2e0895475f7421cfa9d00e4ee6a03c7a7d23b07556b6f1a473ac5b41b1ef6f92

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 13:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
Size 5.5MB
Sample240603-qqvtxshd37
SHA256 2e0895475f7421cfa9d00e4ee6a03c7a7d23b07556b6f1a473ac5b41b1ef6f92
MD5 8714b8cdd68c77e46652b898291d7408
SHA1 ddbb55960a64b1fc2f733c4fa37706ae80705a83
SHA512 82b706400a8d163385796a1b10842a5dbe9b6f24cd1997762c01c2e969f0a225df0c7caee3a14b69cf19ff476ac334132bd8cd3ce604e4e2efff0ad3265ca6b2
SSDEEP 49152:3EFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1Ln9tJEUxDG0BYYrLA50IHLGf9:jAI5pAdVJn9tbnR1VgBVmRmqrWETR9b
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
4508	alg.exe
3984	DiagnosticsHub.StandardCollector.Service.exe
1780	fxssvc.exe
2768	elevation_service.exe
416	elevation_service.exe
3900	maintenanceservice.exe
4016	msdtc.exe
4580	OSE.EXE
4596	PerceptionSimulationService.exe
2880	perfhost.exe
1996	locator.exe
3560	SensorDataService.exe
4156	snmptrap.exe
4624	spectrum.exe
2292	ssh-agent.exe
3588	TieringEngineService.exe
1480	AgentService.exe
1984	vds.exe
2924	vssvc.exe
4112	wbengine.exe
4504	WmiApSrv.exe
1308	SearchIndexer.exe
5912	chrmstp.exe
6032	chrmstp.exe
3196	chrmstp.exe
5244	chrmstp.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d5da5bcdc3136770.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\javaws.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000650dc0f5b9b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bcf6a1fcb9b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c5bcef5b9b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000052476f5b9b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000179307f6b9b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004bfa44fcb9b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e329dfcb9b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133618949202925076"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb7ff4f5b9b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed5401fdb9b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
6232	chrome.exe
6232	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4204	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
Token: SeTakeOwnershipPrivilege	220	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
Token: SeAuditPrivilege	1780	fxssvc.exe
Token: SeRestorePrivilege	3588	TieringEngineService.exe
Token: SeManageVolumePrivilege	3588	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1480	AgentService.exe
Token: SeBackupPrivilege	2924	vssvc.exe
Token: SeRestorePrivilege	2924	vssvc.exe
Token: SeAuditPrivilege	2924	vssvc.exe
Token: SeBackupPrivilege	4112	wbengine.exe
Token: SeRestorePrivilege	4112	wbengine.exe
Token: SeSecurityPrivilege	4112	wbengine.exe
Token: 33	1308	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
3196	chrmstp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 220	4204	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe	83
PID 4204 wrote to memory of 220	4204	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe	83
PID 4204 wrote to memory of 4900	4204	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe	86
PID 4204 wrote to memory of 4900	4204	2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe	86
PID 4900 wrote to memory of 2116	4900	chrome.exe	87
PID 4900 wrote to memory of 2116	4900	chrome.exe	87
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 2384	4900	chrome.exe	112
PID 4900 wrote to memory of 3308	4900	chrome.exe	113
PID 4900 wrote to memory of 3308	4900	chrome.exe	113
PID 4900 wrote to memory of 4092	4900	chrome.exe	114
PID 4900 wrote to memory of 4092	4900	chrome.exe	114
PID 4900 wrote to memory of 4092	4900	chrome.exe	114
PID 4900 wrote to memory of 4092	4900	chrome.exe	114
PID 4900 wrote to memory of 4092	4900	chrome.exe	114
PID 4900 wrote to memory of 4092	4900	chrome.exe	114
PID 4900 wrote to memory of 4092	4900	chrome.exe	114
PID 4900 wrote to memory of 4092	4900	chrome.exe	114
PID 4900 wrote to memory of 4092	4900	chrome.exe	114
PID 4900 wrote to memory of 4092	4900	chrome.exe	114
PID 4900 wrote to memory of 4092	4900	chrome.exe	114
PID 4900 wrote to memory of 4092	4900	chrome.exe	114
PID 4900 wrote to memory of 4092	4900	chrome.exe	114
PID 4900 wrote to memory of 4092	4900	chrome.exe	114
PID 4900 wrote to memory of 4092	4900	chrome.exe	114
PID 4900 wrote to memory of 4092	4900	chrome.exe	114
PID 4900 wrote to memory of 4092	4900	chrome.exe	114
PID 4900 wrote to memory of 4092	4900	chrome.exe	114
PID 4900 wrote to memory of 4092	4900	chrome.exe	114
PID 4900 wrote to memory of 4092	4900	chrome.exe	114
PID 4900 wrote to memory of 4092	4900	chrome.exe	114
PID 4900 wrote to memory of 4092	4900	chrome.exe	114
PID 4900 wrote to memory of 4092	4900	chrome.exe	114
PID 4900 wrote to memory of 4092	4900	chrome.exe	114
PID 4900 wrote to memory of 4092	4900	chrome.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Users\Admin\AppData\Local\Temp\2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-06-03_8714b8cdd68c77e46652b898291d7408_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2c8,0x2cc,0x2d0,0x29c,0x2d4,0x140462458,0x140462468,0x140462478
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa05d5ab58,0x7ffa05d5ab68,0x7ffa05d5ab78
    3⤵
    PID:2116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 --field-trial-handle=1928,i,7453452985764211805,15025844531946502054,131072 /prefetch:2
    3⤵
    PID:2384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1928,i,7453452985764211805,15025844531946502054,131072 /prefetch:8
    3⤵
    PID:3308
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2200 --field-trial-handle=1928,i,7453452985764211805,15025844531946502054,131072 /prefetch:8
    3⤵
    PID:4092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3044 --field-trial-handle=1928,i,7453452985764211805,15025844531946502054,131072 /prefetch:1
    3⤵
    PID:3900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1928,i,7453452985764211805,15025844531946502054,131072 /prefetch:1
    3⤵
    PID:2152
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4232 --field-trial-handle=1928,i,7453452985764211805,15025844531946502054,131072 /prefetch:1
    3⤵
    PID:5160
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4432 --field-trial-handle=1928,i,7453452985764211805,15025844531946502054,131072 /prefetch:8
    3⤵
    PID:5228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4532 --field-trial-handle=1928,i,7453452985764211805,15025844531946502054,131072 /prefetch:8
    3⤵
    PID:5248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4792 --field-trial-handle=1928,i,7453452985764211805,15025844531946502054,131072 /prefetch:8
    3⤵
    PID:5688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 --field-trial-handle=1928,i,7453452985764211805,15025844531946502054,131072 /prefetch:8
    3⤵
    PID:5896
- - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    PID:5912
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x29c,0x294,0x298,0x290,0x2a0,0x14044ae48,0x14044ae58,0x14044ae68
      4⤵
      Executes dropped EXE
      PID:6032
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:3196
    - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x29c,0x294,0x298,0x290,0x2a0,0x14044ae48,0x14044ae58,0x14044ae68
        5⤵
        Executes dropped EXE
        
