6a273f5f366369d881241ef05ec1d02d484a55fe167e0d61477527c7978bdbdf

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17228f9bace397c181bd53adce1a7c60N.exe
Size

4.6MB
MD5

17228f9bace397c181bd53adce1a7c60
SHA1

208e039a29e402fe33abb583562fb934dd33426d
SHA256

6a273f5f366369d881241ef05ec1d02d484a55fe167e0d61477527c7978bdbdf
SHA512

d0457c6f74b7f6603a2eed7c74f547aadb42be83649cf94c100db4f9c5634a238edf4af2e2eecf07baa6df09752f3e719d642a9e55b828c488afe6c85e27f2f9
SSDEEP

49152:XndPjazwYcCOlBWD9rqGZi0iIGTHI6DOnIIeNxu6xl1aZt6m5xbzDI6bpsRJrAG9:f2D8siFIIm3Gob5iEcU023W

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
2284	alg.exe
4892	DiagnosticsHub.StandardCollector.Service.exe
3692	fxssvc.exe
2408	elevation_service.exe
4156	elevation_service.exe
652	maintenanceservice.exe
2004	msdtc.exe
4880	OSE.EXE
1912	PerceptionSimulationService.exe
2320	perfhost.exe
4912	locator.exe
3992	SensorDataService.exe
4612	snmptrap.exe
4636	spectrum.exe
2784	ssh-agent.exe
1280	TieringEngineService.exe
2792	AgentService.exe
3368	vds.exe
1072	vssvc.exe
3376	wbengine.exe
4968	WmiApSrv.exe
3316	SearchIndexer.exe
5356	chrmstp.exe
5440	chrmstp.exe
5536	chrmstp.exe
5604	chrmstp.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3f68362ec8648821.bin	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Windows\system32\vssvc.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Windows\system32\wbengine.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Windows\System32\alg.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Windows\System32\vds.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Windows\System32\msdtc.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Windows\system32\msiexec.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Windows\system32\locator.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Windows\system32\dllhost.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Windows\system32\spectrum.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	17228f9bace397c181bd53adce1a7c60N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\java.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	17228f9bace397c181bd53adce1a7c60N.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	17228f9bace397c181bd53adce1a7c60N.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133649202118454854"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000077db11cb3dd1da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081aa02cc3dd1da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f180dcb3dd1da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000054c2acd3dd1da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000044427ccc3dd1da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007efbd2cb3dd1da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
5480	chrome.exe
5480	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1456	17228f9bace397c181bd53adce1a7c60N.exe
Token: SeAuditPrivilege	3692	fxssvc.exe
Token: SeRestorePrivilege	1280	TieringEngineService.exe
Token: SeManageVolumePrivilege	1280	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2792	AgentService.exe
Token: SeBackupPrivilege	1072	vssvc.exe
Token: SeRestorePrivilege	1072	vssvc.exe
Token: SeAuditPrivilege	1072	vssvc.exe
Token: SeBackupPrivilege	3376	wbengine.exe
Token: SeRestorePrivilege	3376	wbengine.exe
Token: SeSecurityPrivilege	3376	wbengine.exe
Token: 33	3316	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3316	SearchIndexer.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
5536	chrmstp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1276	1456	17228f9bace397c181bd53adce1a7c60N.exe	80
PID 1456 wrote to memory of 1276	1456	17228f9bace397c181bd53adce1a7c60N.exe	80
PID 1456 wrote to memory of 4904	1456	17228f9bace397c181bd53adce1a7c60N.exe	82
PID 1456 wrote to memory of 4904	1456	17228f9bace397c181bd53adce1a7c60N.exe	82
PID 4904 wrote to memory of 1888	4904	chrome.exe	83
PID 4904 wrote to memory of 1888	4904	chrome.exe	83
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 2328	4904	chrome.exe	109
PID 4904 wrote to memory of 1928	4904	chrome.exe	110
PID 4904 wrote to memory of 1928	4904	chrome.exe	110
PID 4904 wrote to memory of 2268	4904	chrome.exe	111
PID 4904 wrote to memory of 2268	4904	chrome.exe	111
PID 4904 wrote to memory of 2268	4904	chrome.exe	111
