aa5ca01a4cdc71c10b1045e2b955b0308f61edb713800b62dc9016c7b29c6d14

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
Size

5.5MB
MD5

b3b8ebfa796fdb607214a016154f1e1c
SHA1

bc902e28274934ef299a055d8088015f1252dd08
SHA256

aa5ca01a4cdc71c10b1045e2b955b0308f61edb713800b62dc9016c7b29c6d14
SHA512

0a057288e58a74c900447b2e0d150728688cffb325e3d7ef9cd42b7189d00a5378611be1fd51dfca1ab8b2ad8186e6ee63c98e41405e7b1e8fe05ffd040a51e3
SSDEEP

49152:BEFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1Ln9tJEUxDG0BYYrLA50IHLGfZ:lAI5pAdVJn9tbnR1VgBVmww7izY0a

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
3868	alg.exe
1100	DiagnosticsHub.StandardCollector.Service.exe
4852	fxssvc.exe
2096	elevation_service.exe
4864	elevation_service.exe
1436	maintenanceservice.exe
4872	msdtc.exe
2340	OSE.EXE
1228	PerceptionSimulationService.exe
5100	perfhost.exe
440	locator.exe
916	SensorDataService.exe
2800	snmptrap.exe
4552	spectrum.exe
4828	ssh-agent.exe
1392	TieringEngineService.exe
3344	AgentService.exe
4220	vds.exe
4124	vssvc.exe
4924	wbengine.exe
2136	WmiApSrv.exe
1040	SearchIndexer.exe
5996	chrmstp.exe
5612	chrmstp.exe
6192	chrmstp.exe
6264	chrmstp.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b2ce92f8c3a5208d.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000caddef233bb5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133618404512674787"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000031d76b243bb5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000de3112223bb5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c9546233bb5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002fb6e8233bb5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008a5819223bb5da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001fca8b223bb5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000055f273223bb5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
388	chrome.exe
388	chrome.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
1100	DiagnosticsHub.StandardCollector.Service.exe
1100	DiagnosticsHub.StandardCollector.Service.exe
1100	DiagnosticsHub.StandardCollector.Service.exe
1100	DiagnosticsHub.StandardCollector.Service.exe
1100	DiagnosticsHub.StandardCollector.Service.exe
1100	DiagnosticsHub.StandardCollector.Service.exe
1100	DiagnosticsHub.StandardCollector.Service.exe
3296	chrome.exe
3296	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
388	chrome.exe
388	chrome.exe
388	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3316	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
Token: SeTakeOwnershipPrivilege	3456	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
Token: SeAuditPrivilege	4852	fxssvc.exe
Token: SeRestorePrivilege	1392	TieringEngineService.exe
Token: SeManageVolumePrivilege	1392	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3344	AgentService.exe
Token: SeBackupPrivilege	4124	vssvc.exe
Token: SeRestorePrivilege	4124	vssvc.exe
Token: SeAuditPrivilege	4124	vssvc.exe
Token: SeBackupPrivilege	4924	wbengine.exe
Token: SeRestorePrivilege	4924	wbengine.exe
Token: SeSecurityPrivilege	4924	wbengine.exe
Token: 33	1040	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1040	SearchIndexer.exe
Token: SeShutdownPrivilege	388	chrome.exe
Token: SeCreatePagefilePrivilege	388	chrome.exe
Token: SeShutdownPrivilege	388	chrome.exe
Token: SeCreatePagefilePrivilege	388	chrome.exe
Token: SeShutdownPrivilege	388	chrome.exe
Token: SeCreatePagefilePrivilege	388	chrome.exe
Token: SeShutdownPrivilege	388	chrome.exe
Token: SeCreatePagefilePrivilege	388	chrome.exe
Token: SeShutdownPrivilege	388	chrome.exe
Token: SeCreatePagefilePrivilege	388	chrome.exe
Token: SeShutdownPrivilege	388	chrome.exe
Token: SeCreatePagefilePrivilege	388	chrome.exe
Token: SeShutdownPrivilege	388	chrome.exe
Token: SeCreatePagefilePrivilege	388	chrome.exe
Token: SeShutdownPrivilege	388	chrome.exe
Token: SeCreatePagefilePrivilege	388	chrome.exe
Token: SeShutdownPrivilege	388	chrome.exe
Token: SeCreatePagefilePrivilege	388	chrome.exe
Token: SeShutdownPrivilege	388	chrome.exe
Token: SeCreatePagefilePrivilege	388	chrome.exe
Token: SeShutdownPrivilege	388	chrome.exe
Token: SeCreatePagefilePrivilege	388	chrome.exe
Token: SeShutdownPrivilege	388	chrome.exe
Token: SeCreatePagefilePrivilege	388	chrome.exe
Token: SeShutdownPrivilege	388	chrome.exe
Token: SeCreatePagefilePrivilege	388	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
388	chrome.exe
388	chrome.exe
388	chrome.exe
6192	chrmstp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 3456	3316	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe	90
PID 3316 wrote to memory of 3456	3316	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe	90
PID 3316 wrote to memory of 388	3316	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe	91
PID 3316 wrote to memory of 388	3316	2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe	91
PID 388 wrote to memory of 4656	388	chrome.exe	93
PID 388 wrote to memory of 4656	388	chrome.exe	93
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5616	388	chrome.exe	118
PID 388 wrote to memory of 5684	388	chrome.exe	119
PID 388 wrote to memory of 5684	388	chrome.exe	119
PID 388 wrote to memory of 5704	388	chrome.exe	120
PID 388 wrote to memory of 5704	388	chrome.exe	120
PID 388 wrote to memory of 5704	388	chrome.exe	120
PID 388 wrote to memory of 5704	388	chrome.exe	120
PID 388 wrote to memory of 5704	388	chrome.exe	120
PID 388 wrote to memory of 5704	388	chrome.exe	120
PID 388 wrote to memory of 5704	388	chrome.exe	120
PID 388 wrote to memory of 5704	388	chrome.exe	120
PID 388 wrote to memory of 5704	388	chrome.exe	120
PID 388 wrote to memory of 5704	388	chrome.exe	120
PID 388 wrote to memory of 5704	388	chrome.exe	120
PID 388 wrote to memory of 5704	388	chrome.exe	120
PID 388 wrote to memory of 5704	388	chrome.exe	120
PID 388 wrote to memory of 5704	388	chrome.exe	120
PID 388 wrote to memory of 5704	388	chrome.exe	120
PID 388 wrote to memory of 5704	388	chrome.exe	120
PID 388 wrote to memory of 5704	388	chrome.exe	120
PID 388 wrote to memory of 5704	388	chrome.exe	120
PID 388 wrote to memory of 5704	388	chrome.exe	120
PID 388 wrote to memory of 5704	388	chrome.exe	120
PID 388 wrote to memory of 5704	388	chrome.exe	120
PID 388 wrote to memory of 5704	388	chrome.exe	120
PID 388 wrote to memory of 5704	388	chrome.exe	120
PID 388 wrote to memory of 5704	388	chrome.exe	120
PID 388 wrote to memory of 5704	388	chrome.exe	120

