe
3956	elevation_service.exe
6100	maintenanceservice.exe
5584	OSE.EXE
1152	PerceptionSimulationService.exe
2428	perfhost.exe
1880	ReFsDedupSvc.exe
1716	SensorDataService.exe
932	ssh-agent.exe
1044	AgentService.exe
2288	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Windows\System32\msdtc.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Windows\system32\msiexec.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Windows\system32\wbengine.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Windows\system32\vssvc.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9e55c599d744edbe.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Windows\System32\vds.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Windows\system32\dllhost.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Control Panel\Colors	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d4b513a4f3ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000019538fa4e3ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005db6c9f84e3ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f28615fa4e3ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000323810fa4e3ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe

Modifies registry class 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\NotificationData	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
1240	elevation_service.exe
1240	elevation_service.exe
1240	elevation_service.exe
1240	elevation_service.exe
1240	elevation_service.exe
1240	elevation_service.exe
1240	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Token: SeAssignPrimaryTokenPrivilege	1044	AgentService.exe
Token: SeBackupPrivilege	1880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1880	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1880	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1880	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1880	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1880	ReFsDedupSvc.exe
Token: 33	2288	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2288	SearchIndexer.exe
Token: SeDebugPrivilege	4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Token: SeDebugPrivilege	4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Token: SeDebugPrivilege	4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Token: SeDebugPrivilege	4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Token: SeDebugPrivilege	1240	elevation_service.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
4536	d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 1232	2288	SearchIndexer.exe	100
PID 2288 wrote to memory of 3724	2288	SearchIndexer.exe	101
PID 2288 wrote to memory of 2668	2288	SearchIndexer.exe	103
PID 2288 wrote to memory of 4112	2288	SearchIndexer.exe	104

C:\Users\Admin\AppData\Local\Temp\d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
"C:\Users\Admin\AppData\Local\Temp\d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4536

