1cb40c59517f76116fa937e6b2829c03baf26f78d3f95bd2b9883b36726b4fb0

Analysis

max time kernel
1799s
max time network
1768s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
520+ Cosmetics.zip
Size 1.6MB
Sample240616-wevmnsvclr
SHA256 1cb40c59517f76116fa937e6b2829c03baf26f78d3f95bd2b9883b36726b4fb0
MD5 66146c60b3090062ee0e01e068624e47
SHA1 6ee1a07a3d215613126567339193df3de30f4525
SHA512 f09e746dbbd5e335bc022e54ca3e5e26676aedac36e2c35753588f1c9a6e09f47cb5287bf6c7756a50c10d0df304121921dafac9fcd6593867449a92a57a65e6
SSDEEP 24576:0r7Y/x9UBwp3DWXik4ynFaxVtKIQvJCoJ8Zkb+QVSfHKWuqpYF7LeHLXTEECQGv2:0rJQ3+xVeMIQx85KkpYdiLXNovp3M
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SRU\SRU.chk	svchost.exe
File opened for modification	C:\Windows\system32\SRU\SRUDB.jfm	svchost.exe
File opened for modification	C:\Windows\system32\NDF\{B2CA8D8F-0608-495F-A5F9-367ABC8ED5A8}-temp-06162024-1759.etl	svchost.exe
File created	C:\Windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{a2d96c41-46cd-4773-8fbe-e9697ebd1e61}\snapshot.etl	svchost.exe
File opened for modification	C:\Windows\system32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3558294865-3673844354-2255444939-1000_UserData.bin	svchost.exe
File created	C:\Windows\system32\wdi\LogFiles\StartupInfo\S-1-5-21-3558294865-3673844354-2255444939-1000_StartupInfo3.xml	svchost.exe
File opened for modification	C:\Windows\system32\SRU\SRU.log	svchost.exe
File opened for modification	C:\Windows\system32\SRU\SRUDB.dat	svchost.exe
File created	C:\Windows\system32\NDF\{B2CA8D8F-0608-495F-A5F9-367ABC8ED5A8}-temp-06162024-1759.etl	svchost.exe
File opened for modification	C:\Windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{a2d96c41-46cd-4773-8fbe-e9697ebd1e61}\snapshot.etl	svchost.exe
File opened for modification	C:\Windows\system32\WDI\BootPerformanceDiagnostics_SystemData.bin	svchost.exe
File opened for modification	C:\Windows\system32\SRU\SRUtmp.log	svchost.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\rasphone.pbk	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3624	ipconfig.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133630342708838391"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\RAS AutoDial	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\RAS AutoDial\Default	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client"	svchost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
900	chrome.exe
900	chrome.exe
3420	sdiagnhost.exe
1836	svchost.exe
1836	svchost.exe
380	chrome.exe
380	chrome.exe
1836	svchost.exe
1836	svchost.exe
1836	svchost.exe
1836	svchost.exe
1836	svchost.exe
1836	svchost.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe
Token: SeShutdownPrivilege	900	chrome.exe
Token: SeCreatePagefilePrivilege	900	chrome.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
324	msdt.exe
324	msdt.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe
900	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 4212	900	chrome.exe	90
PID 900 wrote to memory of 4212	900	chrome.exe	90
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 3960	900	chrome.exe	91
PID 900 wrote to memory of 4280	900	chrome.exe	92
PID 900 wrote to memory of 4280	900	chrome.exe	92
PID 900 wrote to memory of 2396	900	chrome.exe	93
PID 900 wrote to memory of 2396	900	chrome.exe	93
PID 900 wrote to memory of 2396	900	chrome.exe	93
PID 900 wrote to memory of 2396	900	chrome.exe	93
PID 900 wrote to memory of 2396	900	chrome.exe	93
PID 900 wrote to memory of 2396	900	chrome.exe	93
PID 900 wrote to memory of 2396	900	chrome.exe	93
PID 900 wrote to memory of 2396	900	chrome.exe	93
PID 900 wrote to memory of 2396	900	chrome.exe	93
PID 900 wrote to memory of 2396	900	chrome.exe	93
PID 900 wrote to memory of 2396	900	chrome.exe	93
PID 900 wrote to memory of 2396	900	chrome.exe	93
PID 900 wrote to memory of 2396	900	chrome.exe	93
PID 900 wrote to memory of 2396	900	chrome.exe	93
PID 900 wrote to memory of 2396	900	chrome.exe	93
PID 900 wrote to memory of 2396	900	chrome.exe	93
PID 900 wrote to memory of 2396	900	chrome.exe	93
PID 900 wrote to memory of 2396	900	chrome.exe	93
PID 900 wrote to memory of 2396	900	chrome.exe	93
PID 900 wrote to memory of 2396	900	chrome.exe	93
PID 900 wrote to memory of 2396	900	chrome.exe	93
PID 900 wrote to memory of 2396	900	chrome.exe	93
PID 900 wrote to memory of 2396	900	chrome.exe	93
PID 900 wrote to memory of 2396	900	chrome.exe	93
PID 900 wrote to memory of 2396	900	chrome.exe	93
PID 900 wrote to memory of 2396	900	chrome.exe	93
PID 900 wrote to memory of 2396	900	chrome.exe	93
PID 900 wrote to memory of 2396	900	chrome.exe	93
PID 900 wrote to memory of 2396	900	chrome.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\520+ Cosmetics.zip"
1⤵
PID:5096

