9c91d59fdb2c0b40bd56e4306a558c4a4eec3feca07c7f137ed0b09be1199992

Analysis

user interaction
yes
max time kernel
44s
max time network
51s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 22:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ShadeFN_Cracked.exe
Size 110.2MB
Sample260925-145ldsyv5j
SHA256 9c91d59fdb2c0b40bd56e4306a558c4a4eec3feca07c7f137ed0b09be1199992
MD5 5cc3985339b456eb2682f757a4fbc1af
SHA1 67419d448f36be5c59abb7293a219138a75ea537
SHA512 b5e89077a1c8daf633c3af50fc405299ad19a455e73ed010cfb40238031117e6242b9bafdba2b37778464f6f345474b3cea67e933be8513b94f13f1b87786909
SSDEEP 1572864:9c7hR3Ih0BCLeVfAle0YyZJgdIMKZ3HCAYd3LeJsEDQl1sa/eeUQHCBn6fIct:9c7hWeiqAlJEje3HA3AF+z/XKAR
TLSH
T1694833D43A035A0CCB6B9634F983D5A87407A4CD89668ADB5FE23A16F0CD1EB61344F7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5564	elevation_service.exe
1488	elevation_service.exe
5576	maintenanceservice.exe
4264	OSE.EXE
4856	PerceptionSimulationService.exe
4960	perfhost.exe
1060	ReFsDedupSvc.exe
6124	SensorDataService.exe
4100	ssh-agent.exe
696	AgentService.exe
556	SearchIndexer.exe

Loads dropped DLL 28 IoCs

pid	Process
464	ShadeFN_Cracked.exe
464	ShadeFN_Cracked.exe
464	ShadeFN_Cracked.exe
464	ShadeFN_Cracked.exe
464	ShadeFN_Cracked.exe
464	ShadeFN_Cracked.exe
464	ShadeFN_Cracked.exe
464	ShadeFN_Cracked.exe
464	ShadeFN_Cracked.exe
464	ShadeFN_Cracked.exe
464	ShadeFN_Cracked.exe
464	ShadeFN_Cracked.exe
464	ShadeFN_Cracked.exe
464	ShadeFN_Cracked.exe
464	ShadeFN_Cracked.exe
464	ShadeFN_Cracked.exe
464	ShadeFN_Cracked.exe
464	ShadeFN_Cracked.exe
464	ShadeFN_Cracked.exe
464	ShadeFN_Cracked.exe
464	ShadeFN_Cracked.exe
464	ShadeFN_Cracked.exe
464	ShadeFN_Cracked.exe
464	ShadeFN_Cracked.exe
464	ShadeFN_Cracked.exe
464	ShadeFN_Cracked.exe
464	ShadeFN_Cracked.exe
464	ShadeFN_Cracked.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 49 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
	\??\F:\	ShadeFN_Cracked.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\System32\vds.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\dllhost.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\msiexec.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\locator.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\AgentService.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\vssvc.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\System32\alg.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1ef30a39e4fea11e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	ShadeFN_Cracked.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	ShadeFN_Cracked.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	ShadeFN_Cracked.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	ShadeFN_Cracked.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ShadeFN_Cracked.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ShadeFN_Cracked.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 62 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000021434f3c3b4ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dece993d3b4ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001901bc3e3b4ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f0cbf3c3b4ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f441ca3e3b4ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a9ff0373b4ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d192d23c3b4ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000183c323e3b4ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cfcb84383b4ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
1104	ShadeFN_Cracked.exe
1104	ShadeFN_Cracked.exe
1104	ShadeFN_Cracked.exe
1104	ShadeFN_Cracked.exe
1104	ShadeFN_Cracked.exe
1104	ShadeFN_Cracked.exe
1104	ShadeFN_Cracked.exe
1104	ShadeFN_Cracked.exe
1104	ShadeFN_Cracked.exe
1104	ShadeFN_Cracked.exe
1104	ShadeFN_Cracked.exe
1104	ShadeFN_Cracked.exe
1104	ShadeFN_Cracked.exe
1104	ShadeFN_Cracked.exe
1104	ShadeFN_Cracked.exe
1104	ShadeFN_Cracked.exe
1104	ShadeFN_Cracked.exe
1104	ShadeFN_Cracked.exe
1104	ShadeFN_Cracked.exe
1104	ShadeFN_Cracked.exe
1104	ShadeFN_Cracked.exe
1104	ShadeFN_Cracked.exe
1104	ShadeFN_Cracked.exe
1104	ShadeFN_Cracked.exe
1104	ShadeFN_Cracked.exe
1104	ShadeFN_Cracked.exe
1104	ShadeFN_Cracked.exe
1104	ShadeFN_Cracked.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1104	ShadeFN_Cracked.exe
Token: SeAssignPrimaryTokenPrivilege	696	AgentService.exe
Token: 33	556	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	556	SearchIndexer.exe
Token: SeBackupPrivilege	1060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1060	ReFsDedupSvc.exe
Token: SeDebugPrivilege	1104	ShadeFN_Cracked.exe
Token: SeDebugPrivilege	1104	ShadeFN_Cracked.exe
Token: SeDebugPrivilege	1104	ShadeFN_Cracked.exe
Token: SeDebugPrivilege	1104	ShadeFN_Cracked.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 464	1104	ShadeFN_Cracked.exe	94
PID 556 wrote to memory of 4308	556	SearchIndexer.exe	102
PID 556 wrote to memory of 5372	556	SearchIndexer.exe	103
PID 556 wrote to memory of 3600	556	SearchIndexer.exe	104
PID 556 wrote to memory of 2092	556	SearchIndexer.exe	105