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Users\Admin\AppData\Local\Temp\2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-06-02_b3b8ebfa796fdb607214a016154f1e1c_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2d4,0x2d8,0x2dc,0x2b0,0x2e0,0x140462458,0x140462468,0x140462478
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:388
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcbdafab58,0x7ffcbdafab68,0x7ffcbdafab78
    3⤵
    PID:4656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 --field-trial-handle=1932,i,9298239765655646132,15347097668954000090,131072 /prefetch:2
    3⤵
    PID:5616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1932,i,9298239765655646132,15347097668954000090,131072 /prefetch:8
    3⤵
    PID:5684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2164 --field-trial-handle=1932,i,9298239765655646132,15347097668954000090,131072 /prefetch:8
    3⤵
    PID:5704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2768 --field-trial-handle=1932,i,9298239765655646132,15347097668954000090,131072 /prefetch:1
    3⤵
    PID:5936
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1932,i,9298239765655646132,15347097668954000090,131072 /prefetch:1
    3⤵
    PID:5944
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4280 --field-trial-handle=1932,i,9298239765655646132,15347097668954000090,131072 /prefetch:1
    3⤵
    PID:5208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4272 --field-trial-handle=1932,i,9298239765655646132,15347097668954000090,131072 /prefetch:8
    3⤵
    PID:5340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4600 --field-trial-handle=1932,i,9298239765655646132,15347097668954000090,131072 /prefetch:8
    3⤵
    PID:5392
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4756 --field-trial-handle=1932,i,9298239765655646132,15347097668954000090,131072 /prefetch:8
    3⤵
    PID:2788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 --field-trial-handle=1932,i,9298239765655646132,15347097668954000090,131072 /prefetch:8
    3⤵
    PID:5932
- - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    PID:5996
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x294,0x298,0x29c,0x268,0x2a0,0x14044ae48,0x14044ae58,0x14044ae68
      4⤵
      Executes dropped EXE
      PID:5612
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:6192
    - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x14044ae48,0x14044ae58,0x14044ae68
        5⤵
        Executes dropped EXE
        
        PID:6264
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 --field-trial-handle=1932,i,9298239765655646132,15347097668954000090,131072 /prefetch:8
    3⤵
    PID:2204
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2652 --field-trial-handle=1932,i,9298239765655646132,15347097668954000090,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3296

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3868

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1892

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2096

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4864

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1436

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4872

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2340

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1228

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5100

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:440

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:916

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2800

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4552

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2700

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1392

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3344

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4220

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4124

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4924

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2136

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1040
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5268
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3804,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
1⤵
PID:5384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe

Filesize
2.3MB

MD5
420f65c6cf6b45df4b8c4ff036f59ce8

SHA1
5967879841662a64b66db8207e69c399bf77334e

SHA256
5b3b3f0c4d7ea703282df1d65686a2102a157197ff96ed56f601bfb11c55728f

SHA512
5d8ffab164b3e86cc6840d2049f28b8b854b40669cb88d2257ab25d27fc49c5e3a36229ea8f8c45a1d126f11b394c0c8a20e97fb88787adc0654efc49308a721

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
797KB

MD5
d09d7457e59b6fd24783ef82665000e0

SHA1
373f1cf78972a005f23e9afa76f99ce28fe17ad4

SHA256
a5d48b3a5b9a4233704d765c92d9e8325892ae4ecc6436c5f9898fe907abd678

SHA512
53b2b80131d5195a545cc5fab4690c11888f2bfd3481da80c621c24ce0fbef42f6d8ef93debdd59211c38a4e987e6b437c867cb381c051a55f6ee71a6d799aec

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.1MB

MD5
eb647fd188ba9973e02331ffb04f1fd9

SHA1
ec596065c0e5ddd26207963d9e6b9896910274fa

SHA256
8e195976098a6d2453df250f758fffcec84a59d9640e0df75bae687465638413

SHA512
b380c5e1274146398fdecc306be05749b3376e654a0d0d7aa3918c98ae3dca721649197a9fff7fb86b5c936fa6efb1cee643170841b153b19aeffa4d325ee9a9

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.5MB

MD5
7e7a5c349eb095cf31f855ae56aeb4f1

SHA1
11fc33a7a97eabb34c7dfcd884c8469b057559c3

SHA256
958bb20d0a113b5726db924cfe2d6c72a541baeb6b1c50ffc24836eaf3b16cba

SHA512
417f6f3c64036bd412b13544bde491c6dc579add6b86baa8d7dd54b78b966bdec5fd8e4e4583e26f6dd0d2f2186ef3ef1e188c0669bce7999d7e9853fe4f7076

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.2MB

MD5
fc7dd221aa864837e0e32d910860dd17

SHA1
80c53b469ef4aa44b167ea7355e25bc16716f5f3

SHA256
ea4289d041ba3db33f01019c762fd78c4f7011098f49319ed47d7810f0c316ab

SHA512
435ca4e7308da6fb83cf1b8c235dc7eeef3911a702fcc5801badb20024e1bbd6dc388e18619ac2bfdada77872ea28a01716326cfd02534b077c750184725d168

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
582KB

MD5
e02c9c6a7b04d146d5417c1a64bbd871

SHA1
06d916e1724ab941afbf1c4f50bdcf4b2f3d5032

SHA256
1b70493bb475eeaa4d50294ca910bca9b08e704fec8b368c51848cba9af6a494

SHA512
a64be09abec0509363defb19057c289cd3622443b465a641d6c0330544e783a43d2d86dc66ed76784970289aa3911e9793de74ea7b9d94f2afa4f5f57694568c

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
840KB

MD5
c3d699bbcc2a0fadeccf95d1d833490c

SHA1
e963ee58a4baf019343de3be264f82e95c0ce61a

SHA256
fe7b853ca60713327930ff4d0a3eac939def9e2d9f4da8e4fe1eb869e3bac2ae

SHA512
4363e006761a42bddb6cfb6f3f42b7cd5b6742d548e057461a3aa47b64c4b59808da814c14d6670247b04a80deadf2682c5924f99116bbdf2988507f11986bf5

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.6MB

MD5
90f62f597479c73f803bb0f609814ecf

SHA1
b4b700dd6cbb26b6d73e80ccd48e9f374fc1139f

SHA256
2539c10f32c80ab80e5a3303256682345570ad19254d1e2e021072e9543f1ec6

SHA512
c35a20af102a5a6c8bb225a3fc8e109d805984af832da564332c1c952d8daf9b11d5d991fdd765e934fe40fae25413609e41f6996c39eb3e2d731fea75ea00a7

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
910KB

MD5
a428b906d474bc0ad3398660ae5538a7

SHA1
f48e04fa47346c5a2675698d4c73f2e3baf049bd

SHA256
946fa0d29a57d992e19b5db9a1506311b8118973c23f548a9b11627ce4e1aba4

SHA512
edf6c66480c054f5777f18bd3bd3a7dd945de0327a8662edb0968cd2b83245643f111990a52333c5b3f432815138bfd6fd67d6a3cb20eb78d88a7464a68884b4

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
24.0MB

MD5
192575b18a7cae952719e5a735f295f6

SHA1
39f397ca24bea905fce310c27c336bc890481327

SHA256
b66a431151d80e612716997f02f83c161d7212b63ed8305085b1cc2a04b9fb42

SHA512
b0368d5140b7fd6386afa365a85b1c7bf158568c704e503440e9ea2ace2663457ab909d33faeede0bce9cb13bb349f17c70d22110f99b7caef1f5f4deacebdd5