PID 4904 wrote to memory of 2268	4904	chrome.exe	111
PID 4904 wrote to memory of 2268	4904	chrome.exe	111
PID 4904 wrote to memory of 2268	4904	chrome.exe	111
PID 4904 wrote to memory of 2268	4904	chrome.exe	111
PID 4904 wrote to memory of 2268	4904	chrome.exe	111
PID 4904 wrote to memory of 2268	4904	chrome.exe	111
PID 4904 wrote to memory of 2268	4904	chrome.exe	111
PID 4904 wrote to memory of 2268	4904	chrome.exe	111
PID 4904 wrote to memory of 2268	4904	chrome.exe	111
PID 4904 wrote to memory of 2268	4904	chrome.exe	111
PID 4904 wrote to memory of 2268	4904	chrome.exe	111
PID 4904 wrote to memory of 2268	4904	chrome.exe	111
PID 4904 wrote to memory of 2268	4904	chrome.exe	111
PID 4904 wrote to memory of 2268	4904	chrome.exe	111
PID 4904 wrote to memory of 2268	4904	chrome.exe	111
PID 4904 wrote to memory of 2268	4904	chrome.exe	111
PID 4904 wrote to memory of 2268	4904	chrome.exe	111
PID 4904 wrote to memory of 2268	4904	chrome.exe	111
PID 4904 wrote to memory of 2268	4904	chrome.exe	111
PID 4904 wrote to memory of 2268	4904	chrome.exe	111
PID 4904 wrote to memory of 2268	4904	chrome.exe	111
PID 4904 wrote to memory of 2268	4904	chrome.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\17228f9bace397c181bd53adce1a7c60N.exe
"C:\Users\Admin\AppData\Local\Temp\17228f9bace397c181bd53adce1a7c60N.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Users\Admin\AppData\Local\Temp\17228f9bace397c181bd53adce1a7c60N.exe
  C:\Users\Admin\AppData\Local\Temp\17228f9bace397c181bd53adce1a7c60N.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=124.0.6367.202 --initial-client-data=0x2c8,0x2cc,0x2d8,0x2d4,0x2dc,0x1403796b8,0x1403796c4,0x1403796d0
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  PID:1276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffddf0aab58,0x7ffddf0aab68,0x7ffddf0aab78
    3⤵
    PID:1888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1936,i,3664506059778856436,1654342003449488857,131072 /prefetch:2
    3⤵
    PID:2328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1936,i,3664506059778856436,1654342003449488857,131072 /prefetch:8
    3⤵
    PID:1928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2264 --field-trial-handle=1936,i,3664506059778856436,1654342003449488857,131072 /prefetch:8
    3⤵
    PID:2268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2888 --field-trial-handle=1936,i,3664506059778856436,1654342003449488857,131072 /prefetch:1
    3⤵
    PID:336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3024 --field-trial-handle=1936,i,3664506059778856436,1654342003449488857,131072 /prefetch:1
    3⤵
    PID:3944
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4052 --field-trial-handle=1936,i,3664506059778856436,1654342003449488857,131072 /prefetch:1
    3⤵
    PID:1052
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4536 --field-trial-handle=1936,i,3664506059778856436,1654342003449488857,131072 /prefetch:8
    3⤵
    PID:3040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 --field-trial-handle=1936,i,3664506059778856436,1654342003449488857,131072 /prefetch:8
    3⤵
    PID:5224
- - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    PID:5356
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
      4⤵
      Executes dropped EXE
      PID:5440
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:5536
    - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
        5⤵
        Executes dropped EXE
        
        PID:5604
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 --field-trial-handle=1936,i,3664506059778856436,1654342003449488857,131072 /prefetch:8
    3⤵
    PID:5768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4560 --field-trial-handle=1936,i,3664506059778856436,1654342003449488857,131072 /prefetch:8
    3⤵
    PID:5760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 --field-trial-handle=1936,i,3664506059778856436,1654342003449488857,131072 /prefetch:8
    3⤵
    PID:5452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 --field-trial-handle=1936,i,3664506059778856436,1654342003449488857,131072 /prefetch:8
    3⤵
    PID:5864
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4968 --field-trial-handle=1936,i,3664506059778856436,1654342003449488857,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5480