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8d89cab58,0x7ff8d89cab68,0x7ff8d89cab78
  2⤵
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1904,i,2715058159025358532,6666027469291204141,131072 /prefetch:2
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1904,i,2715058159025358532,6666027469291204141,131072 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2208 --field-trial-handle=1904,i,2715058159025358532,6666027469291204141,131072 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3112 --field-trial-handle=1904,i,2715058159025358532,6666027469291204141,131072 /prefetch:1
  2⤵
  PID:976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3132 --field-trial-handle=1904,i,2715058159025358532,6666027469291204141,131072 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4380 --field-trial-handle=1904,i,2715058159025358532,6666027469291204141,131072 /prefetch:1
  2⤵
  PID:720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4528 --field-trial-handle=1904,i,2715058159025358532,6666027469291204141,131072 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4668 --field-trial-handle=1904,i,2715058159025358532,6666027469291204141,131072 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3516 --field-trial-handle=1904,i,2715058159025358532,6666027469291204141,131072 /prefetch:1
  2⤵
  PID:604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 --field-trial-handle=1904,i,2715058159025358532,6666027469291204141,131072 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3148 --field-trial-handle=1904,i,2715058159025358532,6666027469291204141,131072 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3280 --field-trial-handle=1904,i,2715058159025358532,6666027469291204141,131072 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4804 --field-trial-handle=1904,i,2715058159025358532,6666027469291204141,131072 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3988 --field-trial-handle=1904,i,2715058159025358532,6666027469291204141,131072 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3288 --field-trial-handle=1904,i,2715058159025358532,6666027469291204141,131072 /prefetch:8
  2⤵
  PID:4404
- C:\Windows\system32\msdt.exe
  -modal "786520" -skip TRUE -path "C:\Windows\diagnostics\system\networking" -af "C:\Users\Admin\AppData\Local\Temp\NDFA69B.tmp" -ep "NetworkDiagnosticsWeb"
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2412 --field-trial-handle=1904,i,2715058159025358532,6666027469291204141,131072 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1588 --field-trial-handle=1904,i,2715058159025358532,6666027469291204141,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=1592 --field-trial-handle=1904,i,2715058159025358532,6666027469291204141,131072 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=3940 --field-trial-handle=1904,i,2715058159025358532,6666027469291204141,131072 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=3516 --field-trial-handle=1904,i,2715058159025358532,6666027469291204141,131072 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=3444 --field-trial-handle=1904,i,2715058159025358532,6666027469291204141,131072 /prefetch:1
  2⤵
  PID:2716