C:\Users\Admin\AppData\Local\Temp\ShadeFN_Cracked.exe
"C:\Users\Admin\AppData\Local\Temp\ShadeFN_Cracked.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Users\Admin\AppData\Local\Temp\ShadeFN_Cracked.exe
  C:\Users\Admin\AppData\Local\Temp\ShadeFN_Cracked.exe
  2⤵
  - Loads dropped DLL
  PID:464

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5564

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1488

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5576

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4264

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4856

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4960

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1060

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6124

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4100

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:696

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:556
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4308
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5372
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 2952 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3600
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2948 2956 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ff791eae18546840e952a2d967b30ed52795312f1d6447a142d9fee76eb22f0a
MD5 ab650286ef63628c122b587f0bd1b3a3
SHA1 dfd294b34ec61698af77fd71cfbb84b510bb4f83
SHA512 652849501397a65f718ffd8eebdcadf2e68cdf8e8a9b57fde577af9fc40942311bf6dd4d75689313769bbbf834e7f2ea607c29c521b561c10b3d6c6dade6ee32
SSDEEP 49152:fb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnPXcsQJcsKEzQNpHj:d3q6sjBNbcstu
TLSH
T116D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 7b55df30cbc999aa220e62377d6780d1470c2e0598466dc31748b52278949249
MD5 e31107c713e14e119530ebd96d339369
SHA1 03a775e8520fc74e9bb688cdf6f61bdc3ed58d7a
SHA512 5bd1ad83aecb2cf51fe7ae52b9d787d4264f7a20202c950ff3229044cf57ce70ad0c3b1ea392024b73c12243f34113f57fdf2c9b93a611ad0c874e7509fbf43a
SSDEEP 24576:9XYfDtczAoDUWXAPMxPsSQhnTcg3KEzIdNDN4sJj:otc1XcsQJcsKEzQNpHj
TLSH
T17205F128A7D408F9EC6B813DC9A28811E633BC554760E6CB03A496765F337E85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 9b6df623eb7507e5287461ce0d6c98ae6662d22b3825ac79da8ea00b4cdf07f4
MD5 6136eaceddb155392bb720e891c16c22
SHA1 e9f76ae64dcc50517823a596fbec8d489a9d18a4
SHA512 c63a8f9e17e5f9a75a7185d7eacc16cd7aa675e8e809444dfab1ee612266834a46b629eeb95a0c416e703faf9761fcead698117f97c3082683e676c603c9a136
SSDEEP 24576:gwu4OWGDUWXAPMxPsSQhnTcg3KEzIdNDN4sJj:gwvO9XcsQJcsKEzQNpHj
TLSH
T18B05F14576A41CF9E9A78139869BC536F3F2BC012A21DB1F1760C66B5F37321AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 64cc5ea6d9bc49cb7a4025b6a1b4d45f56c27a9b6cd5554e30c3a90c40dd2d9b
MD5 8a55d49b1ec8a245b41ae6b604ac23f4
SHA1 3840c3c5ffd6bbd44ae0fd0599adebb2a627d625
SHA512 89d4387b30eba236ff79fb4f9779e11a7d57cae8beab358f40235546e074698f51be0f75c5174415a45208a672111ba3427c38846a403678e3e20c76b437f04b
SSDEEP 49152:DB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glIXcsQJcsKEzQNpHj:1u6Jmdxd2dxbcstu
TLSH