        PID:5244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 --field-trial-handle=1928,i,7453452985764211805,15025844531946502054,131072 /prefetch:8
    3⤵
    PID:5596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4824 --field-trial-handle=1928,i,7453452985764211805,15025844531946502054,131072 /prefetch:8
    3⤵
    PID:6964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 --field-trial-handle=1928,i,7453452985764211805,15025844531946502054,131072 /prefetch:8
    3⤵
    PID:6972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=1928,i,7453452985764211805,15025844531946502054,131072 /prefetch:8
    3⤵
    PID:7068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4832 --field-trial-handle=1928,i,7453452985764211805,15025844531946502054,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6232

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4508

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3316

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1780

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2768

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:416

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3900

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4016

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4580

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4596

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2880

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1996

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3560

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4156

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4624

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4328

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3588

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1480

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1984

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2924

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4112

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4504

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1308
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5608
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:5228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 6cadaebfe0aa56f314eda9ce8323af6fe19942a04dccbd94a9cac34b89a4bb2b
MD5 b01f5547878b6c2568d0c3c0d842972b
SHA1 03a6ba1ec22a53465f57528077fe5f548c682189
SHA512 5a088da32b5bf33f141c511b1aabdea94bfac636e1872c2b9305b44ce79b222adaaa51d32d0675dec7471aa8ef30e474d71d8c7d49078e33378edca37d76205e
SSDEEP 49152:yuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5Xm+brLC2hTR9quLB:yPfTqi90bzmqrWETR9b
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 d7764ca85dbec105403e21fa391f8de57ac51b8117b745d5f60d4396b4495833
MD5 83b73eafa476edc7657741722bd91016
SHA1 142363c70b24e70c4242db4dfb1bb3749cfef0f0
SHA512 9c050b6ce8bf58791422da3941222fa036b4463b325239d036250f61f91bb90a81a8cfd9c6c0721b1c361d90393c1ca60674c64030faf09e041a93411988f0bc
SSDEEP 24576:yidnBsuEiRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:BSuNm+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 77d400605aff504e26fc138013aa6a79f9cda2d67380e3b4b9396ad0d7836cb7
MD5 61df2feec4305416ff5f6799587b46a5
SHA1 7c39054e775a42fa64f48be28d9375d0d6c02ff1
SHA512 5ded88e6fc3e3ff99485da68da3a9391c22c6eaf721acdaf67e1f45e371c1836c3719735bd01a730a0e190a8d6cda1706d7b8fc0d68e80aa95cde150ea538228
SSDEEP 24576:6wuoOWfRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:6wDOym+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 30906cdebfd5f073b75f9dde4ad3e140025a14a9743d6a0c07170dc2b721f0af
MD5 36ca479d2f81fa1e6dbb19bfb5669658
SHA1 db8115d8f5614cba40c9a7e766599cb18369fe08
SHA512 fd3781c1ee3c295eee52a4b8dc589e1aac4f85b98b83241e9bc1da86a78b41a53a6e1db33bc30089f93530db7ddf7e13ebd4f8c4749e05515a6a00eb47e41c05
SSDEEP 98304:iwfhY7g/rLd7yYA3awr341gOmqrWETR9b:y78yhE9b
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 31556ff8487ee3a2b8980047a9c9946b9874975a99e8301b477c7dfdddaa1a91
MD5 24dd1db519efaa7b3e5b5b5b50a0024f
SHA1 51e2a9f89c69883f512f7feb607833864b362697
SHA512 a13c7df87137a5f38e52d2e46508171085798686ed8c430b0a05fb3054eb68b418d8526e6de6e10ad159755fe58f75abffafa0d9b825d14ecd9e137f6ab8b72c
SSDEEP 49152:2y7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxzm+brLC2hTR9quLB:dmYeyxHjWjMTzmqrWETR9b
MD5 SHA1 SHA512 SSDEEP