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4952

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3420
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" trace diagnose Scenario=NetworkSnapshot Mode=NetTroubleshooter
  2⤵
  PID:1504
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" trace diagnose Scenario=NetworkSnapshot Mode=NetTroubleshooter
  2⤵
  PID:2892
- C:\Windows\system32\ipconfig.exe
  "C:\Windows\system32\ipconfig.exe" /all
  2⤵
  - Gathers network information
  PID:3624
- C:\Windows\system32\ROUTE.EXE
  "C:\Windows\system32\ROUTE.EXE" print
  2⤵
  PID:1168
- C:\Windows\system32\makecab.exe
  "C:\Windows\system32\makecab.exe" /f NetworkConfiguration.ddf
  2⤵
  PID:4736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork -p -s DPS
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1836

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s WdiServiceHost
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5008
- C:\Windows\System32\rundll32.exe
  "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\winethc.dll",ForceProxyDetectionOnNextRun
  2⤵
  PID:4804

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost
1⤵
PID:1200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NetworkDiagnostics.debugreport.xml

Path C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2024061618.000\NetworkDiagnostics.debugreport.xml
Size 209KB
SHA256 0165eaffeec235cef658c82d551341f6e05c32d8ab859f5617acccf191ec82e0
MD5 7898c210f6092ab95ba912d2cf70ea36
SHA1 d0ebcd4561e0dc1fe6bb1fdad8f676edc290ecfe
SHA512 03a01c831906337cacfaef8eb1d854811dc70894ed87056b95f7f22990af8c2d1122941832b1c354a209d1a38de06246106e95e80499c245bf860446a7057dbf
SSDEEP 768:sL8Ht8ZqG/ANqBa8LjPQDPhcq3IszjPQDPhcuf3IsUjPQDPhcuf3Is1:sL8N8cyA8oPhcqoPhcWhPhcWN
MD5 SHA1 SHA512 SSDEEP

Submit Download

ResultReport.xml

Path C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2024061618.000\ResultReport.xml
Size 38KB
SHA256 4999e42370b2486b1c72bac35abc521a73b8e5c91ea5a66978aac841a1c3f2ba
MD5 92d71573fd5e3dfc694c1ebccfab10a7
SHA1 5ba9a3defbffe804c5b64d73278c39cd1d86613b
SHA512 7efa27723964379510cd1ec1091737d166fa0392543e11c78e499ab7512f519bd79ee33f96981e2c1623c65531fee58339d1f1263f5e7181d9db38f5ba5fa4da
SSDEEP 384:sNgWBkiVHnVH1VH0bCkVPCkViCkV9CkVLVHKx1kV3x1kVax1kVpx1kVuLx1kVGx0:s2X73yxocByro1FUINGG
MD5 SHA1 SHA512 SSDEEP

Submit Download

results.xsl

Path C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2024061618.000\results.xsl
Size 47KB
SHA256 67401342192babc27e62d4c1e0940409cc3f2bd28f77399e71d245eae8d3f63c
MD5 310e1da2344ba6ca96666fb639840ea9
SHA1 e8694edf9ee68782aa1de05470b884cc1a0e1ded
SHA512 62ab361ffea1f0b6ff1cc76c74b8e20c2499d72f3eb0c010d47dba7e6d723f9948dba3397ea26241a1a995cffce2a68cd0aaa1bb8d917dd8f4c8f3729fa6d244
SSDEEP 768:hUeTHmb0+tk+Ci10ycNV6OW9a+KDoVxrVF+bBH0t9mYNJ7u2+d:hUcHXDY10tNV6OW9abDoVxrVF+bBH0tO
MD5 SHA1 SHA512 SSDEEP