T189D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Salsa20.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1104_427086_enUH7bbxeso\Crypto\Cipher\_Salsa20.pyd
Size 13KB
SHA256 1ece1dc94471d6977dbe2ceeba3764adf0625e2203d6257f7c781c619d2a3dad
MD5 f19cb847e567a31fab97435536c7b783
SHA1 4c8bfe404af28c1781740e7767619a5e2d2ff2b7
SHA512 382dc205f703fc3e1f072f17f58e321e1a65b86be7d9d6b07f24a02a156308a7fec9b1a621ba1f3428fd6bb413d14ae9ecb2a2c8dd62a7659776cffdebb6374c
SSDEEP 192:4t/1nCuqaL0kt7AznuRmceS4lDFhAlcqgcLg:F/k1ACln4lDogcLg
TLSH
T17952F896F26681F6F52B4076CDB34A87DA79B500239223DB5320C2535D237D2323E792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_cbc.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1104_427086_enUH7bbxeso\Crypto\Cipher\_raw_cbc.pyd
Size 12KB
SHA256 6ba9c910f755885e4d356c798a4dd32d2803ea4cfabb3d56165b3017d0491ae2
MD5 40390f2113dc2a9d6cfae7127f6ba329
SHA1 9c886c33a20b3f76b37aa9b10a6954f3c8981772
SHA512 617b963816838d649c212c5021d7d0c58839a85d4d33bbaf72c0ec6ecd98b609080e9e57af06fa558ff302660619be57cc974282826ab9f21ae0d80fbaa831a1
SSDEEP 192:lF/1n7Guqaj0ktfEJwX1fYwCODR3lncqg0Gd6l:RGXkJEm1feODxDg0Gd6
TLSH
T14E420A0BFAA449B9E017423AC0330A45E9B6BB147351A7DF137052962D737C2323D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_cfb.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1104_427086_enUH7bbxeso\Crypto\Cipher\_raw_cfb.pyd
Size 12KB
SHA256 18d568c7be3e04f4e6026d12b09b1fa3fae50ff29ac3deaf861f3c181653e691
MD5 899895c0ed6830c4c9a3328cc7df95b6
SHA1 c02f14ebda8b631195068266ba20e03210abeabc
SHA512 0b4c50e40af92bc9589668e13df417244274f46f5a66e1fc7d1d59bc281969ba319305becea119385f01cc4603439e4b37afa2cf90645425210848a02839e3e7
SSDEEP 192:kblRgfeqfz0RP767fB4A84DgVD6eDcqgzbkLgmf:BwRj67p84Dg6eVgzbkLgmf
TLSH
T190423A49F6E448B8F49B42BAC977464B9DB5B504235123CF0311909D1D73BC13B3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ctr.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1104_427086_enUH7bbxeso\Crypto\Cipher\_raw_ctr.pyd
Size 14KB
SHA256 4d86a90b2e20cde099d6122c49a72bae081f60eb2eea0f76e740be6c41da6749
MD5 c4c525b081f8a0927091178f5f2ee103
SHA1 a1f17b5ea430ade174d02ecc0b3cb79dbf619900
SHA512 7c06e3e6261427bc6e654b2b53518c7eaa5f860a47ae8e80dc3f8f0fed91e122cb2d4632188dc44123fb759749b5425f426cd1153a8f84485ef0491002b26555
SSDEEP 192:vktJ1gifqQGRk0IP73AdXdmEEEEEm9uhiFEQayDZVMcqgnF6+6Lg:vkdU1ID3AdXd49urQPDggnUjLg
TLSH
T1A5620A16E69044B9F667427888678B0FE6BEB4442352BBCF033192662E237C4333F791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ecb.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1104_427086_enUH7bbxeso\Crypto\Cipher\_raw_ecb.pyd
Size 10KB
SHA256 5d1c2c60c4e571b88f27d4ae7d22494bed57d5ec91939e5716afa3ea7f6871f6
MD5 80bb1e0e06acaf03a0b1d4ef30d14be7
SHA1 b20cac0d2f3cd803d98a2e8a25fbf65884b0b619
SHA512 2a13ab6715b818ad62267ab51e55cd54714aebf21ec9ea61c2aefd56017dc84a6b360d024f8682a2e105582b9c5fe892ecebd2bef8a492279b19ffd84bc83fa5
SSDEEP 192:Yddz2KTnThIz0qfteRY4zp+D3PLui8p1cqgHCWt:k2E9RqfCXp+D3juRpLgiWt
TLSH
T1E922D84DFE5188EAEA2982B885730F49F176B710172273CF1370952E1E627CB357A742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ocb.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1104_427086_enUH7bbxeso\Crypto\Cipher\_raw_ocb.pyd