Submit Download

20240603132840.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\20240603132840.pma
Size 488B
SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
MD5 6d971ce11af4a6a93a4311841da1a178
SHA1 cbfdbc9b184f340cbad764abc4d8a31b9c250176
SHA512 c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 d0c09cff1833071e93cda9a4b8141a154dba5964db2c6d773ea98625860d13ad
MD5 757f9692a70d6d6f226ba652bbcffe53
SHA1 771e76fc92d2bf676b3c8e3459ab1a2a1257ff5b
SHA512 79580dd7eb264967e0f97d0676ba2fcf0c99943681cad40e657e8e246df1b956f6daeb4585c5913ca3a93fdfd768933730a9a97a9018efa33c829ab1dea7a150
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 193KB
SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
MD5 ef36a84ad2bc23f79d171c604b56de29
SHA1 38d6569cd30d096140e752db5d98d53cf304a8fc
SHA512 dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be
SSDEEP 3072:HXm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4g2rJBXCy9enoN:HXUMCm4U6q62MEBi99g6JVCvoZhhl+No
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 fe5dfa1691f168093d78f948e42b556e3472b79ca2d85125fd9eebb2b56e51f5
MD5 ba95725430952e865456cebae3f586af
SHA1 7a61d6d541219f1bc77b8cf6bb3f43f5a5eee661
SHA512 18c41274fbc8bda0b92466349ce26b523787456900883863e1e7410d171a296d54d21ec5fc8b0a17c3081789ee2ca2054c22cc8f760499faa70a292c488f2746
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 f509631632fd2625a3720fad1a72094d7ddd524723aaa60e1054d2d4379514e6
MD5 03d6cac21a3f8d0e7c3bdbf5b15d00e2
SHA1 7ff272632552e4f54c32a3579aef791708eaa697
SHA512 f2039d5ad8dee291afcb091105eb688c7a45d0442f51114080923a255eb1c73856a40307d08c95418e885ada9c747b6c34938e55b8568bea10e2ba5435d2293a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 08584267b48743be7f50cdc345e0b0a8207c80c1bd46001a4abb3b9d6d35af84
MD5 f8d275594df8fb9b321335f549967527
SHA1 8356b558f200814a2c90e2b61820bf802818dde0
SHA512 d1406a4ca0db442799fa74d6efbe57ecd8cf304ca5ecd9e6fd13e75ec445c899a9d48879e7d6f3dd6699a0b109f90657b7ec1890336627437125abc41f6f17c0
SSDEEP 96:M+gmzxsX1WikFhFJIkJjwl8iZRy7Dx+6MSmueqBOkZM+2MEVMup:MNixsFWiKhFJ7JI8syh+F6TM+PU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe578db9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe578db9.TMP
Size 2KB
SHA256 d5bb9e1c53b6d6dd67dcfdf3963d7d8b0dd3094ce6a86851e8b8ab7d3d6f235a
MD5 6c38709f2b92b4197d45f6df3df81cb9
SHA1 92d1adb3512f085dba8c03ea68d926704ebbbda3
SHA512 3cc01f22a75c283dd55a4fc9b02211776bc1246ae7787ffeee21a25d0ea8ddaafbb70cbe8d0976356fcff59c9be8e9c178c15264d2a44df3653bb1e03fe41bf9
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 30b671b5201f87929aab6b316203d1c4e071bd0341654a62b1e659d14c737f3e
MD5 f5c045583f512cde019201274f47d05f
SHA1 b694bd8311c4f943594972c6eb36f74140177e35
SHA512 ae2bf6237b6dd422f3f9ea0976d949d55667e949de5ada29b9dece2bf26fdeaf4fc88156b86af0036e6bb385d69e9c4c96d91c3ddf84043d90ec20a8efbc38e9
SSDEEP 384:O2TmLPLeR/X9f1kXqKf/pUZNCgVLH2Hf9kFrUiLHGivE8Y:O0mLPLIv9f1kXqKf/pUZNCgVLH2HfqFk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 257KB
SHA256 c90a124ef2a3153455f4582d251e5af3fd296647e479b81a36c2b9ecc55abc53
MD5 c67d4d27a79cd4856c7a1db916556b53
SHA1 9d0e1007454b9076f84e2a6c752f20c4c857fda0
SHA512 d56c2f7bb20c2a8e519d2f010e89b64908d0d818199f06ebe64bfd01198a41c4111b4c95633d0871b35ef8e4eb2082feb7373f11d74265ef6b19f49b3287a85c