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3956

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6100

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5584

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1152

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2428

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1880

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1716

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:932

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1044

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1232
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3724
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2668
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 70a284875c56e94e90bb4214682efd6cfc08ccac417610b749783c208f71d28e
MD5 9a9d66a885090d45b6b5d76d947ff37e
SHA1 8ae57444eb2dcdeae37779a38a5a9edba2cbda2e
SHA512 4c75f0aec655c48d54b6e20f332e71a0f7e3c26730b803876b07a899a055bfc3bb6a0f50d77fbe9f6eccf8025d4888f0656a99d7ebf580501fa7155d18707a21
SSDEEP 49152:yb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnNgx7akmndO9Q5q:U3q60jBegx7aS9
TLSH
T1F0D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 d23e71f3f8bf330f351e74447f4cfac42fde0488e48781f7f3d0f08bd6a2db0c
MD5 0980d06b3c51598974e5806fafc211e7
SHA1 1b987d4dde6a509b010c666eb6d73a1b668ac039
SHA512 ef1d78904c17fe8fdccc919ff093c8ca3cf2ec219280cae61b36104e8b8c19cf6403cf48a3efe35fbf4314a6083c0cef1c61a6c098a0fd6d3d6844f242a1145d
SSDEEP 24576:cXYfDtczAM0wgLBv7atTeuDMYdOtfQ5qlXq:btcDgx7akmndO9Q5q
TLSH
T1CF05F12877E504FAED67823DC9A2C511D632B8854774EBDB03E4992A1F332C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 ed1e7c7c955d37ad3d900a24788941ff32a761c6f4cd2d8aaf0a799a02bd4d0d
MD5 c5311072093104ec40db361610b8eebe
SHA1 2e08ddc8fa2e680b565a1ac6ec9baa881f91edbb
SHA512 6656f8e931098cdb18e5d2407d30d3729ddccbd2853dbff39f9590b27b9576ff2ffd580843e568dcae00fe97e7155daa31897d68b9d700b58b49760c73e3a534
SSDEEP 24576:H0Le5ji0hmxNrML0wgLBv7atTeuDMYdOtfQ5qlXk:HPji0A7kgx7akmndO9Q5q
TLSH
T1DB359E16F5748332D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d5dfdc50e1c6ec1836a3c6cd3b7bdee4d418f9f0906b763f482b578fc9422a4b
MD5 d037495c57a999c07594db47d8267818
SHA1 6624d5cb7ebd656673af8ac822a32b3ef78b110c
SHA512 907ea0cc70351fdb4b9463717718c4aa551ff079c77793b9204ea3193c502c9f66b08f66fbb84a7655a887b8ed25997a1d9391474166bdf041db3284d98309bc
SSDEEP 24576:Ca7/ezSC6vUyD/aqgrvWr6q8wyut0wgLBv7atTeuDMYdOtfQ5qlXq:l/ezSC6vUzPviHjyQgx7akmndO9Q5q
TLSH
T1CB755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9462fb3416f964f5ab70cca71185d121f56b575cc190b3ae660dc1fb63d94dee
MD5 047ade89bf50b4fea84af4149ba100e3
SHA1 f8205557f89aa219ceb7d6a603b78ff4c6f1377f
SHA512 bda623c66d419e30fd179ae4e6991ba1db05e330fc984d573b1f08863a635cf6e1fbd870357bef7a9a5132fd503dc104d3fc95f37d1aa34954098a2566cc55b5
SSDEEP 24576:bVbqPb88hv/l+bI0wgLBv7atTeuDMYdOtfQ5qlXX:bVO88hXl+Cgx7akmndO9Q5q
TLSH
T16D559E66F5B48331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 0d63d486f66155670d909df7974b8641dda0278896660e39179d06610b738550
MD5 913d4ac4302410d2a8cfa46d98538e7a
SHA1 5b28eec2258cd9f335db3f1176e61dd9b7d4bfd9
SHA512 a642ccd3534a15e6353107bdf8bdc99e8aa6c5597d2cc6cbd86115fb260643867e2fe303f1ed4c12e691c454add6c1cd1615b8006eda985ad70501251fbff303
SSDEEP 12288:vjXzjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXuf:vjX0wgLBv7atTeuDMYdOtfQ5qlXm
TLSH
T18AC4238069EAC093EF574636F29AE1E5C5149EC54F3C6F6B68447D0E6CB858AF073223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 0ece391b5175d45f6fb01d8dbb5f0e90cfa14d3c8437e786386a0d3bc551552e