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.7MB

MD5
1745517adccda876a0c4ff3e7477984f

SHA1
4c461b504bf7b28c54ab47d3323c55c5578d8a7a

SHA256
25354ea2debfafb661e53ebc14866add881e5bc0e08caf13577d1fd08891cda2

SHA512
46cb7ae5c46a5535d918598d97d1f2f21dd59ea74d516f57e42c29fd4bec6a090e3fa807267b4ea81e6c482181d8774669f8e656ff58490ebfdf477f72f28727

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Filesize
1.1MB

MD5
68ce8e34d4bcb8979a55b4a2334e5840

SHA1
de5cc2f4b52f55f57d81c8a325e5dfc8c8d9f5ad

SHA256
6123f6b62638fda522e1eff3ce2fe4cc8bb968c478f79cb40ffcd33c5fd56eae

SHA512
04019d0aa5bc80315d110819ba25aee13694c62ae8a2a19cc111fbcc86ffcb42d33add03e3b0fd1db523c0aee18236581b1a607f2a464c950d2c0a00e2dee8f0

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
805KB

MD5
6b767383a005c5b6db4cb3de06b66827

SHA1
631dbdc027cec3977ee0ed77e11d52faa791146e

SHA256
4d9c535bf6182a7b3b0b68eddf28b9feed215720b0dd16795126a4bacef44ef7

SHA512
121b76f2f2d4417656ba7d1d258ad8b11626b2803b2687a5517847c7b4a1b1147db39d2efa5511187f990c38dc87f8e88ec0f8f85b8995e205103f248c72fdfb

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

Filesize
656KB

MD5
db7ba58ea76e86c80127d01247aa3e2e

SHA1
b1fd127c206c6785c8fd8bdb2a039f98caf7ac7e

SHA256
705a8a9d39fb550642e1a9e7c5587d13e7a84e6d6ee55bd34ae41acfa8b00bcd

SHA512
bc2a5d0ae80bae8b3cf5255f0888c5d6e462456fbbece6580b1bca3fc4fa25c3ef5c5adf1be76b12080891ce606dd3580f229f6ef1aa3297249fd42bfa690830

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

Filesize
5.4MB

MD5
648c5569560c78d4f88fdb24c22615f1

SHA1
6efca583548173840e892406c3c85488c1f4c263

SHA256
03c6a0df5c801d38b7d599687d66402b292b3d6e780593e05a7f611211a7437f

SHA512
a2da15c019da8da506399121c5c6399e4d95a9e019a6a392e98c7574e2788b4dee75996de47b85e47061cb4f72b019c1940271e6cdd106b5a6217ce524801433

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

Filesize
2.2MB

MD5
ebf8d0f25ff617767c1d566078b1a4a8

SHA1
df059e78e478c7dba2333fbd075b3405487b4dfa

SHA256
97b01ec504451cf23c8908f0661181033aa33719c03dc781515499e37f478c9a

SHA512
647ac567fc05e4229ea361acf0d8b533b66f7d2dea72d7d108193264cf8f23cd7edf746dfd9cffa2ff65e8c5f86552806b3570deb3ccac66ef7600f3e1159e82

Download Submit
C:\Program Files\Google\Chrome\Application\SetupMetrics\8ebfeb8c-b7b2-4398-affb-1120c58d986b.tmp

Filesize
488B

MD5
6d971ce11af4a6a93a4311841da1a178

SHA1
cbfdbc9b184f340cbad764abc4d8a31b9c250176

SHA256
338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783

SHA512
c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f

Download Submit
C:\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
1.5MB

MD5
b1f2c1bce28927eba117e5a793d05c81

SHA1
204c29e2cf5b9b90f88628826fad3b6fa157a371

SHA256
62e9306b02b150ef3da4f518b650a3c3085f5e8624575da8129382b8d7639f2a

SHA512
34fd85479e88af6bcee293c8cf4bef373a9206e070591192095659c49711dae45c24cdc6ac34f8b66007e2cdb197544536bac61acf9e27bc20ed7e0d07c99c2d

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
701KB

MD5
92e47a7826fbe78baf585436faa64e87

SHA1
e0f26f44eeee5d9f29e244e837405d90deb441f5

SHA256
c64cb463eacea3d9324aeb74631a1fa7911510e8849fce81e8671e8b70cb0697

SHA512
84732748e835e42ecd0671a68d63a44405e42eb74af624fa8a9dd21aa858d610245a1552c8d6faee73a227e5e56a2008ca85e9a5ec96c0807565a1a319a03e96

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
e646991f9b7863013f4543e5deea2d49

SHA1
7d3ab1c249b15c5bc5761baef819fa96b043539a

SHA256
0cc277125b5bd55a7c42e32f351b5bce3ca6003f28bc0646db5bc6b9b5135c07

SHA512
8b7b264f086ee2d1c1ec1199307d6511ce964890e84312a1c12c21a0a1fac24d6bf005a2ded820ecae3b51b58229a8ce724e98e40b03e1f93d3914948025a76f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\06c34bad-c304-4172-baf0-0654e00b7eb9.tmp