Size 17KB
SHA256 56e4e4b156295f1aaa22ecb5481841de2a9eb84845a16e12a7c18c7c3b05b707
MD5 78aef441c9152a17dd4dc40c7cc9df69
SHA1 6bb6f8426afa6522e647dfc82b1b64faf3a9781f
SHA512 27b27e77be81b29d42359fe28531225383860bcd19a79044090c4ea58d9f98009a254bf63585979c60b3134d47b8233941abb354a291f23c8641a4961fa33107
SSDEEP 384:4PHoDUntQjNB+/yw/pogeXOvXoTezczOo3p9iJgDQ3iNgnVbwhA:dUOhBcDRogeXOfoTezcio3pUJgDQ3i+
TLSH
T12582C647AD71AA9DD4D4423841A6897DF0BB74F10328D2FF4EE800BA3D2A3C815797E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ofb.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1104_427086_enUH7bbxeso\Crypto\Cipher\_raw_ofb.pyd
Size 11KB
SHA256 d9fda05ae16c5387ab46dc728c6edce6a3d0a9e1abdd7acb8b32fc2a17be6f13
MD5 19e0abf76b274c12ff624a16713f4999
SHA1 a4b370f556b925f7126bf87f70263d1705c3a0db
SHA512 d03033ea5cf37641fbd802ebeb5019caef33c9a78e01519fea88f87e773dca92c80b74ba80429b530694dad0bfa3f043a7104234c7c961e18d48019d90277c8e
SSDEEP 96:0Ga+F/1NtJ9t4udqaj01rlALnNNJSS2sP+YEdMN+F9FdKaWDULk+VOmWbucX6gR7:PF/1n7Guqaj0ktfEON+bMDUlJcqg0Gd
TLSH
T1B232094BFAE049BAE0164236C4734A09EAB6BA10B35177DF1370925B2D737D6323D395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_BLAKE2s.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1104_427086_enUH7bbxeso\Crypto\Hash\_BLAKE2s.pyd
Size 13KB
SHA256 032b83f1003a796465255d9b246050a196488bac1260f628913e536314afded4
MD5 d54feb9a270b212b0ccb1937c660678a
SHA1 224259e5b684c7ac8d79464e51503d302390c5c9
SHA512 29955a6569ca6d039b35bb40c56aeeb75fc765600525d0b469f72c97945970a428951bab4af9cd21b3161d5bba932f853778e2674ca83b14f7aba009fa53566f
SSDEEP 192:rF/1n7Guqaj0ktrESsrUW+SBjsK5tcQmEreD2mf1AoxkVcqgOvgXQ:rGXkFE/UW575tA2eDp1Ao2rgOvgX
TLSH
T19D52074BE66445F9F91B41B881B35A0DA6BAB5006361B7CB036092AA2D237D1737F3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA1.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1104_427086_enUH7bbxeso\Crypto\Hash\_SHA1.pyd
Size 17KB
SHA256 247b0885cf83375211861f37b6dd1376aed5131d621ee0137a60fe7910e40f8b
MD5 556e6d0e5f8e4da74c2780481105d543
SHA1 7a49cdef738e9fe9cd6cd62b0f74ead1a1774a33
SHA512 28fa0ce6bdbcc5e95b80aadc284c12658ef0c2be63421af5627776a55050ee0ea0345e30a15b744fc2b2f5b1b1bbb61e4881f27f6e3e863ebaaeed1073f4cda1
SSDEEP 384:APHoDUntQj0sKhDOJ+0QPSfu6rofDjiZzgE+kbwb:VUOYsKNO466DjoUE+
TLSH
T159823C95EDAAA4FCE565C834C6634A2FA376B51A5B5093CF03E002DE1C233D65A38B1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA256.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1104_427086_enUH7bbxeso\Crypto\Hash\_SHA256.pyd
Size 21KB
SHA256 16bea322d994a553b293a724b57293d57da62bc7eaf41f287956b306c13fd972
MD5 cde035b8ab3d046b1ce37eee7ee91fa0
SHA1 4298b62ed67c8d4f731d1b33e68d7dc9a58487ff
SHA512 c44fdee5a210459ce4557351e56b2d357fd4937f8ec8eaceab842fee29761f66c2262fcbaac837f39c859c67fa0e23d13e0f60b3ae59be29eb9d8abab0a572bb
SSDEEP 384:EJWo4IRCGHXfKXqHGcvYHp5RYcARQOj4MSTjqgPmJD12gkxEv:EcIRnHXfP/YtswvaD1zk
TLSH
T1B7A20B18AF3880A4F40E6039BB63867B77B8B600D394B3FF46510E991C2A7ED5634796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ghash_clmul.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1104_427086_enUH7bbxeso\Crypto\Hash\_ghash_clmul.pyd