MD5 a10715eccc308f7dc9eae8d637b57575
SHA1 1c9f123390a1cd6a0f46226bca496659ff10ac71
SHA512 7bdc90675a2dbba32f01021f746e2945a9728fba247bc4ab4011b945f080587cff50a37596afa52bb6bf680b322a906e099430518b14153f587c9dba6523332e
SSDEEP 12288:meBNUbTVO86Ugzjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXuL:mJIUg0wgLBv7atTeuDMYdOtfQ5qlX6
TLSH
T13C05CF3BEE28FCD2C67A8D795691C240D77278704F22A3CBE164820EDE235E55D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ddda62dc82cf49601e2c82f3b89610da445ef544ebe8a905cf279ab132bf5faf
MD5 202370e1d8f453892a91f9930c82c763
SHA1 d3411e9d8e9aba39f6f7bc2440dc8059f51fc585
SHA512 91ad5c0e2aad72c75239f40d98aa4e3587a1dc7917b2a03b34b5611a9d592ec1f1e1e4270dc9619811b3ef23c873c95004c2c020b27fd544f911433d7a397888
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THT:5QvGAdlCEL8c/RRNw5Cjgx7aS9
TLSH
T1C0266C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 33028cf54b3d4094996aa6fddbee4a2f44a10d10cff9ddfa97683b9f9d0e8113
MD5 c8fa3cabb6b91e1071b68424c3ca679a
SHA1 53293c4ef8a51e4551fe0e9ec8bfb3c2ab597ffc
SHA512 c9d9bc6d71c0ad24044f7685c50068cf8e59610b3aaee965a58e2c6c6ba102e32f3d6dec5d0b6cbab76b5958cd276cafb1da3b804fa0c7b7dfb129d181c971dd
SSDEEP 24576:ASewsAjq0wgLBv7atTeuDMYdOtfQ5qlXX:zlj0gx7akmndO9Q5q
TLSH
T17E15E031FE74D033C77B0DB61B26C716542CBA604F612AC3E3A89E8E59742D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 adbd2d0f27547206c33546ac0a0923373a958368aab6ec420ca88248a571fa29
MD5 d4f2af0426c5325014bc8910364e74a5
SHA1 dbce5541cf2952727d0db41ab82c38dffb2a872d
SHA512 58e67a937463dc86a43357795b9aae78d3855ba527f39dbe405bedadd14ef2d146773780463c87e47bdae77eaae274f4086588340d6880d9b6070d9f20ded1e3
SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHsgtaM:eUEtQevvqc2W1cpV2RI32sg
TLSH
T114474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 adaaa05fbe02820184a882116855e3f6a7a11096a510757d48ca635fc4f9bd27
MD5 a6901aaea9b76590f42da6ef6253fc1e
SHA1 60f65c7b3082e8f1cfe30872aa7b7112e16e281d
SHA512 a296980cfc7701ff79001db2a6ad4a4f55fc0419625769a03c5b8a6dafbb230017292ea90f63db7853afaca00302e10352b187e660700d876fe32f6cb2a5ada4
SSDEEP 49152:vCbRquA/m2yL5zLfFiV+XenmE3/zUgx7akmndO9Q5q:ooq2Vjnm/gx7aS9
TLSH
T145D58D0976B8C1E4D1F6C77886A2C647F37178154B34ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5c87773eaa4da4f45a32f63bc5f750b7a7f3634d58a35e81933c0e9188795c24
MD5 c6b4a92243ba66f1cfa9d6a6ee012aa2
SHA1 d279f5d08bb9460d5d76a627a78577204db2a22a
SHA512 ba26972d655c9e1f331637f7f828344191fec785bd5977e11ac65afba69e9cba2a9ad1cecfda3e5eddbe8c5d9b9f58790f70c31e8229aee9e52707ef01e9bcfc
SSDEEP 24576:tAhGL2IFoiwtA5l7S53x0wgLBv7atTeuDMYdOtfQ5qlXX:tAM1Foiq5Pgx7akmndO9Q5q
TLSH
T15735AD80EBF941D4F5B3AA78A9B69171EA76BCA65E31D20F2150D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 2c64e5da49c1c96d4469b5460ad33e6c698f24920d9b6cd3920c6f6811e7eaf1
MD5 4a944f727dec08923e486542b14a8093
SHA1 d31b8686a47f3fb2af435d763f2d0bb28f836e5a
SHA512 df76498623b8e5a2d0feefe9405cbc8d6ac35d1007a37c16dee22eff634eee92eccb46ba591b72e616f945cd131a9158fd1fdbf1c01ce7efeb863b3f6d02249f
SSDEEP 24576:bwuXOWu0wgLBv7atTeuDMYdOtfQ5qlXI:bwsObgx7akmndO9Q5q
TLSH
T17405F14536E508FAEA678239C597C136E7B2B8022B35DB1F1760C61B6F37251BD3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 321d2b79ef88637404918261ec23ec71886efc70345b76eea9e7de0b0f7d4bb1
MD5 0813daa1dcc06a099b07dfbe798cfdc7
SHA1 56f98132804cee502ed8308f2be133b1b7bba240
SHA512 ba05822500bd9e657061c5c2537ba04fc520afdf1f77f4fa77ac5a5037edf08678ac098f7c8b5d47b274d006371f2b239b37013efc5f423395147a28dab85536
SSDEEP 12288:d/Z1Iyazjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXu9:lZuD0wgLBv7atTeuDMYdOtfQ5qlX4