Submit Download

6d156f5a-783a-45cc-9c72-84633d1ecea1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6d156f5a-783a-45cc-9c72-84633d1ecea1.tmp
Size 129KB
SHA256 65058057af9b9194a0d906d3fec8157539f9733e94351fd3f9eae0eb0ba883bb
MD5 468113ad8361da07766fe76fe362263b
SHA1 ec46bb12bc4666ec0322f753c745131143e96478
SHA512 a1fcfddc154344569f6cd8c43b6764da1e57b39570bb0752cb225eb17e7017900b9a0a772d7fd61fd0319c19209f850492bdfca62759825ca9a03235a5068118
SSDEEP 3072:alJ5TObcly4nASlCdNpLpDqqnhXNFM35jX0HYw6eGGCBa2DX1hG:aQYRPILxZnhLMJjX0EeGzY2rLG
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 95d76c452f7b71397263b62f7d75234df900c0e2e31a5dbf5d5a762eaf7b39ed
MD5 6d4dfe7a4f1accc37c33c578ae1d0063
SHA1 5e681d6df1d093fcc15c49b7db022edb63b0f0d5
SHA512 fd7ab46435a0b7b2bce0fe6cdde9ffe6f080342ede2b4dbf68e826be2c9d82752c36e8816a8e9bfd99a6b33d7f2a6bbae867f9c16f7ee35d4503320be84b181e
SSDEEP 192:ccc2kJnWpF50aJo8syh+FqUzm6HP5tjEsXtScR:cccnWXCyq1y6RtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 816e64e51ea545038bf3849251044d768d5012b40745c5cf18634a9f4d781780
MD5 144ff995ac4902b4d05b7847eef74798
SHA1 00a8a4b52eb8d5036e4046761613157c04663b0b
SHA512 08ce277fdaba3632ccd33481b1df188660cb5784d3d3bb80adf9b62ca331975ac5c6be8d37aa18ff91eafeb0b061530ff5d2fbc548bc9a691b9810042c3e2ed7
SSDEEP 192:ccc2kJ2WpF50aJo8syh+FYgm6HP5tjEsXtScR:ccc2WXCyqU6RtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 9fdf4df096a0ea5ef79354e332350d1ad727fe3a39d1f9375fb5159dc4484c64
MD5 424aa1dbb5b572246a56e33bace4bd64
SHA1 dfcff44599055c852133ab84b3b13683c4e55786
SHA512 690c6b7aa278ba36e1d4d0fd63a97bee15bb14010a701621003b5cd3ce82a0faa0041ae8b6013393f29f1dcdf169769454b183409a2e913ffdc5e3e31bc02e4f
SSDEEP 3072:ElJ5TObcly4nASlCdNpLpDqqnhXNFM35jX0HYw6eGGCBa2DX1hG:EQYRPILxZnhLMJjX0EeGzY2rLG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 90KB
SHA256 1f5e7d0f38ef1b26078bdfc4ae8e864dd7d904fa558f67759129e0d81b32876b
MD5 84533bf3e19fb6309e1cb27c0bbde9d2
SHA1 fed96d66ff484c85522b2764b18d502ba4439eaa
SHA512 d2eafe6a9c3ca332e427ae6b1c7c2ce8c7a9b83b456aa435333a34b6ad619feeb22bbcf78b2e735623125fbf94f57f5739a37460e5254aa50a4a2824339b5c33
SSDEEP 384:3JcPoxEQvsmUOwTmp9zdWHOs3pMYpTQEStVf+tiCUKfp9bhsrummUjQ04ieozBVr:viQK1Y9N86K9iIvCKLeFj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe58cdf9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58cdf9.TMP
Size 89KB
SHA256 6d9c903d593a75b58084480d91943856f4e477831115915eb3b0ac10b973ec7a
MD5 75dd71f48e994cc13884fc187f885d25
SHA1 9cb22706deca9277cb52284ed748064eba69eb39
SHA512 664ee539e0e64f59dc7842eed0e2182e3929d99a7743cc003196558608f33d712850a989e0b949de82be23056f4db44c80b8b1e013eea64b76a88e44e81e907f
SSDEEP 384:SJcPoxEQvsmUOwjp9zdWHOs3pMYpTQEStVf+tiCUKfp9bhsrummUjH4ieozBVXWB:kiQV1YBN86K9iIvCKLeFA
MD5 SHA1 SHA512 SSDEEP