Size 12KB
SHA256 bcb14dac6c87c24269d3e60c46b49effb1360f714c353318f5bbaa48c79ec290
MD5 5f057a380bacba4ef59c0611549c0e02
SHA1 4b758d18372d71f0aa38075f073722a55b897f71
SHA512 e1c99e224745b86ee55822c1dbcb4555a11ec31b72d87b46514917eb61e0258a1c6d38c4f592969c17eb4f0f74da04bceca31cf1622720e95f0f20e9631792e8
SSDEEP 192:dMpWt/1nCuqaL0kt7TsEx2fiTgDZqGF0T7cqgkLgJ:k/k1Ts64DDJyBgkLg
TLSH
T1BF420A0DE69655BDF12741B5C87B4B4AA9B5751827E0B3EF036284AA1D237C1333DBC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ghash_portable.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1104_427086_enUH7bbxeso\Crypto\Hash\_ghash_portable.pyd
Size 13KB
SHA256 49e15461dcb76690139e71e9359f7fcf92269dcca78e3bfe9acb90c6271080b2
MD5 49bca1b7df076d1a550ee1b7ed3bd997
SHA1 47609c7102f5b1bca16c6bad4ae22ce0b8aee9e9
SHA512 8574d7fa133b72a4a8d1d7d9fdb61053bc88c2d238b7ac7d519be19972b658c44ea1de433885e3206927c75dd5d1028f74999e048ab73189585b87630f865466
SSDEEP 192:bMt/1nCuqaL0ktPH0T7fwtF4zDn2rGacqgRGd:1/kpU3Yv4zDXqgRGd
TLSH
T10952F749E66489EDED2A4274C1334B0DA7FDF624335167CB0321A2990C23BC3723FAA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_scrypt.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1104_427086_enUH7bbxeso\Crypto\Protocol\_scrypt.pyd
Size 12KB
SHA256 eb2950b6a2185e87c5318b55132dfe5774a5a579259ab50a7935a7fb143ea7b1
MD5 3b1ce70b0193b02c437678f13a335932
SHA1 063bfd5a32441ed883409aad17285ce405977d1f
SHA512 0e02187f17dfcfd323f2f0e62fbfe35f326dcf9f119fc8b15066afaeee4eb7078184bc85d571b555e9e67a2dd909ec12d8a67e3d075e9b1283813ef274e05c0d
SSDEEP 192:rhsC3eqv6b0q3OQ3rHu5bc64OhD2I/p3cqgONLg:r/Hq3jHuY64OhDJJgONLg
TLSH
T12742E90AFA9484B9F55A5135C4734E4AA9FABA0423B167CF0361D2A61D237CB323D791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1104_427086_enUH7bbxeso\Crypto\Util\_cpuid_c.pyd
Size 10KB
SHA256 921c2d55179c0968535b20e9fd7af55ad29f4ce4cf87a90fe258c257e2673aa5
MD5 44b930b89ce905db4716a548c3db8dee
SHA1 948cbff12a243c8d17a7acd3c632ee232df0f0ed
SHA512 79df755be8b01d576557a4cb3f3200e5ee1ede21809047abb9ff8d578c535ac1ea0277eda97109839a7607af043019f2c297e767441c7e11f81fdc87fd1b6efc
SSDEEP 96:frQRpBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSztllIDpqf4AZaRcX6gnO:Qddz2KTnThIz0qfteRIDgRWcqgnCWt
TLSH
T14D22E70CFA9189FAE92A81B8C5730E4EA576B7215B2273CF1374953A1D627CB313B741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_strxor.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1104_427086_enUH7bbxeso\Crypto\Util\_strxor.pyd
Size 10KB
SHA256 034bb8efe3068763d32c404c178bd88099192c707a36f5351f7fdb63249c7f81
MD5 f24f9356a6bdd29b9ef67509a8bc3a96
SHA1 a26946e938304b4e993872c6721eb8cc1dcbe43b
SHA512 c4d3f92d7558be1a714388c72f5992165dd7a9e1b4fa83b882536030542d93fdad9148c981f76fff7868192b301ac9256edb8c3d5ce5a1a2acac183f96c1028b
SSDEEP 96:flipBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSzteXuDVZqYNIfcX6gHCWx:Cddz2KTnThIz0qfteR5DVwYkcqgHCWt
TLSH
T10422F84DFA528CF6E91981B9C5770F4AF076B710572163CF2370962A1E623CB313A782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_1104_427086_enUH7bbxeso\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_1104_427086_enUH7bbxeso\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1104_427086_enUH7bbxeso\_bz2.pyd