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2284

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4408

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3692

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4156

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:652

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2004

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4880

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1912

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2320

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4912

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3992

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4612

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4636

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1056

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1280

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2792

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3368

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1072

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3376

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4968

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3316
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1932
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
2.1MB

MD5
22312681be90f1f35f95b7fb6d5508c0

SHA1
555a2973502dcbca918902b4d6c5111354be05d6

SHA256
55b77c6b5859f52e6d983ce0e827d525b2c17a2a3694a0cfb18479ba6c94cb1d

SHA512
0328d5998cc781c7b02236cdc08fb2d156c83599a51a31d53d591d7ea793e9b499f4534f8653784b835065de8dfa2a3882661f1ef2558d88cbd127c537348034

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
797KB

MD5
9db1197e04f6461abe84df0802530cff

SHA1
528ea398d68e5dfa2ab9a5ffed6a034a11c9db57

SHA256
7ff7dc6fca9a3faf33cd4fd51741a22dd2b62eb23f5673ef1321eac683486925

SHA512
fef5ecebe6a085181acccc31dbb54191c40e2b41e6306f84045ec1db43cb9b0e46c1d39e39056bc3f3c38b7c3c02f1ae07c0e5c684bcd3beff2a86c3e7fd92f0

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
805KB

MD5
a312ef139c6d126be999df28291aa643

SHA1
c68c05651d5a816da38ee7970fe3a25d305acba7

SHA256
29bc4d3caca374a23a9d51c836aee3ba5f80078ffd7cf54b4a69b4eb99c13624

SHA512
2e69c326a628be8a9fc4b38152ee93f4014d98e17af0f6b35e7bb5fffea04743e5c7e9054c40a75848af4ec366ca196aa740fdaa625d34f668b7c98d8298265a

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

Filesize
5.4MB

MD5
b9300616627305fdc5cb06e1a8037b04

SHA1
a475a8a48c9fea45d6204d4163b98e0c126b3a33

SHA256
c6774053612e0cd0400476a20508521fb0f2123910ad59320ef904dd1b50a637

SHA512
13d9dcef456caca523db56e86e149de900e715e6958f15c60ee40c3d2abedf44b89cb44bace409ccc1a85fa8551898557732c54f1b6a47c0691bfc52e8f57743

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

Filesize
2.2MB

MD5
18260cb35366197d0873c13e362539bc

SHA1
03466a1017e96a3e152b3d2943d38901f0219cb3

SHA256
871731f547d510890a677c59e0e6797458161fc2ad7617f55003cd5f3497924c

SHA512
d7539f60092e96335f0544a980df14146956f92c0f0ab0ccb2d450c76e5afdd93bddd53d71546ea2277583766df91698fc7a747752fa8ff3cc0f404e12403a34

Download Submit
C:\Program Files\Google\Chrome\Application\SetupMetrics\246d0120-93f8-432d-b8fa-2b6bb01b6b02.tmp

Filesize
488B

MD5
6d971ce11af4a6a93a4311841da1a178

SHA1
cbfdbc9b184f340cbad764abc4d8a31b9c250176

SHA256
338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783

SHA512
c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
89f55681cd116518c116754e0407b2c8

SHA1
f5d4aeb85e94ba181091d6a1ebca93915919c9c6

SHA256
f36101d056932eba1217b54d3ee1c54e0c6c4120087bf1e1e0781625d2be6fc9

SHA512
8db0dc249a77703508e63c8314af4bddcf54ac4f887b26409f743b344b94f9afe762d266cbac8b8097ffb28870d40841c7f64ed60acd087dbc1768db15b1c0cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

Filesize
193KB

MD5
ef36a84ad2bc23f79d171c604b56de29

SHA1
38d6569cd30d096140e752db5d98d53cf304a8fc

SHA256
e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831

SHA512
dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
4d1793d8c333899a5c598437f7935065