Submit Download

NdfSession-06162024-1759.etl

Path C:\Users\Admin\AppData\Local\Microsoft\NetTraces\NdfSession-06162024-1759.etl
Size 192KB
SHA256 7057d884adf82b0a9b17a1a000933a51f1f8f59f69efaba698a95ac0509d06b8
MD5 656270bf2c540a7f46f94c6484c65deb
SHA1 f6c35a41b4d79d0a3155c03d218b614b54eb652a
SHA512 771b6744c6b5bf0d1e62afeab51925e62cb5f1372a260d21b3006f2db75c094a6b4bb47dd5ea2eb6d545efcc964345ef4085a5d524986954a9331b1f71e7f1be
SSDEEP 768:qL7Ts+UgTBQtVmq+dv0rNNVvNiUa6NVGdqtDkFkpjidBYnaNy0Y1kcD:ukpz1iJ14jirYnDD
MD5 SHA1 SHA512 SSDEEP

Submit Download

NDFA69B.tmp

Path C:\Users\Admin\AppData\Local\Temp\NDFA69B.tmp
Size 3KB
SHA256 904b48d7f7c6f079ddf5453bfe05bd98118a7e69d0bba17a75f2209a7a5389bd
MD5 e310e5578a38aa0803fe501af84e061d
SHA1 ec4e52893b7da842778df8d6658b356de731249b
SHA512 36465ac3ee139947b6623b0efc85cbf66dc8640dbb41abb613057b7d4b48e816bb67cc4893bd994f4f81d2978397f0a8361b2300eb5fb38cb0dcf01a546bceb2
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_zcjdmt3y.1py.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zcjdmt3y.1py.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

NetworkConfiguration.cab

Path C:\Users\Admin\AppData\Local\Temp\tmp5412.tmp\NetworkConfiguration.cab
Size 1KB
SHA256 518587a7b97829fe2c143284e9d9f8fe8e42ce6f28c107a48d35e73cb5e1c113
MD5 0a5f56dcb9e52f87f1f01e4b137fdab1
SHA1 cbf39f392ed2e6252ff92cdce01c0c6c2a59111b
SHA512 769e63cc7ae3915a46a491141506fdf89c052bad699a461203d7fb23dc67fbbb42bda7d7c645f060a0b728cb3d6349632b2e092f9dfc35a8519ce55a057cb530
MD5 SHA1 SHA512

Submit Download

NetworkConfiguration.ddf

Path C:\Users\Admin\AppData\Local\Temp\tmp5412.tmp\NetworkConfiguration.ddf
Size 231B
SHA256 ffeafbb8e7163fd7ec9abc029076796c73cd7b4eddaeeda9ba394c547419769e
MD5 00848049d4218c485d9e9d7a54aa3b5f
SHA1 d1d5f388221417985c365e8acaec127b971c40d0
SHA512 3a4874a5289682e2b32108740feea586cb9ccdad9ca08bf30f67c9742370c081ad943ea714f08dbf722f9f98f3b0bb307619a8ba47f96b24301c68b0fd1086d9
MD5 SHA1 SHA512