Size 84KB
SHA256 76a33e2baa3880aa46290cc7d5810b3155c5e2f5a1cc7d3f7b751f6434144ada
MD5 cf64abae18a5ce2c95b8e894fa5cfdc3
SHA1 76d87bef339e31af803a1a930b33a3e5dbc1c0cf
SHA512 7c4787b7cda291f49ce1bf9e1716ec5d50ae42a84425136c75c155c6fddbea00bc2900c6779f88f8d4cc47c0ed61f5f6c1caa433e660f0b8e5cb78e449ef35cf
SSDEEP 1536:NeFNPz7faNtxDCkrp43zOB2YHClj9l8sEsHiuP5IFLVAy1Ni9lfIL0qAO:4FVzzaww2DOsl9KsXCK5IFLV9dAO
TLSH
T1A4836D43B77461F6F9AF81B496810353F730BE960710A3AFB25482993F13B91EE68359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1104_427086_enUH7bbxeso\_ctypes.pyd
Size 131KB
SHA256 75687620596877b0dde462e74ae12140d695b3c78df3c6c099d55717768dde42
MD5 744a8886e7187cb632da61e2d48ebafa
SHA1 e105fe498617813f2d34e578d48b82e23e56a972
SHA512 a362fc3eee1a7f71d9b82dc3b6b268e1d3115d20733b40e3891ab04469f9f8fbb1f6ee07d6a92a78cba82c7c53101bfde13c99f9a3feffa5430b94791ecae30c
SSDEEP 3072:/uZHKSoKYGYzZkdf/F2zy4PK8fUSlIFyPAT0:moZAf/F2zyIK+USC0
TLSH
T10DD37D0B736800AADAA79178C533AF47EFB1B453161057CF02A4C59A2F63B926E7F705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1104_427086_enUH7bbxeso\_hashlib.pyd
Size 67KB
SHA256 5eb4a2aa9e28b49cb2a4f6ecee21f3c2b629b43a0709bad1d7e6204bac74eac2
MD5 648a300c9deda89218f23faacd7b0d17
SHA1 fd5fda7807cbfbaa23d052fcd8140d7ff4e98ff6
SHA512 27a8dc1dc1dad7aeed93912b9544760a984e5e3da0014fce1b66170079992cfea36c18212024982336d415ddb17db114ca0c45c85dabf7218b9467bed2d3fe6d
SSDEEP 1536:XMqXn1yAu1lEAXfXhfcV5TaSZ6CAxIFvIdy1Ni9/kfIbH5OnM:B1w1uAJfcySZ6CAxIFvIFNT5Z
TLSH
T152637C95A6494092E92382B5C4A34F83F9B1F3521711ABDFA2A8C18D2F237C38777756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1104_427086_enUH7bbxeso\_lzma.pyd
Size 155KB
SHA256 f221ed5f1c2789aa357f3c2dc4cd22af134b4b91acb3fb78f9fa5f7f9a7b62e4
MD5 a6bd469ef44eb08284a417fd5aaa4096
SHA1 ca65c9e0ee9bfdd3e8abbe46eb78b6bba1d657a4
SHA512 85198fbfcf517a3da03e897333dc5af4deb3c8eceee61e172a3effe7e6f79de9c76e029049bd727aa782ac018feebcabef73804df9270c49a1b6e411f149cd59
SSDEEP 3072:vK1fxTOfpRnifp5/eNRFAznf59mNomURj5IF01SL5E:v6JTOjKsHWhYOXjQFE
TLSH
T17CF35B86B794F0E5F3328C38D6624F57E6F5795A0320929E01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1104_427086_enUH7bbxeso\_wmi.pyd
Size 38KB
SHA256 ca38a50c27413a5acfd14b30b0433fcf80a64ad0020e41aceeb3666f8439aba4
MD5 39bf31877dd6b64700451021a91cd32e
SHA1 dca8e58dfe221c74f22c8bf56871e49a4f187966
SHA512 340765268b60520f6cf72cd37e6e9b5d1f728448ce2fd29427823f2bbb9630ee6894799c68744cf5bf65685772ba8b514e7735b76a298b94f5fc557513cfee55
SSDEEP 768:Z2/EEqrVmjsuuD2cru5IFLi9y1KPuBL2Ip4ETxf1ml6Z+7UBFg58:UE9BEKD2cru5IFLi9y1Ni9YfILqq8
TLSH
T192037D86E6680082FA6BC674C5A5CE93F575F7D35B12838F326582590F233D1D73A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_1104_427086_enUH7bbxeso\libcrypto-3.dll
Size 5.0MB
SHA256 09499e186cf0e434ffa17ad153aa9a66d6048c54a2c03b823e2a06c49d9affe4
MD5 6d0a1af0e9a539a749dd50add9c4c27b
SHA1 e484df936d4c1072f6aaa287ef41fe8ed238e87b
SHA512 485c01182e838488c93cdc6d526d5f568b52101ac49a5739461fb3480ec490110a50695f53f60079431c940880a3c049fdac8e562bb00e0930578b2cb947d5e4