SSDEEP 6144:gZ5IZXqXHjTdCP3y/hQYRPILxZnhLMJjX0EeGzY2rLV:osqlGShQ5fnReEFsLLV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 193bb4277d8e6fdd0ba347c3f2d5aa6405337d28aaf0818160fe27522df628fd
MD5 f5a3d56152e5dd050a3f321570a14db8
SHA1 f023da45284befd442fcd7de2e971093fba004ca
SHA512 d3da0b5c6b690008598f6431059afa78a7cc7bbbd1ebbc7f3a16ea789e7bfc9b4993a8c91643b663750c244ca3ae9d34d9a4fe67a3205d3c92ece2409e353d9c
SSDEEP 6144:AlVHWVzwRNs2ZelhZCFKieFsRZ5IZXqXHjTdCP3y/7:0OzwRNs2YSUiBNsqlGS7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 fb2f0157a62f33583949117e48665d0840c73272745daa22f3fcf8d2f048497e
MD5 6af09b8c97b5c5611b4ec60c90cafec6
SHA1 87fc4f0dff08d1e05e4ac84b4a194a273e061611
SHA512 8c39ef6306a13018779f4dd4b7a8d06727a0c511ef726cd4e33f77570894412eee189255a193b9bd1ddc4367b137258896c06132bc7fb545a50dade2ee98030c
SSDEEP 6144:gdalVHWVzwRNs2ZelhZCFKieFsRZ5IZXqXHjTdCP3y/7:jOzwRNs2YSUiBNsqlGS7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 281KB
SHA256 bbe697ad8fb4a5962ae48f4ad5a9319ee46d6d6c63e4cd199862d91a373eb57c
MD5 203a9b94eadcb93e33967a2ce1e0d19f
SHA1 04d375256e87d5ca03e67c8ea7f992f565e79dbb
SHA512 dd3cc47c8dc2a9e6babdfa83ff5859e97fe8d3d17167928d9afeea80ea8bb9aa30df77b6aa81f0f8fed66775505e28c4df605213f01a9e8be5e86c0d056731c0
SSDEEP 6144:v8xdQlVHWVzwRNs2ZelhZCFKieFsRZ5IZXqXHjTdCP3y/7:vxOzwRNs2YSUiBNsqlGS7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 91KB
SHA256 68ffa66e2f82fb3fbb35c728712730648eda820c4bc6aab38492292b1222e94f
MD5 b61eaf2b06860480e8a0bfff96563ec7
SHA1 549321ce76cf2c3f937893bb525e6ff0def0361b
SHA512 368a8ae2ceaa68a34f82174f2e1cfed163a2a279c24de36b71db6a935cc576bc5f6164b61eed236e3b3f57f020d52d6937038775912748c9c331499c359ad94b
SSDEEP 384:5/IxxEQjxPR7luIA+U9H/5cpdhAaxEPPn6rk/z1vqASbUN71WKQ1D3TzkgXjhx3S:KiQyO9twDer+jHe2KEyFU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe580337.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe580337.TMP
Size 88KB
SHA256 059370b505ddf57db5c052ffe672841baddd1453a43469fff1544fc51997eb2f
MD5 bc004f2e6179d71303ba98d2f743a988
SHA1 33ed1451df64d9917e588e5024985670e8054e3e
SHA512 07e01b1104e4dd910fbb628d01597b1a3b0efeb9bd5aac4e05b0f8c4b89eebeeeaad26b157ac0bf503fea9dd1626658a2dc11cf0c0b38559bf7aabac4ed4e116
SSDEEP 384:T/IxxEQjxPR7luIA+U9H/5cpdhAaxEPS6rk/z1vqASbUN71W+1D3TzkgXjhx3zjT:siQyO9vwDer+jHe2KEyF1
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 7KB
SHA256 9443edbc06a5c0f6e6a321af55486b278b7145516f3b3b19de3527a27514fdc4
MD5 cb0ed3944c9d0cc57652f0bc622b080f
SHA1 1d402e69797e20e8f8fac416a1c5d53489fa8d8e
SHA512 9a82e63cf26be5ba85ebeec9407aeca1146963f8d1515db7208de82529a21b8d8bae9ef0ac74bde2e600b3ca1ec63f2a59f8ddb96c63f8717e4c143479097a32
SSDEEP 96:X04v+feybLGNAwK3yK35EIU4UTR8nsXwK2wbK2Wl+SyfnHNn2NiYP:IbGn/gU98nE/2Nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 8KB
SHA256 b3eff797ee7f79c5b47a7ffa0f50b807dbe87b6f1f0a27f8c8e37a421d0719ab
MD5 c39b59d7dab388686cdd60d694516d96
SHA1 0e19e6ffdcbe7e52e91bae5ea9e5b1fe1f9f785c
SHA512 35a297d27e4aca41aaea6633319a9b39722b6d0351150d0682d5a560710cace944c5f9b19c8d19d32a68308b5f2a5aa81b29705fc8237258a865be52520c36c2
SSDEEP 96:X04v+feybLGNAwK3yK35EIU4UTR8nsXwK2wbK2Wl+SyfnHNn2NiYTXodZKo6wK3Y:IbGn/gU98nE/2NAdZLnX6Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