Filesize
5KB

MD5
9e5a92449b384c5b141545dcc41e5b2a

SHA1
ad432cb49dd4081434798f239f29f508aa264c2e

SHA256
da74de63d45895644d78b326d7b1828a7ddfd1d780e41bed942677b0e6e70fdc

SHA512
6fb8987ee07b071e5f1a12ccd183f36e7d226c9a282405765a98d715f402744204c52d97580262178defa014fa2baff266f5513eb87146c64f2d938c00b40600

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

Filesize
193KB

MD5
ef36a84ad2bc23f79d171c604b56de29

SHA1
38d6569cd30d096140e752db5d98d53cf304a8fc

SHA256
e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831

SHA512
dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
6ceceec713b699fdbdd922e5a264298d

SHA1
b6d08969b6f2fc7b895c0772dceb6c862eb1a0b2

SHA256
02a318a39149742a4b159fd708cf3084d6217c3c774749b0aa50d911b0be8c2c

SHA512
38d1c13c828c4cbda8d566b2451cd156981b13fa8b96c0f9d06e40cd8567c111c84cd25e9e7c204b5f3709fe733158604ee724bafb88b9604cf74f23eec79e2c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
6cbe396fd9ba1155ab28457289e20cf0

SHA1
ba274694088d1a8eaf5ae6c67fc0a6dec26a3a18

SHA256
408058a1b2e681c1c8de517b607555fc54b84ad975e660b9a96e9a1a062b1675

SHA512
67556b37bba006294047d120f15cd8182d5488b74f8f1a2e1a692d9f9415dd0f73a7f0f92c8cfa5373ed76993228d336f315b7041422c93ff0b0d648f5c0ce50

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe582054.TMP

Filesize
2KB

MD5
c4d12c24a85b7e1aaf85cad983fe7610

SHA1
00bcb6e962cbc5a3d88689ec2f8c15feda6ff7fb

SHA256
6568b506f3cb4367abf414e66e1e93a4d4e40339dd3a2a1d5ded1f1907484337

SHA512
0d45cd5f36424147b7a67d4f154539d9ddde285cb363a139c5922814e6073cf731d61902a7eb84e9ac6547bcd52e65b023a2f97636072db478ccd04495a59aa6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
82ea91f54330f35583542bb77fce6bc7

SHA1
b18213e17c3b06fcb56e2a0abec824d130f2ba54

SHA256
4a8138e02233dadfba523279b620845732d4cecabcac897a2b55043a49cebd42

SHA512
ab51a230d10c89678d5d49832053dea0ce49e41528aa125e963a2e631aabd38a03670b8d82a8380755957c7dddb6cf3ed34ff3d38c37c2bab164bf6ce137053f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
261KB

MD5
72d30185cf09ef97e00e1d93f9555d07

SHA1
b7a0a9e773019984099779f88071a7837253fce6

SHA256
6ce359e6d95f7e791e94fc0603223bf7910f9befd95b0b2863aeb1dc8888fe27

SHA512
dd3046f1f86eaf1270b08457c77f048fcfebd847ac89d449ea30c82c1e820f13aa093ab30b9173a6390dc5df7130a695d01813253cc822ac34a83cf9c1ffb8b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

Filesize
7KB

MD5
d74141d327b53dcaa7c3ee6b42e1cc05

SHA1
050ccdecd0290d2dbdabf8ed267d19885c363515

SHA256
838f8cce93f881589d285f0b3a04f9b51a56df280a7d7a7f8c9a98114991f506

SHA512
45a7f5d4c69690ace3e2826af7e15a7f7efd7f78bcdb3f5bd59b669ffbdca0bb1ec111b9ab55e96211850c886184949cfffd0da0138c26ca3fb5acf912c16719

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

Filesize
8KB

MD5
70374a04d200979e35071a27f40dbfa3

SHA1
cb0e118bd415417372eaa84af1c93b543076306c

SHA256
c22b466b77df252e917543d20d7b55400f94c6f28d6021df5bdf7c9432e257b0

SHA512
add1578d0bb4099d15b7d1c50254c433f0de345fcbab36fd5ed3e8953acebe8f2f4b7289cbbab2b5f5cd8620fdcf7bda61b2ec7ca068e3f1d2233c8d1b9e5cae

Download Submit
C:\Users\Admin\AppData\Roaming\b2ce92f8c3a5208d.bin

Filesize
12KB

MD5
2e45d1875e55375c32475ccfdf13b4b2

SHA1
f9370dfa0390f74bfcbc9b4fdb3071b57956d7c9

SHA256
000ed8d683e6d0c863fe3cad5f5536765e21e2623238afc71b5a34e5abd87d7e

SHA512
5321e85769f7a132c030db932cec44c811caf6042baaba9e34eed3dfbadd9e2c97bdb5d3f5e31a3451bd3142b897927cda7a7504011d08518e3b99fc37493967