SHA1
b38de460110428ead5341494204cf26845e76082

SHA256
07dc266dc7e6f380518255849511f92153d0efc753a83b68ddaef930aaa4320c

SHA512
11665520de14a73a5f6d76e3eea48fac78a3013d7d029d969988b31653f095403668126056197770047acf79a0767a52d7d52205803059245ad75e1708d5b100

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
6934d517cf224dc6b48f712dc065032a

SHA1
fd920d14e9c589635b8b1fd95e25daf2eb67ff72

SHA256
45a3320d2e664a8cb2a8a5b559646357ff8275a3c29856f997ee98716a0737ce

SHA512
0c46c083793954142bb2fefa4e3762de5c653103f3337c77c5ba1d9d3a6a36e15df81941c4c4f3a92f654d1bf20e9062a0b5ba33627e86c5af9e1b2d39df447d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
45c8b5a8975bbb7f96dc6bbdaab9be12

SHA1
4ba4e4cb3c4c819cbd784578b8df9b12a25b5e5f

SHA256
edc2bb50199b237882b1726db02084e0e2307ccec14753ebb103a400f564cdde

SHA512
44e22aae31e12866b2abbc59e396f07c508b232ad5b56be76ae7eebea2b7f2ea525ac40526790906efbbbc4ec43352bc5c26b00f5ff7a9af99ad5e503e1abc39

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe578656.TMP

Filesize
2KB

MD5
8e5632bb5baca5f24f88c9e2a8eb2b6d

SHA1
71f7dee86640b602595b40c6a65d7ed4498cf00d

SHA256
88575950e262396bd009db3c75b18b3a1cd44b7b869b90f9b2c961ce9b74c1ad

SHA512
def476d83ba944f2fe83839108072677672a230218192751dd5e37305d42816e2db59b6f368fe8d3ca8848542ac3e3732dea3a58187c1e14f372ff2f721dffcc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
be612be2a3d3154979f8dedf9b54405a

SHA1
e6469e70a03b3b7918d65712351e22e2ceb6f45d

SHA256
865d775a689774132be152146b2625823ebf81c8cacb13622fd48ae7598e3f2b

SHA512
54cbe46efbdbe0f286d125ef7b53e1678cceca62daee29c84921000f0bc1ba763dc195a11e389c752e16aba446299194d4666928498b83275e6a45bc7fb9fb48

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
272KB

MD5
7b367223c6e0d9c5fb66548d74136aa0

SHA1
051356d6803b3b207e50586ec259a83912c86213

SHA256
d504cdcea12cec6845312d261548f09791073f25de65251452ec79e0ea52eeb6

SHA512
a935c0807f8368a39c339f2f1e78e824a3ad6af08fc818dd05ede7424c8ba77b02c3767e2bab42d4490cabec4fea48b4da34a83fa309064aedbdbe7e09fc62f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
272KB

MD5
d6c28985a8d6c2f098081e8eeb7e57fd

SHA1
46157021489d90aaa32efe0c661a6216588bb75c

SHA256
22f816ba20b0ed3ff14419a03b671ccaabb0189f111e15072bb1d537352fd9d6

SHA512
e6e091ae7dd0b5d88be15b16a2ad880ba9714d2ef5ddbae55e4a821eb8a04f1e55f098999ed3ac8520b5423d2a02c3cab1efd69fa690a87862d956e0353088c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
292KB

MD5
f4c1f91c1f0df2056b70684d88860bb9

SHA1
d78ec3509c0577a6c0fa3e6963082fe5b64ef799

SHA256
64f96e37f3d27a34be747e25561af20fae7f6d9c757f8d830a41ad3253e431ac

SHA512
86c31371afe36ec3d176f49b2d79e1898e3014ec1e9ecede9fa60f9d738757ae860953f83bab5bddb76caf6d2d4727429e9bd9867574803a5f56ada1d829adb9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
257KB

MD5
b5e12d7280f00486d11016f4dfa38999

SHA1
39b3e9a1696192e6116045c170f525d67626f26d

SHA256
972cf64fc4f10dce350f48ec1fce0874366ef1e6964bd08cb0bb0e5320b5be7c

SHA512
5aca0b1a628ed54ee2a0b7b197577b7ea16a21ffb760e5febbcbcb00bbaf0b58ae9d9c35f5fa34d30c3e7f422526a2939b030960741f97b8b287d49ff4151ada