SSDEEP 98304:uAH+4va7N1rRtynkJj2uSFPzy1CPwDvt3uFlDC/R:uuVv+1rRkMj2uSF21CPwDvt3uFlDC/R
TLSH
T111367B6AA7A80189E4BAC13CC9534617D2B1F85A57B097CF18A156BD0F37FCA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_1104_427086_enUH7bbxeso\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_1104_427086_enUH7bbxeso\python313.dll
Size 5.8MB
SHA256 3a7a6170ea840bf2a2a76d05b687b946fcdc8d0cfedfe159012b38f1e8959a7c
MD5 b0f3aa8a9fc7462f25b1f48f3174dfa5
SHA1 63243edfcf789b5fb9370e5baa27e9a07ba3ebaa
SHA512 07b83bd20ff501f4753273684e4e539a5722dd0eb2689c045665da12e5a1b0950c70ba9c8e4dd99be72057b9311ed4199b643639b8f49f1cba8c41c8c29bc57e
SSDEEP 49152:kYxOb4yPiEMqTGnJwYE2M8SMW+IC1f37M2nGyN7yd5va4ifhSBqVX0Yy13KR/x1n:gPzKWIHosdoBcqbei8I0CSvNHDMiEnsj
TLSH
T15D567C16729E40ACD97B8078CA17864BFBB27C013E60534B61E6BB5D2FB3362476E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 3f317c832d35380308c286cfb9afa417d04d5920a0b52a18d713323b6fbfd0d9
MD5 6b609493c5f85b2a3cc23fcd15f7b319
SHA1 b2c03f6d748fa92cbac2aff10998601ba0307c28
SHA512 e72ef665b7260fbc80618b89b8cdb94c638cb0d7624c5b30b992339f450c731cec0e4c5664b1bc27bf3552f76d66307345905245c11dbc6a73c34b9c8ebd0f8e
SSDEEP 12288:Hz7fDUWGyAPMxPsSwHcenP7OtT0ZRKEzpmdu0U1iN4sJWy:nfDUWXAPMxPsSQhnTcg3KEzIdNDN4sJj
TLSH
T149D42360DB5871DAD8AE483162EF6830511EFC68EF00E4C3B505A27ADB38AF59C7535E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c88e398f43656ee81cee7415e3d85971d29aaf318ef0f89f2f0713ce6d70d36c
MD5 83a2a0af19f554af1ddc0d38a8116fc3
SHA1 38b57f409e42a17c280f95f8325bd0a144af71bc
SHA512 07eb6d98e692227ac73d6878f98f0e432a9f2c8c4de2ad81be05b08b9bbc0073c41184aa6bb15de7300cea707717b3c1a0503f02abf837ca02eae44e0f8b273a
SSDEEP 24576:Fgb6bmBIi49WNNFpg1rSvFv7bY1DUWXAPMxPsSQhnTcg3KEzIdNDN4sJj:Fgb4mBIBhGF2XcsQJcsKEzQNpHj
TLSH
T1CD65AE1E22EC02F5E0FAD2B89DAA4417D6B278161731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 21ca4fe43b4d445deaa56d01f038e7cea8562980a9277aa26be48ad8b0f211e1
MD5 40fa2724d19be7ced7d8364ed5d8190e
SHA1 dbbe0ddb66f93c072b5fe8f0fdd8e9b164a7656d
SHA512 542b8b2e2c5b82bcbe5856412a8bf31bbf01f862f724a21f58a9296ea5f9ff9edb7ff1abbe0b6a0b15d12cdbf6e0c78b4f31e0363be2e39294adbc50b96a2f86
SSDEEP 24576:jG88u8FpJqH1bzria7/mODUWXAPMxPsSQhnTcg3KEzIdNDN4sJj:S7ZFPqVea7/tXcsQJcsKEzQNpHj
TLSH
T10735F16576E001F1D47BD13889864663F2B2B8251324EFDF07A88B651F33AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 b8e93a945c4be4931ff8443601f00883d5e5b631e8dabf31345e89180d3850db
MD5 bb36fe75d45f4e1913a1920fc04742dc
SHA1 01f8312203e3ae0ed2180546ea57ce8a4464a921
SHA512 393368a3c737779485c4d0de3c6570ed676d28648baa9edaba4f577a042f924399ebac6556439f170b56745637b103dcc29bf274978c83e6a7f9ce8dc9d78285
SSDEEP 24576:YPUr+NQCDUWXAPMxPsSQhnTcg3KEzIdNDN4sJj:YJQiXcsQJcsKEzQNpHj
TLSH
T15905F12E66EC18E5E67AE17D85864619E371B8621711E2CF02D0817E4F37EE8BC3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6818e066582e80d3c445ee0f7fffcff30d2706d7b98c065d3975b7fe6770091d
MD5 a253d16f709e3854eb42507ff6ff0010
SHA1 4d36cfe49232a141dc9c5db23b2a020d5c9b51df
SHA512 2a9cf8650a7f28b9ee2521427b6d4df41efd6bb93f8a824536c4cdc4cc9a0af981763a7b2a02d0f668e28bee9abe4ddad7323d666679b49278e7e299e8bd3fb0