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
588KB

MD5
ad995697093b16e7f9a1d973a8c237d9

SHA1
e42df965b7c124eee42a804bf2f2cba6ed393a39

SHA256
fc50b4076ddab19258ab8d73a88998bedc7808073a92a233da128af978a6762a

SHA512
ec2dc1745444abd3e781345724cf7222774e0e03aa9e78258fceb2d60dd6e10caf764bd72eafad7b24cf48fb45593debd4f41d516bd645ddf3e7c68e0dc6c129

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.7MB

MD5
7efa3959b347e1d6e2184c63bb96f5fd

SHA1
7641260ba05c84c8185bb52d49499f1884c4e967

SHA256
5306b7c3af561a552ff078108df80123b05595588b2e7b15e995efe5162c8d00

SHA512
a6858d3eb2d55bf3480f3f39833dd91c6af8603bf85ec5b1f3c90667bfd0cefc5c1ed94d6314e79a3143de6b58f1c1260c44b57c4ad2191f297e481f25fec5dc

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
659KB

MD5
e5419ed1fa7a7d688b57b2ac7af492e6

SHA1
9e4ce74eb616d95aecf9b5f8f0b68b869e320c0b

SHA256
170f133d340430cf1a88028ed9a439bcfa14f071e8676b2290e3d7906712e8c5

SHA512
a1cfd7f90ec5a5e08cee9ffd0d204311ef985495e26aaae6dcf1daea0ad72b15028d38aff59fe337d03974eb40e96b5a65f6b666ad2a690ad662f68299abb9b8

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
79b2926dc72069e5f0f0000ad554ad62

SHA1
d22e9d78129272e3ce45f188159ecf9eb11e765a

SHA256
bf4f428006dae99b54e280a18e25c1fdecc81c83439f56a088ed594475796d4e

SHA512
196b74619eaf243bcaae1ce8fb9323717d1b29f531dd6a37374919d93bb14779060505ad0b37dc2c3b95a8fb96b1c8ea49e4bd8836c706377a2775871785fc2f

Download Submit
C:\Windows\System32\Locator.exe

Filesize
578KB

MD5
bb0b3c53f31e4e5c6851e95e963d13ba

SHA1
80dbeb568339ba6ef27778823ec6504b9800f113

SHA256
1c01568fd82dc9152ae2989140123c92e2f347ed280822892fbdcdc3f08d0662

SHA512
57c09181e2c7cb12018d59c76c81421f41690b635789d95ccb519ca3b8140df39c8e4c3b1a943701ae31a63d9b0561e1374321b7ed9b013d6ba08d664fe6d64f

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
940KB

MD5
2bcb76974d0826abcd855985065270f5

SHA1
b5aba8033a4ecbd70826c6c653c59952c4b063d0

SHA256
3d24588124addcc9113703a9f1dcd63dd0f60b634ba46245b5dd4631c262a29d

SHA512
6aca4ed1d989dc99702bbe470795d2f990a5990a3dfe055c94b33e16a6d16043a0f38769e241cdfa48b5e83166b54d28ccd5d9621242432654e1c2706685f564

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Filesize
671KB

MD5
aa430819ef1b17aba4e6269a202d92f2

SHA1
c82dce43b7eba519e9a0593a272973a64e14425f

SHA256
b941c30ddd3074995bcce4b8b91f5440eaf69809520f14bc14836c4ece5bd50d

SHA512
faa628e7622bc8222e4a5d43b58996bd65b77e5e868043fa829d9e1376d38d3ad6ad06b24887ec4cf0a604d1cdd4ba604853dec08c8f27c25fe378ac0e2d60e9

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.4MB

MD5
700a2c60f603b566a035397fc94aa1dc

SHA1
179daaabb01c76ad22aa01caaa6613376b151be1

SHA256
1fb224d48da1536e13f07e07d52b5744d724aebfacb1f4c5693b4d73ede60f1b

SHA512
26ba16b41d9a2f6fc7a2041647b66d6e3153a977c1ab9db70ae2cbb21186b672da637f2208a86c20e34f9cd61e46ecfff7551c412b09d8aca20056234537da53

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
f298ed5a5b5e3d864ef1fc3e3dd6f7c5

SHA1
58e3f0aca755c5d11f5da57be1e60052f4df5c62

SHA256
36932ea422d9cb731fd60e4e9b34a897ba4a3f6b56dbdf36fbc0be449fc78d39

SHA512
11f53daaed39f94e3e680209b726b2b7b3e8d6a555af3aab7adc8c51a061bb649550609709522311d4f5f07257df962a2a1b0ff1f36c57d096cf54860decdfa6

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
1.4MB

MD5
a88e5114fb21fa46adaa54893f1d7cc2

SHA1
2117d9614194d915230dcba6b38b5f93e79427b0

SHA256
11d72b00115713adf06abca527ac848b5ed95a60e81b98eb1eec1bd01a34d3c9

SHA512
880957308b01995deabb7d7f9cdde73b583fa38e0538f4136d5559bd3e2906bef6c9ef9a1d377434ea768c1b4206b90f24d3cc9d3123f17833cb9d1d51d6b84f