TLSH
T19FE4238932E460F7E6A3823DD9E59285C37178921B3557CF2554561E2F33AC6AC3A333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c315e5d5575fa6e8902b3937f62296b2a02c2776416c7214abe8a8403e5bcb02
MD5 f8669e1049597e395ceb4e0d18be2431
SHA1 b2e6a5e59fe1ad63a61acde6a7d0ebe030fec3ed
SHA512 38830486c2d8ea9183faac3102c99ae89246dcdab06704f21c097fc5760e6cc8a31813f420b7a5df442c4b4959da31df8beb6d29a453d44a61b6f09bdb84497e
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uf:EQRQyi36YOcPhLvw2gAf+PN3Sgx7aS9
TLSH
T1FD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 59c884e9b30869d946c91a84a4e5c49450ad72bf3c31a2eaef4ec9d06aa3d349
MD5 3dec80a5d31783592948150d7b6a1d83
SHA1 87ada30ff085347efd0f936796a21d7f0e369c79
SHA512 cc365cac9638b90ae41309ad34fa275294d0c642d84cb027ef26bb4e318db517b62f94cf1bd74fdd5816e7b1d48af05798e3a701ab3201e77cec87a0a189857d
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uf:cQRQyi36YOcPhLvw2gAf+PN3Sgx7aS9
TLSH
T1AA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9e9bbd020bb905f13523398686d2e631a01ab090f764f26b3f9c70c10f0dbc1e
MD5 ab314d31ea09f80719db4d68f800b773
SHA1 cc7bd4cc63ef495e9e2a97706ba093cf0fc53271
SHA512 d1df7ca938685b63fbbeadfa5d5bbf51965a9c6110ac10e886b83db83aaf58ae00637253919accf2ae50af65c6f35cc819573e4e4ab76b035d4c8d3509073a93
SSDEEP 49152:r68Qg55nhceWu7PNU3/kgx7akmndO9Q5q:1thLRc/kgx7aS9
TLSH
T1F9B54933B2F600A9C44DE1769F4A873196D17C758FE0E7DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 db54579788fafe1274be0b858e5a9840574d40efc2e009ad2017f057c371072a
MD5 499aa7294c95ed0bbd6c4eaf2345ea65
SHA1 e69fcfd06c6fe3187ad9db18713889333319d81f
SHA512 9ac8546e34dbb32b8a68ff8e3e0f5184649a6abb1bd88851888a845c60059b902c18e4eadafcf152176a9ace4e8272b71a8272d9cdf8fbadbcef8e3dc12083eb
SSDEEP 49152:K3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99Z:by5112gYy5azzVva69nLKnhZJgx7aS9
TLSH
T16C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 da076247835b36db04f2b64f769709377b5eea9c32b45f29aae76fc125c288e5
MD5 aa9ec924fe62bd210d77e3ba502dfd88
SHA1 57fe3e672bf6129647122823746fe22fb0ff9145
SHA512 f3772d88c39e98531a6aab22fe46f391836f634832ed12a72bcccce428ead73bc17b2edadb6af7f473d1f7f3073e05037a088fea94b3f8ec3969ba5a4d1a2399
SSDEEP 49152:CB+taZ3usBWOBr4tEG20bqx0z+n217aau1glagx7akmndO9Q5q:wu6JmUxd2dagx7aS9
TLSH
T170D59E13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 58c9f289120e932477ebf1033b213e12b04d75b509e1084dba1ba7d902834236
MD5 747deacd98e447a2cad5d9eff3ad93b9
SHA1 cd195728e081eb10b295fdb61cf9e8a0118e7216
SHA512 446996ed6e04c666339b8b1ef08d84bf0b8294be5856bbe7417b6a07c039d47fe54e08b61e7b4c82397a4d46b2eac93fe0ed4e90c0c94c451fb45e84dad7facd
SSDEEP 49152:z1hpsNoJpF1A6BU44CwH7R4x2gx7akmndO9Q5q:zmifPkR/gx7aS9
TLSH
T137B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 021adc32854f34499040fbc95dd175ee5f89263aeee7c617eff6d216c3a3a577
MD5 be43976224a0470619d3f90fd71cb00d
SHA1 a0b897cfe4a31e956526c7d9d5ce7ca3e1f65dab
SHA512 26249c5ab702dfbf18b3c1ed82c643ea65d338dbe069821104145564d7c3903cb662933ee606e6012415d3c4b163f527c9086efd3efdbf6408024ebb0f944de5
SSDEEP 49152:gSuZQIY0Be2KNRVtOnks6NMHqdgx7akmndO9Q5q:65dKvi61dgx7aS9
TLSH
T140C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f472af5aecff8469e6dedf16c03a43dc05eedd6d89c51fd2d7bd568d869d760a
MD5 2860ae1740e56f8c7548bd578f95a9a8
SHA1 4273a1cf7d6b8729731ead2e196f7b455fd2bbd0
SHA512 cb77574eb5685a5513831ee0416462ce2fcdd0fbcaa5580a50cadd199590c46ac50622ff72bf985dfda865a8c9c37ee5245ff3cfc256b6418cbe9d8139974775
SSDEEP 49152:DhtSn8EApI0figXgiDn0AP5wqgx7akmndO9Q5q:iX2iyph7gx7aS9
TLSH