Submit Download

ipconfig.all.txt

Path C:\Users\Admin\AppData\Local\Temp\tmp5412.tmp\ipconfig.all.txt
Size 1KB
SHA256 087a1cbbdd022f919da32704ec22844d0aa01a694bac58b712569029e478c59b
MD5 1d1fd043bfa70261923863a056970d53
SHA1 6bdbec63996e77b42cf12594c335a88ab61404a7
SHA512 666b5ca041a9485dae695d6504b118ee09e182f9d9f9f9e36f85c71253877c2f89b93096619cc13b18dd70cd2f12d4a49ff28b0e1257c50054499a026fcaf88c
MD5 SHA1 SHA512

Submit Download

route.print.txt

Path C:\Users\Admin\AppData\Local\Temp\tmp5412.tmp\route.print.txt
Size 4KB
SHA256 703afe38d78a341153ea0072ba89a98a653c57787e03b8b0cd6740e45b4f47a9
MD5 8edbcf93c1899e8802c44f6a7ac9d36d
SHA1 485c50af5d1968c6473739bb8b3ee9db6371b0ba
SHA512 0d656ff25b92439d84dc5d6b08782f02577cd8f57b420fdd15d513b5fd7478c3b336e75e8e511a2c01c95d38f2ddb588640e134163bae28a8581876caea34aaf
SSDEEP 24:Qc5l1lY4o28EwO+5okAFLKDSumF5cDugq8tau6NkzgReLOSImfckAFLeAasSqgLK:R7N9wO+50sti5cD/tau6NkUDXeAJre2
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.inf

Path C:\Users\Admin\AppData\Local\Temp\tmp5412.tmp\setup.inf
Size 978B
SHA256 d216717c449ddd5a239ce130b3cbf8b481f98bb3bc2ff528ff6834ac1ba2a3da
MD5 876b3bae650ab4e5d89f5fbcbe41b778
SHA1 913c9a6656cd2e18c4e99f7f9359a353e83645a7
SHA512 1c01c50c24e71adec357e73eb116ff5a605df3c10cfb957c12af178ee1d97417899a63412697533a979fce8cbc14c889ecd8a0ae469867b616c81d5399930a13
MD5 SHA1 SHA512

Submit Download

setup.rpt

Path C:\Users\Admin\AppData\Local\Temp\tmp5412.tmp\setup.rpt
Size 283B
SHA256 d35417f10ca4918ab3dfdc8f980b8ecfc47020ad3da182c52ca21a6769c44a0c
MD5 e51733eca9256fe4b6e3d652f3d27203
SHA1 fc1d82867aed574d8fa5789d954247dcb91677c8
SHA512 463d9d1441e68093a659754fd89ae976c23c1ea7ad6954590e8e555133325f068abe5028a654dbd09003838cd60a2dffb021beb873530c52d1e71d672e88eef3
MD5 SHA1 SHA512

Submit Download

NetworkDiagnosticsResolve.ps1

Path C:\Windows\TEMP\SDIAG_22fbf906-8304-4967-9a12-6fb3ee312c8f\NetworkDiagnosticsResolve.ps1
Size 11KB
SHA256 4662c3c94e0340a243c2a39ca8a88fd9f65c74fb197644a11d4ffcae6b191211
MD5 d213491a2d74b38a9535d616b9161217
SHA1 bde94742d1e769638e2de84dfb099f797adcc217
SHA512 5fd8b91b27935711495934e5d7ca14f9dd72bc40a38072595879ef334a47f99e0608087ddc62668c6f783938d9f22a3688c5cdef3a9ad6c3575f3cfa5a3b0104
SSDEEP 192:eLXYPXsa+OjfI9HIufxAey+3OG78/ce+eT5WjifrM+BK:VPXaifqdfxAey+ecmAu7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