d5da5bcdc3136770.bin

Path C:\Users\Admin\AppData\Roaming\d5da5bcdc3136770.bin
Size 12KB
SHA256 d1a897577798206f6c05bcb6176a065a898dd6bd614b2d04b71815cf15dc97f6
MD5 fbae7b323f0847ec56c8e93fd426113d
SHA1 777ea812651182a024fff4d5a500b0e8b2bd8fd1
SHA512 37ce66b8672cddd986c7513657bce7bc5aa549864e818d4c69ef104b62a7a48cd01866f70947b78ec7e10490300337895464dc544615ef37bc3b37b32888c7ed
SSDEEP 192:HcbJuYaUKjfPPRIGK3FqsfyE6wQcPzhUMhmHuFWf7YnZX7uEsNh6pvBssIroJdAp:Hcb4JPy3FKwjqkWTYnZqdNh63PIs2
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 09d66fe6d0f8f9f476a3aaf787283217e7a6c19aa64af7f0bc614bd2da588ffa
MD5 81c1e3017fdd11769d5aa1da5e4bf077
SHA1 da06e9e17fd547c1cf2e3cb50722435cd5e3a119
SHA512 984a9fc9374887de6fcf0a2d9a4ebe0b98af2d6dcc3da25fe1e7dbe8c75786089abd7662562092ef576cb60fe93afd3b1d44e80cd37ea1fba543f11eab43ba7e
SSDEEP 12288:jtWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:j4Rmlh8t0D+7y8G2G9yL0cMoThTR9PyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 74c724c4e4be61ca925b8f20c6926a34167255e8eb26d9c8d1bd06ba081ce88e
MD5 799296bd3c245b01df8e5997b5e2e642
SHA1 2e3c373b21a960aa5726f08f52407a2334fafb78
SHA512 b2bc9960a8b8b777ee4c6de2786b4b7f2f7fd3e412d35d5049c860884e3768ecf7e362a3ff78546714697fec195cffbd7d039d7af7dfbd81b61dea194e119f39
SSDEEP 49152:Fa0h2GEkuAe73q3pp46zwwQ+m+brLC2hTR9quLB:Fa0hNYG4JwbmqrWETR9b
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 c99de27aaa1e9453f28f3bf0ae3ee26bb20e1e8278d0bdd0385d9042298a7efb
MD5 7dadebd1c9150eb2d852ea76e46efd8b
SHA1 6cccfcd0fa3e2b0522ba798a520ed3d136cc6179
SHA512 a34931e92528054a06afc3782653848e27442d44fff7c780e1ce7270df2f1ac07d8e70226ac5ff2e09696fb6a579d008deb93901b95b6d1849c0dfe010ab6747
SSDEEP 12288:lhbHjfXuWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:lhbHjPPRmlh8t0D+7y8G2G9yL0cMoThh
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 bc6723129a20d25565513f94995d39f71d37875219c089b004475ba713415231
MD5 5a396c331c4e82ac3f9941dc1530aa3b
SHA1 299901c8966f3cd8d19ff60cfaeeb721353c8e06
SHA512 d89a7648f2bad5a603128e8721f78d3425bd1259ef9db803ee2060e49e6cf78133be49fee4b1211bfaf0715062977063e34d654d172b6dc26354a5d5d8180d7d
SSDEEP 24576:s3YgnJcRTk4yti+R5dBR/fRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:sIgnaTk46pBR/fm+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 bd448b7eea14dcda6a2d0d525c599895ac90731605c8d675a4c93891db089ee5
MD5 26b61ef05cf5193ca614f61d8cbd9192
SHA1 4f98b75259d38ac4c32c2fd8003cb5903ef008bb
SHA512 5958bd715911fa26804ae8ea1a03572c91adf148578b0da8ac709717eb3c0a7e5fed6aa4987874ecd364c0292c8794b381e8bc2c3e715fc7d16b7aa915e88910
SSDEEP 12288:cpWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:c0Rmlh8t0D+7y8G2G9yL0cMoThTR9PyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 a5b674f3ce89ecadefca157f6b0985fd9bf6a2b23f709cdb3e0a0d5c20b3b61c
MD5 e4e7e47bb2e7318ee07bd80b34e4b2c8
SHA1 65a08b508e2add67f1d9b53d327b00e45752233c