T10D95BE13F2D900E8D05ED179C7468632E962BC150B39BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 d605893276c98a3e35855e0893cce3bb9641b72a3f3581695e69fa2aa513f06b
MD5 f79c48a03d76d54c8ad203a8f6aed9dc
SHA1 fc6ad26cc36e1bb3b9bacfb9e03118c496a3be3a
SHA512 496af8eb274e4729ed978036e132c38fb652cddd18dd3e847e9b116bb7ab3b2fcb115e6256df305127dc68da0b6507b7d9a6df67cb2a03e937da26f1555aead1
SSDEEP 12288:3vzjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXui:3v0wgLBv7atTeuDMYdOtfQ5qlXj
TLSH
T1E8C4238478EBC093EF038636E296D2E5C5045EC65F3D2F6B7849780E6D7858EB077262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 24120ef3a7f4fe9d6b36b406b51373623527ef1da61d2a266fa38cbc048e0ff3
MD5 d6d1fb1a5592e41168a537d85e08f083
SHA1 d253fe6512c88c6bb8ea4fa31b0c2a3893627df1
SHA512 21badecf13b06854269686d0ff20f1c5a24973ac095c27fb956d72ed2addad6d360bdc9a0aba29f18c66c308eae29f87f3c2ea7b531b99a13657ab4f1408753e
SSDEEP 12288:U2zjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXuY:U20wgLBv7atTeuDMYdOtfQ5qlXN
TLSH
T118C4238478EB8053EF038136F296D2E5C5049EC65F392FBB7849780E6D7858EB477262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 f9daa9bf39c316b696e32213d0863978197675b7b62e47febf449b74e04416c0
MD5 d47e850528f8dbda0b996d411277b4b3
SHA1 e279d4940b68b4e56baceba326b73e843d87224f
SHA512 3015a99c351e2c563d1de95ad208dca9ef69eb18da712a70d230471261215e5497621603632bd0a827d575bd1e198059eae444355eb4bc6f6c5573e8fdf83193
SSDEEP 12288:pYzjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXu6:pY0wgLBv7atTeuDMYdOtfQ5qlX7
TLSH
T100C4238478EBC053EF038636F296D2E5C5045EC65F392FAB7849780E6D7858EB077262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 5a4bf776b988531f221f95d62d126be6cb364ec06809c3e0a61efae7c1b1d808
MD5 471ccaae61c199b008e8aa1b04f9a030
SHA1 ec6d60a398c551a64b6f7731e14561d223a6537b
SHA512 993b23353c2cc5861eb6ca594df157bdb897eebfdfa5b867ed123c19be5981b547b2cc122a24f8501f7f21d2b4b66354c7397b85fa49f534c9ce42b8e08f614b
SSDEEP 12288:OVRzjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXu2:K0wgLBv7atTeuDMYdOtfQ5qlXb
TLSH
T1B5D4234539EA80D3EE53C236E5A6D1E5C264BDC59F396FAF68002D0E1D752C9F836322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 ea89fbaaf8b8ddf1157d38daac88cfe14bb7d22bb9da30136496b23535401292
MD5 c561fcba8f51c8e39d49717fd6fab420
SHA1 72764329202108c3c27d39dc62ce9585643085cf
SHA512 1209104ea1e2edae7be39bc37c2c6a80f92f12bc6935ddb337c55fa3677c3ef5ff371c89f41febb8fc5de751a773f00a8dcd41afa92d166b577b6082314a3ec8
SSDEEP 12288:7Zzjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXuT:7Z0wgLBv7atTeuDMYdOtfQ5qlXC
TLSH
T124C4238478EBC053EF038536E296E2E5C5045EC65F392FAB7849780E6D7858EB077262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 c4947b62f89d1de384dcea27cc91f2eb3c2733708d95aae4193e98ea9700319c
MD5 70e5f5903b8f1db2aa72659c8cd72450
SHA1 1ab6856b6531de204ab50e8445a46fca3c0f22f9
SHA512 b867e2c0d4673d2cbf9ff8d469cce6273acbcce763d47a4df1d0f56914207a7b6c1609b4aab2fdc66940c800c7042be736b49f84211e951e4814daa55916cf77
SSDEEP 12288:tCzjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXuR:tC0wgLBv7atTeuDMYdOtfQ5qlXs
TLSH
T13CC4238478EA8053EF038136F296E2E5C5045EC65F392FBB7849780E6D7858EB477262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 eb8382da4d5d60688ddce67bf5d407be563040e3a8551737444cefbf541127ab
MD5 55c2bb0577ae23a108c5305dd2b504e7
SHA1 0772e53eb3361eacf0d401e04a7d7a52a37d4729
SHA512 88178875cedf8ec6edab0dadd44ba0bdd07ac822ce56af05b940233dc05828a98899e3f18cf91e61d3c5b7d79a0ce703e0189c74c538b28d3c5c56c7a7c23e7b
SSDEEP 12288:b+zjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXu5:b+0wgLBv7atTeuDMYdOtfQ5qlXE
TLSH