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
91KB

MD5
d6c961051a4745bc6712f089d1be416f

SHA1
61b139d04e533452fae874dcc3af911f43a34a72

SHA256
4cfe613f274525a33d8f0218fa971ea162e1f34a436cf24c6c89521c5346ec08

SHA512
eac0c96c048cf72e3fc529a63ed5effb80638b160d23eef888d979703e5d2d224c31e483e495b4fc9feaf383eee709004e8785e347792ae39306abd8c8167fd2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57fba6.TMP

Filesize
88KB

MD5
8cfd119d0a54f937c3f53c6f42ce39da

SHA1
9e24c3710cc29fedb8820ae3b9f750e899e18052

SHA256
72c23514864cfdb2340d534dd11e41490a6076030216cf3a1feeee865a7efcb6

SHA512
bf711d5bad07e8f4197d1eb35ec7fa169268f3144f065099e5aede4d8bbda0e98656c97b54b51970505e0757b1e93a4443f3a15eb9d6013e1d06bdf02222f623

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

Filesize
7KB

MD5
6e3d5a58d6076e191dcc8f3631f22688

SHA1
48e57b3e054d4cddd59d2642564a200a4bc70fe6

SHA256
e9b7f54c0400085551a49b48db770c1b8dc7d7f0542bc57834909b5a742d3b2d

SHA512
e891e8b949bcffb24dfac6b4427806fd02cc23317a944245ebd57ffb9646b04cf878a01d21594eeceb4547efbffd03e73ce80a32dda79fda33a3fc0b54f1643f

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

Filesize
8KB

MD5
622e69d6bf96bb6b99e9cca03e7394b7

SHA1
2551b28ebc828c88598bcd82f3fe55b67f5c6ff1

SHA256
730962e1a023c7a46952167c08caa671112419be662946b4bb76ed105076e29d

SHA512
e24bfa78f40382ab784c8e7203ec6c8bdef03c3ee53f380440da718671dc6a0f0f1575927f209de8efecc5e26714ddc71bfdafed00a21ef4abd00f74c15d3eb4

Download Submit
C:\Users\Admin\AppData\Roaming\3f68362ec8648821.bin

Filesize
12KB

MD5
175d91418dc90dad70e46a3dab65938a

SHA1
569c0585ea6bd88c6e8a7e9787900c967a2a8705

SHA256
f9646df44600fdcc6052ee35c6d8a5b015f8620a50593810f8e6b2cae9359faa

SHA512
0cb1715ad96a0e66779c9c5612ebb74b29cec8769554a9a2a97676356e4c7a8ce8c578f49a6d9e56d1f52de6bd8934fe26a0b7e8337f9ca1ede229f2b1273c6f

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
588KB

MD5
9a53ebba19dee2193839c9074396e6fc

SHA1
e5206d3540f0af0f94ac60aa86698807c1e21099

SHA256
da37b63478193ad48ea5e35fdde163645c186e020426afa0c7fb7fed868a4d5d

SHA512
375386bcd93271318bc7d4c1490fd032eaa428a5a1fabe06686918aef131dd2f7276c80d96f108a9b2ff17d9a035f4cb5fb0340bd925bc60fbc695dbf669fb0c

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.7MB

MD5
b8af553f5b11eecc6df2bdc791103064

SHA1
9dea8a56669c1ca66a2d56a637a4251c0a5d2518

SHA256
201b92d3da83824b234c0c76805ca351ff5f52b0ea2be26d7bc07a17465f8c84

SHA512
bb1ea616ed21d87da84d9e99272448dab370d6e6b384cb4183fb207e7f61a1c5553a00a15b4b02be7b97be4006386ba297f009f4c66c7882eb52ce64837590a8