SHA512 ce750a84f2e55d9bd56bf5858c1153f04ed812575906fb8f49dbb16405c3b465878c99d0ae0e60f294d606c8acd92e1bade72bcc676bf631708dfd924fb7cdcd
SSDEEP 24576:6pL3UTdRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:6pL3UJm+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 f64a78dcb0986af49ecf38ed050a41548e79d1d7f66c241ba929c6d44bfbcccb
MD5 74f45b84e024564141385da2ee2a2a7e
SHA1 9c030334e987b336ef2661d5c005a6d86a602aa6
SHA512 2f83c14d9bbf06f86cd8864c15bbd9e343eb69a773c2e9231ca3da566ae4e6567caacd51b1b3845855b4adb85d05c807b11f803942c31aa5c9c88f647ac79a31
SSDEEP 12288:npFtpOkWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:LOpRmlh8t0D+7y8G2G9yL0cMoThTR9PN
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 39d9492b008cfc13d44ac7b1d9d30f59368fca62d883d228c23d6390961efb24
MD5 c0b99adafb84867f55e29ccb83a6a34e
SHA1 673e636aeff00cfe43d01031c42ea7fd262b106a
SHA512 c8a036567247afe6b70aee461e42c90cb6f40a0ed2ce4ba9690d4eed77ad7eb9eb6d4d31bd8e05914be57101288ad8117fba921e985dc21fc1509edb3fd90940
SSDEEP 24576:+7NM9YqZqmWMUkPjZM48Mv6bEhsoRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:+7cBWMpPjN8DbEh3m+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 ea695d44220ae5e191fc9994fdd371e3facb90fc2f7d2d6f18bab85a6b3ab470
MD5 d751ae7f48dc6f8568ebd99f1ff088b6
SHA1 f05e3b91af5e4197ef76742360817e3597e8fd61
SHA512 19b98af811af7659c5ba232208cbb83411a7c3ddfb824269627160675c98a6de59b8f599248a81d4f7513a3fd13ecf6f2aaee61ab32af5ce74e54f268b03d253
SSDEEP 49152:ZF2YuHNETovAvNYf8kmIm+brLC2hTR9quLB:M6BCf8kpmqrWETR9b
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 03c03f5dafc9bd82e48332ec77a4ea2b74312fbf253a618677034edf61bf47c6
MD5 917af9ad5208733b2dbadda89c909a4f
SHA1 a451f5b319935300a6495e19d3cb6e318b4d5db3
SHA512 65834c8029da73e54a976ca79c5bce8545b284dad440e017ad89b6f5b67e6c7f4b4439df728df3a9080f0e313f8a1de7ab62892a7a159338c482e5c67ab72fa4
SSDEEP 24576:FAFs06+Omlf3NXEbToVRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:KFs060lVXuem+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 82ec3172bfd071ffb2fbe336548f52785dc994c3f9a880da3c6dc10a71e0292f
MD5 6c2adf1e28c4f89c5cb3d53da26e3a46
SHA1 0f153d6741b5524c94789a0b91032da2e60c0e4f
SHA512 a0df863e0df4c2115443286e97ac29b3e49d8ae16264ddc5304008c0e20c0a36835d9051d3c34f9ec87496f8140df23119c334348f7bf55d0b31d8552242a084
SSDEEP 24576:oJnJ5D3WXeRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:oJnJ5DGXem+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 825ff1f27993c6377f58f8550c17b37fa2e8df64c332e437fe71d7b69d189337
MD5 ed57f8624581ea96048bde76ece1ca6f
SHA1 01a104956c8a4603010bfb5e42f7f0504724cd1f
SHA512 7714242e48c5c4aa4c918b6ada7d4cca3a7888a0e84db6a059751d11ec2c7716df89393b987f33e3113f48fad3f73c6e82f329739299cf9c61d1ce9a0dd633ad
SSDEEP 49152:xg06DIKdwc+eQnSt65aVMm+brLC2hTR9quLB:6imqrWETR9b
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 b37ad03af6ca5797a12cc88c7a9738936db614d28b7616ee26effbfae0694999