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
885KB

MD5
c40037c6e6f9d3c67af6267a73183773

SHA1
e4ae6eaa357c670cbd7eae294d83371c92e70878

SHA256
6a40061d2bdd5e6a72e027cd891bcd6c146f7e1cc02d34f2f0724ea3adcd7864

SHA512
e3512ae963084870e8cb9cfda5274fb3be4c63e2b23710511c9476e28860c6bc2f505dd749348a73d85752fcbe878a583b02c39c69e228a5d581a586eaa83357

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.0MB

MD5
bce929b930ef2866aebde84c1d9ad213

SHA1
be1c405c31c4337acc143083261c12fa2631c3af

SHA256
1e44f7e93d839a2f130dbb88c56618a5c778902f2c7b68f72d2971d6710b1a6d

SHA512
b4f2e6cf365164b73bf7e6638039a9676dd389111e830c7bde8949101cd8a8ed5793a7f168350ee470930da2476eb9e82931cdfb50a987bf33f02cbcf6e97946

Download Submit
C:\Windows\System32\alg.exe

Filesize
661KB

MD5
dc6fb088bb2e58c21068d6733457b638

SHA1
edc1964ecfe4acc7ae43ae5a222a3bd46b2dbb0c

SHA256
1e562e6fc0f8ec578c017fa8b0b68b670831cf23c152b405ee27abfe7a604c89

SHA512
3bf88cbce52ef8458bda3abacb51b2532f73c5d3936005892827973104d27276813bac2b4ab152e9dd18c624d2fd4892f505092ce563782d327a9268886ba763

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
712KB

MD5
10acd19e1b4fbf4bacc550c0e1095dee

SHA1
e2a8e488538d65739746c7a5bbe2247d843e52af

SHA256
fac4d578cb91dec371395a839efbb1f6e725bfaa30a64a1acc31a87d9134644f

SHA512
f68f19890d1f78bd36ebf9b08e0286c2f9534f692aa0ee4fd2c8f4e818f4d01ea69f6a225961221ae87a6666bdf06db5e0aa59b52fb4344a0ae1ceb4caf175ae

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
584KB

MD5
d224bea476d89c92da392ca1a8c10084

SHA1
510a3fe842a8358d2e17df307a53465d3c61befe

SHA256
d7c532fe7bee49eb5338a76cb068a752e96a08da9670b3010c54e1ba9459a68c

SHA512
9448a302522e4fa8975b16ddc7238115991535cf89b1dd56e666857ab841863447b31d16e4dcb95a57156a6cc547297f7e803bfd11fba894541a523657c034dc

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.3MB

MD5
945f9e7680156538827647bef2c196ce

SHA1
d3ba350a0326df528f55bae3dc4327b087f7c13d

SHA256
f5b5c003439526e681138013a649b628aab3ad0a408c1b5cfed8378ad2a4b40c

SHA512
babfb56393d2db596ad976eb9832ad344f60599d9d89a2c304ba2d01e4211463e99ae00c8a292e520a501192c7f129716a0db07ffe71022cc77151522261aada

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
772KB

MD5
8c928f572af5398c476aed71643f1f91

SHA1
3f6c4137c72899428dd75cd5c6e8f3cc657d02e8

SHA256
bdf6682aa3a327dd7570a24fd5bfe8c17916b9073029a8d7bf96150d69ae6a1d

SHA512
8eaf6e8135a07bb7f55923f39c87da2b0c3954879944b299b21340b147beb8cb8acc08cdb398b049cdcb5083247c1d458353ca31d0dedc67c065e23da3c61ddf

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.1MB

MD5
9ee39243a7032b066ff75f29f1ea3b8a

SHA1
02f0da6eef2025d1c1ede7b1e8a2e6d239394fbd

SHA256
2454698f78c43d372f59c79782c4900bfd2879566b17e6a88d06a1fe1b2b4eb8

SHA512
b87f64bf7f0eecec8b7f68977ab952ac789f3a02b654a58f08921a89466a0881a38f66e18b35fdd60327727307a192768b14174e5e25e572443faa7e0cbc91bc

Download Submit
C:\Windows\TEMP\Crashpad\settings.dat

Filesize
40B

MD5
de12892063f81f60b11c0497ec332fa7

SHA1
ccfa0530f55d277c3fe6d75260088ae08d5b7616

SHA256
afd8ccad757251c38eecbb67fc9f41af5aecfec62b521b229c5b17e17ba05eae

SHA512
441e809f431b7d1715efa1a6eeda910ba6945b9529a6330cf964a1d8f7233e97893e6eac6758abbeca4c61d315829371fa2e2fa02a5b838d1fb79e7a43b6d7ca

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.3MB

MD5
d421b66ee26f42c1a1f8c9a7fbccabff

SHA1
1b4db13a6dde2328e5fac7a10f4ed40967a3a27a

SHA256
f81155e38f5bca661810c178a46f4ab0f53458ff4f1f4466fe4e3bc930196ae6

SHA512
27913e812a7fc0b95f99d59255632e9277db599868572f84abddddd3680058c64f26112ba8dac58614f3b8e4f7ac87017f0389999be3ec42bf9671eaabdf4200