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
659KB

MD5
f932941865b0f34ebcf916743c29023c

SHA1
ba55fcc390e4e8b731de4ba33b1a56445b12351e

SHA256
6af8356be0710ab07dd3ec6f9571f49869c6a45e7b9c5c50e86fd24294379cd6

SHA512
f25ac4232214535b15de719f160c1e8e13d014a80031be8dee17eb405ba3702e275568e6343db520a57848bf4adb945a0cebb3ca1123e170b76935c6d822e00b

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
bd8f342f06cf8cd90a499e7c550e6e11

SHA1
6a1e66fe4fe200ab1907c7651ec619ff2013b23e

SHA256
ddb14dbbe8bc0b5160b51bf34d7b952ae0876e626bf372bdb94134aa083c2865

SHA512
6b48ef920dbe62d8bce14e040e733d57cbc9ffb9f8359429dcba3222002b74e82cc6efd513267eb490700ba7d1962fdf199a5a9b9d056467cd98ee6a366b4f99

Download Submit
C:\Windows\System32\Locator.exe

Filesize
578KB

MD5
75c55582ea2e00237535a48b935fc5ce

SHA1
ff75626f52015e2817b6af74ba9cfbe6a47a765c

SHA256
722db045f88bc3cef6cd6c533001677070bea07b5575ca0cd12f974f5cca95f0

SHA512
4a2d5babdfd0c90d7d915d00e03c4aed35b62cfe000711ad69e0643603bc65a85f28acb3eee1ff4be82ab8a0a7e4fe952feb80f91f365bfcc68b6e5984ef18b9

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
940KB

MD5
df979a01af42bd0574913b7738fae183

SHA1
b70e9884466138893dae0b1a4560ddd1840e4e38

SHA256
2f1ff64285c36cdc08066caf345fde95e1fe5f59020ce50d3b25c0deac3ae07d

SHA512
ae7651f7596919daba12783496ee59c288ffa1f94df91ed799d14c276c56035be4613743a0900f4003a8a27879095710fd929df2328f9b70b4856f92101203bb

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Filesize
671KB

MD5
ce8b4c90d93f00a88bf45c1c87aec0fc

SHA1
b56d51312c0bc1833683528d78fbe79e9c32e282

SHA256
928f7bb5fd73137245315d4d23b812fded85f1c4e2559e14b3fe8a366273791b

SHA512
1dc38963de242cad567a4a6f058d5bb2f81ce91b2bd99c4184c06a94493d4990d66ef55e48394a1d1a4b9c842f98059a0153eab2acb1fe9c9ea806be10c49fa3

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.4MB

MD5
4f065fa23e0e36f537b78f6eea44aacb

SHA1
71439dbac23d3c796a36884987616489c41ac9c9

SHA256
ec78332f66d0f5170925c80122b3e9cf701131baaeb7e6b6561a82b271f7cf21

SHA512
d9b48d65d329d7cac0d0b21fde1bba18ba4cf553c9c216d6ef32b24a83b5b056ddd484a7f378a1600dac5f0d223b00dd941be296efa49b89fbf5338e527682e0

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
bfe3014f1994890121ff1e9c49895a9c

SHA1
f4be6b4e14af6e1c0ba56426c0a647904dd6c1e8

SHA256
c86de2daf76c2d62d3d39566fc48c8eefec681935c5ff95b75b7fd5bcfaf941f

SHA512
4b52f5bda9bdd81ef40035e3dbad68a0db7fb802d8b7b8a7a176de330a1532de31163f2353070149e5aeda0d54b75462dd11b5ad75de0d6cf04d6199872d880b

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
1.4MB

MD5
76e38678acedc73276797e8286b7dc61

SHA1
be4c1a6964c7358e0170627d993cb6d858a05672

SHA256
0a456990d5e089f7152f153cfaae70b8224189576b3ddc13cac17437ebac7658

SHA512
1057a2f7cd9f4ea69a46cd38cd24238df30aa9deb7c5051aa593a1f9022ad343e19aa682d8b89af549aa441862a6ece766389459ad8362bbd43cf3716c810a84