MD5 29fe1775990924fdbc6f9d229074acf2
SHA1 7cb472a330e79979cb258e508ceac03f4878590d
SHA512 a264eb15b73e92265d5bd8db9d66af9430a2084a23cb23a33c9c8fd9a6a1ae80fa064990dee5945c10264b27a5427990477ce60f0f493f20b9419f3f82905a6e
SSDEEP 12288:/EP3RnXWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:EnGRmlh8t0D+7y8G2G9yL0cMoThTR9PN
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 957280dce1e1cace20b64729a5190a9e8620aae586be53b9ef956872d16faf6d
MD5 ca632827e7b5e70411c33398e527bab6
SHA1 fc32168b1e05b723ba9e63cd18c0f102612089ca
SHA512 6a451d93bee39510a7682f0f0d9dc5a538a6ff34f1d34988f32e3a740f90b3e2dd25fa98692f4c78b58e5726c54063c9545c47762154999217caa2c3686d1f03
SSDEEP 12288:DjkyWWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:DIynRmlh8t0D+7y8G2G9yL0cMoThTR91
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 78c3257f56f9315ca8268460288686677ab5a486dfab4f649a8d5a3fac5e1ad3
MD5 f72692c0d3b166dbdb439b8f27a3a15b
SHA1 7c53ee95ba12e1a27b5cb5f40e6e6b6e0ac8d31b
SHA512 20b458bcda57bf15480c043580450dcce49b142c41bd47bf3d37d1cb19a9e905f0578dc1d45c2216e027914a205bdc2244f4db8a9710a5d1d4d2560de0abaf14
SSDEEP 12288:Ey0WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:R5Rmlh8t0D+7y8G2G9yL0cMoThTR9PyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 8691e42d19d47ca2d8c742f64d01877ece25999766f1599689ec2d367d164528
MD5 01e5f34ef1d316dc6522ddf59d9f2204
SHA1 3bfe396b9a86ed3071023d75ee3db3d9006b49fb
SHA512 439f0937013a611356c2f6dbcfbca48ee871d6f176f44db823c6e0d739824073ee235c2d516504c58c5fd24b085dd4f7c6ef117ef0d07bac82cef6a8aa4161e8
SSDEEP 24576:TQ9MxZKdcz9dw3ARmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:TVKZAm+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 bc53cbd6b25cd79ded8ffdd69107ef852f31113235596bf76effeef7869a3e60
MD5 b443f59e13731de5ea841f520f066413
SHA1 10b8e360ec6fc50d862a2b959dd541593923352e
SHA512 f027e0fefba6f060328185d55506935c01d52e2715a7f14c42e618074af92d30004be03229e34597959ffc4b21510fc13601cd7c8506e56785e719579e2e4547
SSDEEP 24576:GyocDApzRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:bocDApzm+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 931c351266f05bd8de6e14ebfe986a4808e41eb395be1fdc6af29fe2029c4f47
MD5 f63a395036993b4ea48e7b0a7389299d
SHA1 9b4c7f2621f210d7983035449954c1a4b069396b
SHA512 4c1aba4764df03a8dc761da9543c16a4b1dff7ac87c71edceacbb190a9851869236945ecbc2b30a49f21f9fae699a6aca37a1b4b29dc889ea346b58d4cd9b46d
SSDEEP 49152:5WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKzm+brLC2hTR9quLB:h0zuNIdmqrWETR9b
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Windows\TEMP\Crashpad\settings.dat
Size 40B
SHA256 b04e4a8229ad76f418899a184586a34f1da04653efdd8f0386b76fe7282bd7c4
MD5 8323eb783d4b3475bc1107f7b22fe30a
SHA1 8b61ba2d4ceddcce64913e45b0b3aaedba641153
SHA512 a6e5fa59549dd9f848741b7c5e0e99e3efd1ac639e61a1a430fe7a62e6f13bf625fc22d619b29e9319f0bddd46eda6bd61057d4afcde7c846a72bf6e4ef79972
MD5 SHA1 SHA512