Download Submit
C:\Windows\system32\SgrmBroker.exe

Filesize
877KB

MD5
c2480cdb0b23d76686603a45502aa2ca

SHA1
248a09108666d62d90c81f6edba68e4b67c0ff1e

SHA256
21ccb278c1b5092b9a963169fe322bb72c046dbea8f991ec25e32117a4f97f6d

SHA512
f675e9e86f5ed9ede627c035d4cf3b56684dc224b1270877eac2f8fb40f17f924f82f135561e2c96711d65a6f74cdbe43f7cc851adc9c1ae84d28fab8045c6b9

Download Submit
C:\Windows\system32\msiexec.exe

Filesize
635KB

MD5
7f87be937f63b6ddd33500aa38336d8d

SHA1
194cfb3d0f2bef37431760aad359f1ea12d9dbec

SHA256
1413b44495e74b92f79a286e07044cec8e338b3b22a1075636620638e6c2538c

SHA512
f07a58ed38f41180f4674d9cfa177150549ec5d2286b48fbcdf8b8d14bfdbde829cbfa3c90946fd51ebb84bbfec5c07e8cae0928c6c1c1b70155701a3d982c7a

Download Submit
memory/440-232-0x0000000140000000-0x0000000140095000-memory.dmp

Filesize
596KB

Download
memory/916-500-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/916-233-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/1040-629-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/1040-246-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/1100-41-0x00000000006A0000-0x0000000000700000-memory.dmp

Filesize
384KB

Download
memory/1100-35-0x00000000006A0000-0x0000000000700000-memory.dmp

Filesize
384KB

Download
memory/1100-45-0x0000000140000000-0x00000001400A9000-memory.dmp

Filesize
676KB

Download
memory/1228-103-0x0000000000500000-0x0000000000560000-memory.dmp

Filesize
384KB

Download
memory/1228-230-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/1392-237-0x0000000140000000-0x00000001400E2000-memory.dmp

Filesize
904KB

Download
memory/1436-80-0x0000000000C00000-0x0000000000C60000-memory.dmp

Filesize
384KB

Download
memory/1436-84-0x0000000000C00000-0x0000000000C60000-memory.dmp

Filesize
384KB

Download
memory/1436-86-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/1436-74-0x0000000000C00000-0x0000000000C60000-memory.dmp

Filesize
384KB

Download
memory/1436-73-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/2096-55-0x00000000008B0000-0x0000000000910000-memory.dmp

Filesize
384KB

Download
memory/2096-58-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/2096-354-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/2096-49-0x00000000008B0000-0x0000000000910000-memory.dmp

Filesize
384KB

Download
memory/2136-628-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/2136-245-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/2340-229-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/2340-93-0x0000000000420000-0x0000000000480000-memory.dmp

Filesize
384KB

Download
memory/2340-99-0x0000000000420000-0x0000000000480000-memory.dmp

Filesize
384KB

Download
memory/2800-234-0x0000000140000000-0x0000000140096000-memory.dmp

Filesize
600KB

Download
memory/3316-0-0x0000000001FE0000-0x0000000002040000-memory.dmp

Filesize
384KB

Download
memory/3316-9-0x0000000001FE0000-0x0000000002040000-memory.dmp

Filesize
384KB

Download
memory/3316-8-0x0000000140000000-0x0000000140592000-memory.dmp

Filesize
5.6MB

Download
memory/3316-22-0x0000000001FE0000-0x0000000002040000-memory.dmp

Filesize
384KB

Download
memory/3316-28-0x0000000140000000-0x0000000140592000-memory.dmp

Filesize
5.6MB

Download
memory/3344-156-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/3456-13-0x00000000020D0000-0x0000000002130000-memory.dmp

Filesize
384KB

Download
memory/3456-19-0x00000000020D0000-0x0000000002130000-memory.dmp

Filesize
384KB

Download
memory/3456-420-0x0000000140000000-0x0000000140592000-memory.dmp

Filesize
5.6MB

Download
memory/3456-12-0x0000000140000000-0x0000000140592000-memory.dmp

Filesize
5.6MB

Download
memory/3868-446-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/3868-31-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/4124-239-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/4220-238-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/4552-235-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/4828-236-0x0000000140000000-0x0000000140102000-memory.dmp

Filesize
1.0MB

Download
memory/4852-60-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/4852-57-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/4864-71-0x0000000140000000-0x0000000140267000-memory.dmp

Filesize
2.4MB

Download
memory/4864-68-0x0000000000890000-0x00000000008F0000-memory.dmp

Filesize
384KB

Download
memory/4864-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Filesize
384KB

Download
memory/4864-616-0x0000000140000000-0x0000000140267000-memory.dmp

Filesize
2.4MB

Download
memory/4872-89-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/4924-240-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/5100-231-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/5612-630-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/5612-442-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/5996-421-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/5996-495-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/6192-457-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/6192-484-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/6264-471-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/6264-631-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download