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
885KB

MD5
cad3c6d204437b27d3a27e8e46daed21

SHA1
1e099e995cb26be6fc2f897355517cdcd0f49a57

SHA256
a0c8b9202553f784fc22e1c46e83edf7acb410bcd4c419df7575343f0ff2fefd

SHA512
1c4ea04e68b12dbde7c68ed3e88ea89f1fc677633ada31adb3769ed169aec77234ccc320ec8a2d93a1b047036b9eadf6825983331e4e086fbf69cf65d93af0ee

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.0MB

MD5
1f614a63b046e0c9f9521a3ffd348ed6

SHA1
d7b98284ccd8b2b6136577eb602e4031cfe5ac58

SHA256
e3a5904915dfc7b19e5d967d16e13188979f5a85b9f98e90257118e6e4014c30

SHA512
a36485111ff12ea602b1e501b98d970d31b01d4956f5706b10575345617f0d1e3f2b749cacb11f5409d35aea4ef5d344001f686b82cbcd950959bf0fa649642e

Download Submit
C:\Windows\System32\alg.exe

Filesize
661KB

MD5
bd729b17a3a8dc12cdd3669346bb6972

SHA1
f100aa28005cea07d00f1ac860944fd23519fa74

SHA256
1e8dd3c208d43e82220c8d008f083bd350ff89822f9eaa9f93d9e698f0bb3ea7

SHA512
7162986bc6f8f4cfe8343c790ea3d86781b86373b24b0f3d218f852675643451e256f57a27bf6c8a0fde0d339d84233ee2252b2e6d58b3bba79fedab5c6c94bf

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
712KB

MD5
0be127f0e5df5d28d10435374672e41f

SHA1
f3a554ddbe4f6ce662ca6bc90cc6160342e47917

SHA256
9a6cf122a9b8a05e9d3cb96417a02bda8d58ed9f0a03ee85062143eb776dfae7

SHA512
1c58398a5031beadc22cb799ed8d95426d82f5beb5266cc3c95373af4e50ef3318f675d5afa7abcda73891e13f6c31fd9615eff49fd4775937688a82e4c82607

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
584KB

MD5
81e9a9b0cf1feb0be9e9d3cdb533ac72

SHA1
fbe533422e1df614fda764334329b2818662b1c3

SHA256
7557c84a7505063bd9a1929fa5a163842ac4a5bd0285e49249a71c59ca23fc7b

SHA512
45552175af17d54fcc5c0c0f805dcdf5d3f651cad170133c36d4ff924ca5c8671ba1b995c6f3bda3a1b99e805402074d8a442171cbdf8347511e0a5b558d3190

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.3MB

MD5
ac3c0c48faa1985b587ce639c774df3f

SHA1
4ed3549e7163eeeeca357a26f10313a5cfe5914f

SHA256
637d0e3da8a15806b6bded4f312e69ac31f5d1bb9a8db8e73b23f1a8b463dd0e

SHA512
a445da0712a243ef13c52ce3cbf1477c30ccc0c0bfd41e386012bd5e1b51253ebbd0bdefbb862c31d2258390f45b17490f5124dc8e6a2cd4d2d8fe61c5f81534

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
772KB

MD5
cd219b8cd734189c41abbae0cd890d7a

SHA1
0287b76880f39bcf1ba1c7d63cab4d8192d5550f

SHA256
f81e8345dca3a0e444381241ef8ad2e2e31e791550d933ae09d182e1ed60e43c

SHA512
7b426ae506b68e37557c39b31ea298af1b1fa4f03f577a4d06baa4408d2ceeee0e7ec248df637e6e62fd7c9905b741112bf609486924e55e962377ad53f16a3a

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.1MB

MD5
507f6bd16cecd93e05ae7af7c3980bb1

SHA1
eadbce4ec1bf218069e371c0e6bdea954c3629fe

SHA256
b7dc96e140cdbd35402ce7f84276a0a5a74fdb42542a2687eb1f77a249d0a16a

SHA512
90f132c86a71d3eb5dc0b944e874f5b26cc12d0c2b8ae6132520804f9796202f8502dcca7d81c2d3e7fd176f39740fd8a9bcb11a42b1c962a768277ad8734681