T1EEC4238478EB8053EF138136F296E2E4C5045EC65F3D2F6B7849780E6D7858EB477262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 0a4972e0161cdf0a10ae9edf5fb0e2cb6ab50f4a4d5c1d6a9f93fafdaf00b726
MD5 cd80b3df639637ac2476d32b34a9017c
SHA1 d1b8b9f7219eba23ce8e1b2c539cb0ffe5d89954
SHA512 b8ce4d73a352dfac65a4e15a94cb800af1667ef861118207913c2f8c06c303d3fe6cece3e98a1d82fe0076daeb5607e27c2fed45b45ad19d3cbae5687345013b
SSDEEP 24576:yZMMzFVSOW0wgLBv7atTeuDMYdOtfQ5qlX2:yZMMzfMgx7akmndO9Q5q
TLSH
T175050294B39008F6ED63823EC9558956D2B27C5A0B70CB1F17A4362B5F333915C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 2f0bba67638c328b2a5e3f8013e45ea753473d2da18d11b48d336059d1142bb7
MD5 e6e1faa5f16cbd4725d1c81b4a4786ff
SHA1 83bde8f0210ebd8380fe79b71320c41f7933294d
SHA512 dc1bb5e649eeef0e936649c2da48bb08181863a8a2d53de2c786f905129515e2f14cbc149661e6e17b75dee0f1d3748d1f3ee60ff9891fd7bb1d2ae630a54618
SSDEEP 12288:zzzjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXur:zz0wgLBv7atTeuDMYdOtfQ5qlXW
TLSH
T1D3C4238478EB8053EF034536E296D2E5C5085EC65F393FAB7C49780E6D7858EB077262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 4d0fefdbdbc68b4152e1d6217379360e8954569c850decd985add61d6b4b0909
MD5 5c686463595b60c2443ed009b4a2c92c
SHA1 89f101214cb7aeb48f4afada4d5971505bc7659d
SHA512 54952943828e2c19055f31132ef37fd000eb08aac2ccaa79b585319c2e7ece86d9ca6652b73b850269c0193dfbe1f47bb1c70853e02537b0aad26fc95606c922
SSDEEP 12288:KHzjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXur:KH0wgLBv7atTeuDMYdOtfQ5qlXW
TLSH
T111C4238478EAC053EF038136E296D2E5C5045EC65F393FAB7C49780E6D7858EB477262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 29754fae0acbce855bb20424b7f8554c22d33fe18f8a6d023ecfe0fff408ec19
MD5 84f916b0d0a1acf81c2183a676dca278
SHA1 c736bfd8ea8b2fabd46baf8ded2a4c39ab923083
SHA512 0fea82a56fe7d18b185abacaa1b1a20671ddd07481a17b82802678b78236e63a8051a49af4b1c4d132d01eff440abda33b3e38ad6d0af4d3c527cc73be4c0b53
SSDEEP 12288:9yPz5L8azjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXui:0zya0wgLBv7atTeuDMYdOtfQ5qlXv
TLSH
T177F4124772E620FBD5278239C9925651E371B8720B349FAF2694063B2E372D1AD3B731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 326c7cf1af4d455811fda28f075f6e264eff17db66585efd2f846dbf6134e258
MD5 fcb3d5552fd046ba05dfe8c839ba5a02
SHA1 c7fb1149da854827c02af61677720bcd86ce99e1
SHA512 3b8086ad5a85e8754bfd240cd3c29a548d51f3cff9d141d51b9443e2c53eff185c1bf5cffa86b2a3e8d059392afe984be2135772590aa77414b8d41269177f7d
SSDEEP 12288:Mzzjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXum:Mz0wgLBv7atTeuDMYdOtfQ5qlXz
TLSH
T130C4238478EA8053EF038536F296D2E5C5085EC65F393FAB7C49780E6D7858EB077262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 c2c726c0fdaa9989fa7f9f00c3c299ac9743284037cd5f1a7ebc1ca8c7c49fe8
MD5 1d6cf1c4cd76668506a9e31e777b7bd6
SHA1 b6130039e214dea7d0a2e4ae3d36ba282d33cc12
SHA512 fce1b796be97f8356d0a620ba3d8ae25f8f32d098e6f78d3fbfd20cc75989c7386223ee92e1e4db9a0fd7ad861fb034d2834c237012acd1d596969686a8a56d8
SSDEEP 12288:szzjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXum:sz0wgLBv7atTeuDMYdOtfQ5qlXz
TLSH
T1F0C4238478EA8093EF034536F296D2E5C5085EC65F393FAB7C49780E6D7858EB077262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 fa194fd76eb4d51562e8fb4fca3556d9b1e992d8e6910de38737221648125b22
MD5 d515ea39e5f54234418c380791c1d9dc
SHA1 352a6a8ab0cabf543fc748b01e08e4911727ec2e
SHA512 3c52564be8798be8f91e65267ce9068349b98ab8761f91d39312c29a2997f9eee6b96ea8225157b4eae898f503e03e7d25d25d23965634421c043c79a0de6f8c
SSDEEP 12288:SyPz5L8azjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXuv:Pzya0wgLBv7atTeuDMYdOtfQ5qlXC
TLSH