NetworkDiagnosticsTroubleshoot.ps1

Path C:\Windows\TEMP\SDIAG_22fbf906-8304-4967-9a12-6fb3ee312c8f\NetworkDiagnosticsTroubleshoot.ps1
Size 25KB
SHA256 e3940266b4368c04333db89804246cb89bf2073626f22b8de72bea27c522282a
MD5 d0cfc204ca3968b891f7ce0dccfb2eda
SHA1 56dad1716554d8dc573d0ea391f808e7857b2206
SHA512 4d2225b599ad8af8ba8516f12cfddca5ec0ce69c5c80b133a6a323e9aaf5e0312efbcfa54d2e4462a5095f9a7c42b9d5b39f3204e0be72c3b1992cf33b22087c
SSDEEP 384:UlSoNnCiXTShob5bbVbgWT6rZTvxlBNexTKmh+xdxBUNQGJ:GSo3h8Jq
MD5 SHA1 SHA512 SSDEEP

Submit Download

NetworkDiagnosticsVerify.ps1

Path C:\Windows\TEMP\SDIAG_22fbf906-8304-4967-9a12-6fb3ee312c8f\NetworkDiagnosticsVerify.ps1
Size 10KB
SHA256 a32e13da40ac4b9e1dac7dd28bc1d25e2f2136b61ff93be943018b20796f15bc
MD5 9b222d8ec4b20860f10ebf303035b984
SHA1 b30eea35c2516afcab2c49ef6531af94efaf7e1a
SHA512 8331337ccb6e3137b01aeec03e6921fd3b9e56c44fa1b17545ae5c7bfcdd39fcd8a90192884b3a82f56659009e24b63ce7f500e8766fd01e8d4e60a52de0fe67
SSDEEP 192:YORm9mJWriv3iriv3oyriv3vgriv3qB3b8FnHayrBJckzrSartt0qF+rSG/rSurT:YORm9mJDv33v3oHv3lv3qB3b8FnHrrBA
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartDPSService.ps1

Path C:\Windows\TEMP\SDIAG_22fbf906-8304-4967-9a12-6fb3ee312c8f\StartDPSService.ps1
Size 567B
SHA256 d19677234127c38a52aec23686775a8eb3f4e3a406f4a11804d97602d6c31813
MD5 a660422059d953c6d681b53a6977100e
SHA1 0c95dd05514d062354c0eecc9ae8d437123305bb
SHA512 26f8cf9ac95ff649ecc2ed349bc6c7c3a04b188594d5c3289af8f2768ab59672bc95ffefcc83ed3ffa44edd0afeb16a4c2490e633a89fce7965843674d94b523
MD5 SHA1 SHA512

Submit Download

UtilityFunctions.ps1

Path C:\Windows\TEMP\SDIAG_22fbf906-8304-4967-9a12-6fb3ee312c8f\UtilityFunctions.ps1
Size 53KB
SHA256 3891846307aa9e83bca66b13198455af72af45bf721a2fbd41840d47e2a91201
MD5 c912faa190464ce7dec867464c35a8dc
SHA1 d1c6482dad37720db6bdc594c4757914d1b1dd70
SHA512 5c34352d36459fd8fcda5b459a2e48601a033af31d802a90ed82c443a5a346b9480880d30c64db7ad0e4a8c35b98c98f69eceedad72f2a70d9c6cca74dce826a
SSDEEP 768:AaDgc60FE2UMeV6HQEqEVBWMBaRNdKdNh5BIW6Mk7svkxtFJuAQQW:j0a4bKcW6MkcSuj
MD5 SHA1 SHA512 SSDEEP

Submit Download

UtilitySetConstants.ps1

Path C:\Windows\TEMP\SDIAG_22fbf906-8304-4967-9a12-6fb3ee312c8f\UtilitySetConstants.ps1
Size 2KB
SHA256 de5c231c645d3ae1e13694284997721509f5de64ee5c96c966cdfda9e294db3f
MD5 0c75ae5e75c3e181d13768909c8240ba
SHA1 288403fc4bedaacebccf4f74d3073f082ef70eb9
SHA512 8fc944515f41a837c61a6c4e5181ca273607a89e48fbf86cf8eb8db837aed095aa04fc3043029c3b5cb3710d59abfd86f086ac198200f634bfb1a5dd0823406b
MD5 SHA1 SHA512