Download Submit
C:\Windows\TEMP\Crashpad\settings.dat

Filesize
40B

MD5
63c24fafa38c1b0109d7b33c1be0d22e

SHA1
9b3ae6d17378fa094069f9aef62df034089e3083

SHA256
5928caa89b1d2b710b06e2032deeeb129c5844abc95bb506a96a2181663fdb20

SHA512
1387ef7a3e1e729ec2d22463f44463c5645c772a8336127bbbc7532923abb04b62bbfadf10c12c2f6b50d1ffb567ae4059efe192f3fc0ffdd90ff0cafaacb6b0

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.3MB

MD5
c1192965666da9655784cad000feca3b

SHA1
50cdf2f5327c46f19d53c9b6a233d7622f67daf6

SHA256
1e58162017e86e132f6a4ca3250cea4fc2041d89bbe9c97e8bd60097c21b3d82

SHA512
ed84659cc0bbb3920a047136a549f9640d560b9f824133eb09766d7ab9e176214457dda7ba6096cf0d0dab7425af9a26e6fae75cacf548ada98b688ce81fd69b

Download Submit
memory/652-100-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/652-88-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Filesize
384KB

Download
memory/1072-366-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/1276-29-0x0000000140000000-0x00000001404A3000-memory.dmp

Filesize
4.6MB

Download
memory/1276-11-0x00000000007D0000-0x0000000000830000-memory.dmp

Filesize
384KB

Download
memory/1276-18-0x00000000007D0000-0x0000000000830000-memory.dmp

Filesize
384KB

Download
memory/1276-617-0x0000000140000000-0x00000001404A3000-memory.dmp

Filesize
4.6MB

Download
memory/1280-364-0x0000000140000000-0x00000001400E2000-memory.dmp

Filesize
904KB

Download
memory/1456-0-0x00000000020B0000-0x0000000002110000-memory.dmp

Filesize
384KB

Download
memory/1456-6-0x00000000020B0000-0x0000000002110000-memory.dmp

Filesize
384KB

Download
memory/1456-37-0x0000000140000000-0x00000001404A3000-memory.dmp

Filesize
4.6MB

Download
memory/1456-8-0x0000000140000000-0x00000001404A3000-memory.dmp

Filesize
4.6MB

Download
memory/1912-357-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/2004-353-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/2284-30-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/2284-623-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/2284-31-0x0000000000500000-0x0000000000560000-memory.dmp

Filesize
384KB

Download
memory/2284-20-0x0000000000500000-0x0000000000560000-memory.dmp

Filesize
384KB

Download
memory/2320-358-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/2408-71-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Filesize
384KB

Download
memory/2408-458-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/2408-65-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Filesize
384KB

Download
memory/2408-354-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/2784-363-0x0000000140000000-0x0000000140102000-memory.dmp

Filesize
1.0MB

Download
memory/2792-211-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/3316-634-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/3316-369-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/3368-365-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/3376-367-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/3692-55-0x0000000000530000-0x0000000000590000-memory.dmp

Filesize
384KB

Download
memory/3692-61-0x0000000000530000-0x0000000000590000-memory.dmp

Filesize
384KB

Download
memory/3692-86-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/3692-84-0x0000000000530000-0x0000000000590000-memory.dmp

Filesize
384KB

Download
memory/3992-471-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/3992-360-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4156-633-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/4156-355-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/4156-75-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/4156-81-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/4612-361-0x0000000140000000-0x0000000140096000-memory.dmp

Filesize
600KB

Download
memory/4636-362-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/4880-356-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/4892-352-0x0000000140000000-0x00000001400A9000-memory.dmp

Filesize
676KB

Download
memory/4892-45-0x00000000004C0000-0x0000000000520000-memory.dmp

Filesize
384KB

Download
memory/4892-51-0x00000000004C0000-0x0000000000520000-memory.dmp

Filesize
384KB

Download
memory/4912-359-0x0000000140000000-0x0000000140095000-memory.dmp

Filesize
596KB

Download
memory/4968-368-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/5356-537-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/5356-585-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/5440-751-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/5440-539-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/5536-552-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/5536-574-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/5604-752-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/5604-564-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download