T127F4124772E520FBD5278239C9925651E371B8720B349FAF2694063B2E372D1AD3B731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 b66a5d75d834ba1b312b6f258789dd7cbc0586466715e53dad3bfb764fc9ec9f
MD5 019fa41f05591cf88383427ce0767745
SHA1 7f2296311b1a4485a6b5f4e3ee21592389a3a13c
SHA512 96512825fbff59816af2b2c3a2e300f490f37477dfc319a36e46d0cec5ee3931b3fd0361deaec18b67b925c43180c5ec3676b0663aadbd0a0f967f4086ba387d
SSDEEP 24576:9T9aLl3z0zDo0wgLBv7atTeuDMYdOtfQ5qlXm:9TQLljTgx7akmndO9Q5q
TLSH
T142050294B39008F6ED67813EC9568956C2B27C5A0B70CB1F17A8362B5F333915C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 d14fb41f055d0201eabc40f8e73cb059a7fc390ee3e23941c462ccb968f82076
MD5 8d462cd7f42728fa216e38a273f52707
SHA1 9d98c32dbc3665cd8ea8ad8eedcc6a980e45ed62
SHA512 b62486c4e92758dd8fe56a642ffa2e3d8ae3717ec174ffce821a40c999ae1ad45f8418e448412a1f4eeb57fd9de3128c798837b0b10a1c25c4129f16ddca2066
SSDEEP 24576:vfwvok9RX6wkyAI30wgLBv7atTeuDMYdOtfQ5qlXn:JMnYIpgx7akmndO9Q5q
TLSH
T15035D029EBDC44E2E177923C99B3460AF2B178591B31C6CF125A536D0E37ED4AD3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1e3be66a16cf6de870be5efef4cb83184c590e2302329cadb7f9f5c980c555f3
MD5 a3dd12fddda2158ed61b74bcd5bf1ee1
SHA1 84c45e22ab03f0064e7d1e3d84c43eee29d679c2
SHA512 6f0872ffbc8ffa9e057a1116fcca10eb84693fec798761e8108a255224f74c4bffe306c758d25e1cfa910cb8d551488d1e169ac4ff3a95e5c5a5c8ffbcb18d83
SSDEEP 49152:tYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Kgx7akmndO9Q4:LySzPygx7aS9
TLSH
T1DD067C56A1A841D5C1B9C1B98F0BCC1BFB7134490335ABEB02E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6025af51bfb6a7f947ffb7a55d718163ec401d337a3ca0dfeb09d5a0f3ddc59a
MD5 9f670d8abe51edb63cfe9c1b85939f9f
SHA1 e7c60ea8bdee4976879b83f90bc4635200cc67a7
SHA512 c5cdfe5220c8c5282e05d2d8f9ea7368a176176399629ae3adef7c9d163841ea5138261c981f024dc336b643660b8980bff40b1a38f4f529c2576036113f4a7b
SSDEEP 24576:447Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYG0wgLBv7atTeuDMYdOtfQ5qlXd:447JUQj4irIhCnDHUPfF/agx7akmndOT
TLSH
T19965AE1DA3EC01E6E1BA923885158A5AEA71742E1F31DACF2270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 4fe7c4474028e033075f65ecf92e4c1733650b1c8fa78f6562ec1aeb619508f2
MD5 a2683e56bafaf115179e85ab4b0edefb
SHA1 7b3faaef391fc800c4900e38d8dfaa0848f08c8c
SHA512 95e4e651bb8c33fef7bb1ee92842ffbd18486dd33c4ebe2eb75c8f4b50bb50fa9095c4cc936f6c75f2a6f59802285217fc53a2a178705d15d19ffec4137a41ec
SSDEEP 12288:hGsfDzjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXut:TD0wgLBv7atTeuDMYdOtfQ5qlXw
TLSH
T162E4F109E29841E6C56E5239C7468680F3237C558BF1A7CB66C0F93E1F76684ACFA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 f08686b171b36aad9e1f94c1ab93ede069bb94be2a528d3282f10b556d3c05a0
MD5 1f1948c88a0611f3c593f7c1778a0222
SHA1 5f918c1585aa66f554740a05fb460428b55cf470
SHA512 c74febce01d170bc90fed7cdec920d6dadda352d5423288c5da0fcfb17f065ce04ed945fecf4366bc962c06e4df1d58810ecf81d364b91348a9597e9f8eb3655
SSDEEP 12288:Ms8mhRcfU3fFhzn/aAphMrQcpFhNx8OAY/KafmM0ftMLmYBHKvLBjpowL:Ms8CR6UPFRuQcpvl7mMGMqYcvLt5
TLSH
T1F1452841766BC75FC6A940325E32D2CCAB707D01EE456F0773C8973FC576668BAA2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 333KB
SHA256 e035080bbd08232fe5d9e515ad8048550f40922cd61f66586569baeedcd336ab
MD5 05d9f89258c67422df4205e93ebf2f9d
SHA1 9b06bd8202f1b178bf030a8740b40653d2f1fbe3
SHA512 7edae3df8c5e1f7da2dea0392f1c4b73ad4228e01d2c25c51e24b57f5d0f4de3c4b785652e718d5b59ef3a0109790d91ce0be6ab6e33f7a38759cdda00be936c
SSDEEP 768:KTlToOlTPBlTz2+EQM8g/Ti+TlToOlTPBlTz2+EQMPgVg/TctTlToOlTPBlTz2+U:n8VPQ/ifwGUQrhSmxfFbMs7
TLSH
T1E1746629B790B214C4B340B394B0D2A79A3DF523CF6352093FDC1E46DCEA16636B6B56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Config.ini