Submit Download

LocalizationData.psd1

Path C:\Windows\TEMP\SDIAG_22fbf906-8304-4967-9a12-6fb3ee312c8f\en-US\LocalizationData.psd1
Size 5KB
SHA256 0637af30fc3b3544b1f516f6196a8f821ffbfa5d36d65a8798aeeadbf2e8a7c2
MD5 380768979618b7097b0476179ec494ed
SHA1 af2a03a17c546e4eeb896b230e4f2a52720545ab
SHA512 b9ef59e9bfdbd49052a4e754ead8cd54b77e79cc428e7aee2b80055ff5f0b038584af519bd2d66258cf3c01f8cc71384f6959ee32111eac4399c47e1c2352302
SSDEEP 96:iLsmw/9nwbgDwlwn0iYveuQzRkkwj0pD+Eij4FvJG5B9c1rO4L:iLsZklGeKxGfw
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagPackage.dll

Path C:\Windows\Temp\SDIAG_22fbf906-8304-4967-9a12-6fb3ee312c8f\DiagPackage.dll
Size 478KB
SHA256 5b7aa413e4a64679c550c77e6599a1c940ee947cbdf77d310e142a07a237aad2
MD5 580dc3658fa3fe42c41c99c52a9ce6b0
SHA1 3c4be12c6e3679a6c2267f88363bbd0e6e00cac5
SHA512 68c52cd7b762b8f5d2f546092ed9c4316924fa04bd3ab748ab99541a8b4e7d9aec70acf5c9594d1457ad3a2f207d0c189ec58421d4352ddbc7eae453324d13f2
SSDEEP 6144:0ZC0lEOC2Us6eEyAc0jbJYOjlCLHUZQsxjuaJ7oSEvcdfSc0jbJYOjlCLHUZQ:0ZFLUe6vJ/wLIvavyfEvJ/wLI
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagPackage.dll.mui

Path C:\Windows\Temp\SDIAG_22fbf906-8304-4967-9a12-6fb3ee312c8f\en-US\DiagPackage.dll.mui
Size 17KB
SHA256 8be175e8fbdae0dade54830fece6c6980d1345dbeb4a06c07f7efdb1152743f4
MD5 44c4385447d4fa46b407fc47c8a467d0
SHA1 41e4e0e83b74943f5c41648f263b832419c05256
SHA512 191cd534e85323a4cd9649a1fc372312ed4a600f6252dffc4435793650f9dd40d0c0e615ba5eb9aa437a58af334146aac7c0ba08e0a1bf24ec4837a40f966005
SSDEEP 96:+mbJmdYVotzW1xcFjPe/dQTVOd5RLQ9/5HgVqz+4MLRvTLGlyQzwv7KCbVeog3+S:+mx1xyexdXeoR4gsgKvHWlTWn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1836-544-0x0000024EAC390000-0x0000024EAC391000-memory.dmp

Download

memory/1836-541-0x0000024EAC3A0000-0x0000024EAC3A1000-memory.dmp

Download

memory/1836-542-0x0000024EAC390000-0x0000024EAC391000-memory.dmp

Download

memory/1836-462-0x0000024EA6790000-0x0000024EA67A0000-memory.dmp

Download

memory/1836-547-0x0000024EA6FA0000-0x0000024EA6FA1000-memory.dmp

Download

memory/1836-471-0x0000024EAC390000-0x0000024EAC391000-memory.dmp

Download

memory/1836-467-0x0000024EA6F10000-0x0000024EA6F20000-memory.dmp

Download

memory/1836-539-0x0000024EAC4A0000-0x0000024EAC4A1000-memory.dmp

Download

memory/1836-538-0x0000024EAC4B0000-0x0000024EAC4B1000-memory.dmp

Download

memory/3420-435-0x00000206CD090000-0x00000206CD0B2000-memory.dmp

Download