SSDEEP 49152:bBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjyXcsQJcsKEzQNpHj:kG05lO43bQbcstu
TLSH
T17ED5C06E62EC11F9D1BBC17CDAC64A0BEBB23815033556CB02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 932e6db21a7a8089c16f60377a59fd1461aeeb972531fc4d5c532e36e4e8711e
MD5 487cc46bdd662183fabcee0dd3a8b542
SHA1 f5827bd5d83f8bea5a8b14b6f4cbeb289a2e95f3
SHA512 41c09baa616f4439e6ec9edd1d930ed04f88e3f6619e6af0572289708822c2da02261c388e58f5c7861c1c60d8978e65a1943420175f6d479a6a569ff684f156
SSDEEP 24576:6fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnIDUWXAPMxPsSQhnTcg3KEzIdNDND:Sa5POZ3BJt2pasx2+mKXcsQJcsKEzQNp
TLSH
T1E865BF5EA6FC01D5D5B9D17DC5834A1AE5B1342153329BCB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e3c7d0a0832471117a41eb04dbae1b22c01f819128ee6568c03cd327bb25b2df
MD5 24e90ddd685cf10e9626b6e1082df8b4
SHA1 52e44500172f00ecc41befdf60b6c67fd8e30b3e
SHA512 d50f323630c466bac7b56f3fb2d135de97f9524fbef0645b11053d0c352cbffeacf12bec19b6ee034f4f2b6cdb46ff3a361b39a71f7ae59faa93f7c91b46819b
SSDEEP 24576:iNcwHdjbyQ4nLC18lb/EOjowL7FkmDUWXAPMxPsSQhnTcg3KEzIdNDN4sJj:iNc/zEOVHFNXcsQJcsKEzQNpHj
TLSH
T118858C1623E901E4E5BBE1BE89779946FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/464-122-0x0000000000190000-0x00000000001F0000-memory.dmp

Download

memory/556-197-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/556-203-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/696-183-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/696-189-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/696-191-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1060-149-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1060-419-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1060-155-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1104-0-0x0000000000190000-0x00000000001F0000-memory.dmp

Download

memory/1104-7-0x0000000000190000-0x00000000001F0000-memory.dmp

Download

memory/1488-23-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1488-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4100-172-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4100-178-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4264-125-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4264-110-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4856-131-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4856-136-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4960-145-0x00000000007C0000-0x0000000000827000-memory.dmp

Download

memory/4960-140-0x00000000007C0000-0x0000000000827000-memory.dmp

Download

memory/5564-18-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5564-12-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5576-33-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/5576-39-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/5576-107-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/6124-160-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/6124-382-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/6124-166-0x00000000007A0000-0x0000000000800000-memory.dmp

Download