Path C:\Users\Admin\Documents\Config.ini
Size 397B
SHA256 09c174d57ea9b357c2c169bebba20e1f7f160f891e0ab59da828ba9c7a48f9b8
MD5 d64bd8cc67481411926f101f6e67ed44
SHA1 622518f4d732e194037ad938c66ca51ac2818e31
SHA512 d5b6a0386228ef5e8703d3fab2daee7edf6d692b675e2eb8caa47d71e2b3f53a944f635c140c5c982b40114353cbd7987bc870f24d933c09a69aaa7d225007cc
TLSH
T18DE00236087FED4CCF48742B073D230022CEDC434070007507744C45003516D7000803
MD5 SHA1 SHA512 TLSH

Submit Download

Config.ini

Path C:\Users\Admin\Documents\Config.ini
Size 395B
SHA256 ed2675d20201e1cd4a925fd9c61a43bd6d5b0a6672d09faf23ce06a057310f66
MD5 349d1ae03663957668d7b1e0326dc5a8
SHA1 7608ce000579c01283f3bff3d10c54f4569da091
SHA512 e1622a1810e9db5bd7dbca2bf48a889ce8b8b059a5a476589213d4b2d5f623de4e82bbb9c732bc2f11dba264449d73d8febcae1c92603b2d5230dc030605453d
TLSH
T1E3E00236083FED48CF4C742B073C230021CEEC07003040750F744C41003512D7000803
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 fcd480b1bf3d0dd360133e511532ce8aec3bdda009a60aa0b6fe948a9ea15c2f
MD5 ff6439bf04f8f170cf97b143ad3d3a26
SHA1 7b61d849822b0f19235a6699c0e4f34624d68f24
SHA512 e7b4b0ff030e9115c6ad994fcbc8a66121fe0e01f2071c5db934cd5a716a2ba97fb7d5b6dd5653487db95df4c7645895e59bbd849954641256aaaf47fa8f77e4
SSDEEP 12288:WF7rzjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXue:ir0wgLBv7atTeuDMYdOtfQ5qlX3
TLSH
T131D4235065EAC053FE678635E19AD1B4C518BAC54F38AEEBB804790E6C749C9EC73323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 209b646435558efe6ef9a58f9337e9d478ad0b716db944d18f66533a378fbfc3
MD5 3422f40f1381b030c0a306c8d424635b
SHA1 83853c4c1b99a412fb38f83cfdd3af5f95c33cd2
SHA512 ce2fc86d603b4336ec3b083413b6cb530302b73d84abda4e35b954718c3ef4b1bdaeff2abf7db097eac3b454a0f6a216b04b206fae262d58f952ac4eec6876ad
SSDEEP 24576:4gb6bmBIi49WNNFpg1rSvFv7bYt0wgLBv7atTeuDMYdOtfQ5qlXB:4gb4mBIBhGFYgx7akmndO9Q5q
TLSH
T12865AE1E22EC02F5E1FAD2B8DDAA4417D6B278160731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 9c10e90c167dd15d918a946bfac542827a83c75c6ef1838391c6c1d379101659
MD5 b42417993dea98536df229f609bf98d2
SHA1 63ed129fb1729b97b236a10b7b1942ba5f94df36
SHA512 b586bcbe8e05bc9b49c4bc69757d4b594c079b1d557ed03fadc04f4e33592a8aa7ba929059b3c336fc7f594bdec44868469b24bb75c9f9158337832f96c02de0
SSDEEP 24576:QG88u8FpJqH1Wzria7/mW0wgLBv7atTeuDMYdOtfQ5qlX7:D7ZFPqVha7/rgx7akmndO9Q5q
TLSH
T1E335F16576E101F1D47BD138CA8646A3F6B1B8150334EFDF0AA88A561F23AD54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 89d65cc4f7574db3a9c4f3e3514abf5dcf5ee8a01999ae21735a51aeaa92093e
MD5 bd25cbd19f4803bd1e83dff6f84dde1c
SHA1 3cb6eeb3f1a94797a598072ba0b2c84e598723b8
SHA512 e2597251a3ec6d01563005fc621ab56e197f1728407e816e577fea19e029d22b6b64f69629fa9e0af26d44ad2931fe7ac9678d1ef0e044d212c9bc0230f8855c
SSDEEP 49152:SBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj8gx7akmndO9Q5q:dG05lO43bhgx7aS9
TLSH
T16BD5C06A62EC11F9D1BBC17CDAC6460BEBB23415033556CF02A486A91F27FF4A57E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d6e4c13d5cf8f4891579e1a05a4c32473e6ae6c130ee882c8d34ac803fdef604
MD5 bc74f05170260fd8f3c194ceee4a135b
SHA1 e77855d805ebaa9eec55a3bca4ec150b78fa0a47
SHA512 11a8d0c78271d0edf0660febdd85af0646523753df4ae45be434edf04b6dbfc744094f6af3f2a68a41eeefb752fa5b4372f9223c522c4486ff638619e9c44270
SSDEEP 24576:Ofa5POZ3dpqWVM50JicR2hG0lasx2+47eidns0wgLBv7atTeuDMYdOtfQ5qlXr:Wa5POZ39Jt2pasx2+mkgx7akmndO9Q5q
TLSH
T16165BF5EA6FC00D5D5B9D17DC583861AE5B1342253329BCF122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ee7773cb3399f95a000b5a79376d5f6161e161db624dddf3a64919143048fa41
MD5 0dcd8fc1dd8e2083962fa4cdbe702468
SHA1 27e0d5926a1e86b469fef0b0949b02bd57230163
SHA512 00bf9e9516d8f1d4e10810095c8f1308c4695705384e4ff943976eb5bb02961278053f9ba4df722fd77e5c9c8a190f41358a5448c624d480e7812b7ac833488b
SSDEEP 24576:UNcwHdjbyQ4nLC18lb/EOjowL7FkO0wgLBv7atTeuDMYdOtfQ5qlX7:UNc/zEOVHFLgx7akmndO9Q5q
TLSH
T1C3858B1622E901E4F5BBE1BE89779546FA71786517308ACF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3920c7d8cd8c3c4ce731cf1b9507abffce7c6705d7ddac7f20f93f38e6822629
MD5 718b4da55c6d9f5c18ab079e843014e0
SHA1 8a8ab6f9bd69430331cb6fd57235a82b6657a276
SHA512 99fa8c41f1a042fd33c8f58fe584dba2062bfd216abb99e6468d061c825cf269359a2d0a4cc38aee10fa845bec7812f6b921f6cec541105f21459e2c5597ebf0
SSDEEP 24576:ntkNvNnaFeYhJNtmZBmQ0wgLBv7atTeuDMYdOtfQ5qlXG:ntMwBtOmmgx7akmndO9Q5q
TLSH
T1AE55AF6EBAF846E4D1FAC675CD238512EA727461073293CB5290C13F0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 57fe291bc660163e23cb9ff3822b2fe8a4a99176f47b3dd72831a9b46bae67b7
MD5 94dd3bf51e407525cab33d4353b5e43a
SHA1 bf97685ad5f8e807e82f1232d7fec18c321c0d87
SHA512 7808fed1685a4eb3607c3562ed3d8ef6f0129a52f3aa3c3a47d34f0a6dc8b760ca469cd023ca30f1562c302a229d065421bc69b535a5dbf3c155a13473b9d894
SSDEEP 24576:8PUr+NQy0wgLBv7atTeuDMYdOtfQ5qlXm:8JQMgx7akmndO9Q5q
TLSH
T1DF05E11E22ED18E6E676E13DC5828719E771B8520711A6DF02D0813E5E77ED8BC3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 f8785e6a2075666a92591d748c601c3531772c92750926a5929898153bc0b80d
MD5 64bfd0b22016150c1db9ee2a1ef20c08
SHA1 0c6f5e8d2626269321bb2c4465acf00ec7843569
SHA512 4bf5ba65e6014f962595dfd61c5eed9b06a756f30bd16ca8d5a01ee9570d7751698e4bf59f9a5d092bf1b4db704fe462c94ba136a35fb87bb8e9861ee9a8b6f6
SSDEEP 24576:WD3FHshBIYQgAP0wgLBv7atTeuDMYdOtfQ5qlXQ:WDVHeBIAAxgx7akmndO9Q5q
TLSH
T1D425F13DE69C00E5E57BC17CD6638606E37138A907326ADB11D481BA1F6BEE47D3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/932-311-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/932-120-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/932-112-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/932-114-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1044-131-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/1044-125-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/1044-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1044-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1044-136-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/1152-293-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1152-66-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/1152-64-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1152-72-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/1240-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1240-20-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1240-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1240-21-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1240-13-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1716-107-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1716-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1716-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1716-312-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1716-101-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1716-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1880-342-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1880-94-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1880-88-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1880-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1880-341-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1880-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2288-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2288-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2288-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2288-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2428-83-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/2428-76-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/2428-308-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2428-82-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3956-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3956-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3956-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3956-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4536-5-0x0000000000400000-0x0000000000D96000-memory.dmp

Download

memory/4536-8-0x0000000002CD0000-0x0000000002D37000-memory.dmp

Download

memory/4536-0-0x0000000002CD0000-0x0000000002D37000-memory.dmp

Download

memory/4536-81-0x0000000000400000-0x0000000000D96000-memory.dmp

Download

memory/5584-54-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5584-53-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5584-60-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5584-274-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/6100-45-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/6100-39-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/6100-51-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/6100-49-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/6100-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download