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 29e2a2170a5ac611400da75b925135b2aedcc59f2d87c96e80f96b1ef0cbd638
MD5 45295c24b7407ccecc8e70a73fedd369
SHA1 ef6cac474de12c1aad77944d330549396f6ca04a
SHA512 ee6a1db163795953c4d97dac8c452e04bb46ceb20807033dae15cb838fda4146df95cde6c0ce8a534dde895e22d6ebd042abe0001ad68b569da5d3dbef1c1171
SSDEEP 24576:k1QT7EcpfxR+N5AWAz3ooiYtjMqbGRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:ZTDxR+N5YzTfjM9m+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-17-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/220-19-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/220-431-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/416-70-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/416-62-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/416-68-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/416-580-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1308-288-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1308-582-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1480-153-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1780-48-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1780-60-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1984-282-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1996-273-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2292-277-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2768-56-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2768-58-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/2768-358-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/2880-272-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2924-283-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3196-470-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/3196-482-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/3560-497-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3560-274-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3588-280-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3900-73-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/3900-85-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3900-83-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/3900-79-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/3984-32-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3984-36-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3984-26-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4016-269-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4112-286-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4156-275-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4204-6-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4204-8-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/4204-34-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4204-41-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/4204-0-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4504-287-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4504-581-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4508-22-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4508-475-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4580-90-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4580-270-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4580-96-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4596-100-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/4596-271-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4624-276-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5244-670-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5244-477-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5912-496-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5912-435-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/6032-665-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/6032-444-0x0000000140000000-0x000000014057B000-memory.dmp

Download