f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/10/2024, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
Size 3.2MB
Sample241022-fm56dayemd
SHA256 f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462
MD5 17a073a9c8986b2b481423d67f9b1751
SHA1 eaa353f21e3f6afcc6f2f38e2a69954d935dacd8
SHA512 1c1546d6acfcd9b524856cc54d778e56518d4ddefaac85ca7a74cc0ee4a3834af3cf4d20f4e93fc0bd613a5fb518bd79bd770871535a562b3bae80f2c07b459f
SSDEEP 49152:M5k1YCdptya507NUUWn043oHS3fTGYwVq1/xT3DDbw0TUqyg/snji6attJM:CNhSqYw8y4EnW6at
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
2492	alg.exe
4308	DiagnosticsHub.StandardCollector.Service.exe
4820	fxssvc.exe
1108	elevation_service.exe
1604	elevation_service.exe
3640	maintenanceservice.exe
4404	msdtc.exe
1628	OSE.EXE
3428	PerceptionSimulationService.exe
3896	perfhost.exe
4820	locator.exe
3024	SensorDataService.exe
2972	snmptrap.exe
1284	spectrum.exe
4720	ssh-agent.exe
5224	TieringEngineService.exe
5356	AgentService.exe
5452	vds.exe
5552	vssvc.exe
5648	wbengine.exe
5936	WmiApSrv.exe
6092	SearchIndexer.exe
5416	chrmstp.exe
5164	chrmstp.exe
5680	chrmstp.exe
3228	chrmstp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\system32\spectrum.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\System32\vds.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\system32\wbengine.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\system32\locator.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ac98edf23e6c0d63.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\system32\vssvc.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\system32\dllhost.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\System32\msdtc.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_87843\java.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d81cfb553f24db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d08c6d563f24db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000009ef6f563f24db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf6ccb553f24db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
2640	chrome.exe
2640	chrome.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4364	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
Token: SeTakeOwnershipPrivilege	4256	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
Token: SeAuditPrivilege	4820	fxssvc.exe
Token: SeShutdownPrivilege	2640	chrome.exe
Token: SeCreatePagefilePrivilege	2640	chrome.exe
Token: SeShutdownPrivilege	2640	chrome.exe
Token: SeCreatePagefilePrivilege	2640	chrome.exe
Token: SeRestorePrivilege	5224	TieringEngineService.exe
Token: SeManageVolumePrivilege	5224	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5356	AgentService.exe
Token: SeShutdownPrivilege	2640	chrome.exe
Token: SeCreatePagefilePrivilege	2640	chrome.exe
Token: SeBackupPrivilege	5552	vssvc.exe
Token: SeRestorePrivilege	5552	vssvc.exe
Token: SeAuditPrivilege	5552	vssvc.exe
Token: SeBackupPrivilege	5648	wbengine.exe
Token: SeRestorePrivilege	5648	wbengine.exe
Token: SeSecurityPrivilege	5648	wbengine.exe
Token: SeShutdownPrivilege	2640	chrome.exe
Token: SeCreatePagefilePrivilege	2640	chrome.exe
Token: 33	6092	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6092	SearchIndexer.exe
Token: SeShutdownPrivilege	2640	chrome.exe
Token: SeCreatePagefilePrivilege	2640	chrome.exe
Token: SeShutdownPrivilege	2640	chrome.exe
Token: SeCreatePagefilePrivilege	2640	chrome.exe
Token: SeShutdownPrivilege	2640	chrome.exe
Token: SeCreatePagefilePrivilege	2640	chrome.exe
Token: SeShutdownPrivilege	2640	chrome.exe
Token: SeCreatePagefilePrivilege	2640	chrome.exe
Token: SeShutdownPrivilege	2640	chrome.exe
Token: SeCreatePagefilePrivilege	2640	chrome.exe
Token: SeShutdownPrivilege	2640	chrome.exe
Token: SeCreatePagefilePrivilege	2640	chrome.exe
Token: SeShutdownPrivilege	2640	chrome.exe
Token: SeCreatePagefilePrivilege	2640	chrome.exe
Token: SeShutdownPrivilege	2640	chrome.exe
Token: SeCreatePagefilePrivilege	2640	chrome.exe
Token: SeShutdownPrivilege	2640	chrome.exe
Token: SeCreatePagefilePrivilege	2640	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
5680	chrmstp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 4256	4364	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe	84
PID 4364 wrote to memory of 4256	4364	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe	84
PID 4364 wrote to memory of 2640	4364	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe	85
PID 4364 wrote to memory of 2640	4364	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe	85
PID 2640 wrote to memory of 2984	2640	chrome.exe	86
PID 2640 wrote to memory of 2984	2640	chrome.exe	86
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 2388	2640	chrome.exe	90
PID 2640 wrote to memory of 624	2640	chrome.exe	91
PID 2640 wrote to memory of 624	2640	chrome.exe	91
PID 2640 wrote to memory of 1512	2640	chrome.exe	92
PID 2640 wrote to memory of 1512	2640	chrome.exe	92
PID 2640 wrote to memory of 1512	2640	chrome.exe	92
PID 2640 wrote to memory of 1512	2640	chrome.exe	92
PID 2640 wrote to memory of 1512	2640	chrome.exe	92
PID 2640 wrote to memory of 1512	2640	chrome.exe	92
PID 2640 wrote to memory of 1512	2640	chrome.exe	92
PID 2640 wrote to memory of 1512	2640	chrome.exe	92
PID 2640 wrote to memory of 1512	2640	chrome.exe	92
PID 2640 wrote to memory of 1512	2640	chrome.exe	92
PID 2640 wrote to memory of 1512	2640	chrome.exe	92
PID 2640 wrote to memory of 1512	2640	chrome.exe	92
PID 2640 wrote to memory of 1512	2640	chrome.exe	92
PID 2640 wrote to memory of 1512	2640	chrome.exe	92
PID 2640 wrote to memory of 1512	2640	chrome.exe	92
PID 2640 wrote to memory of 1512	2640	chrome.exe	92
PID 2640 wrote to memory of 1512	2640	chrome.exe	92
PID 2640 wrote to memory of 1512	2640	chrome.exe	92
PID 2640 wrote to memory of 1512	2640	chrome.exe	92
PID 2640 wrote to memory of 1512	2640	chrome.exe	92
PID 2640 wrote to memory of 1512	2640	chrome.exe	92
PID 2640 wrote to memory of 1512	2640	chrome.exe	92
PID 2640 wrote to memory of 1512	2640	chrome.exe	92
PID 2640 wrote to memory of 1512	2640	chrome.exe	92
PID 2640 wrote to memory of 1512	2640	chrome.exe	92
PID 2640 wrote to memory of 1512	2640	chrome.exe	92

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
"C:\Users\Admin\AppData\Local\Temp\f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Users\Admin\AppData\Local\Temp\f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
  C:\Users\Admin\AppData\Local\Temp\f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=92.0.4515.131 --initial-client-data=0x2b8,0x2bc,0x2c0,0x28c,0x2c4,0x140221ee0,0x140221ef0,0x140221f00
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa4703cc40,0x7ffa4703cc4c,0x7ffa4703cc58
    3⤵
    PID:2984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1908,i,8723191348342114349,2352358522958496102,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1904 /prefetch:2
    3⤵
    PID:2388
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2136,i,8723191348342114349,2352358522958496102,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2164 /prefetch:3
    3⤵
    PID:624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2224,i,8723191348342114349,2352358522958496102,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2324 /prefetch:8
    3⤵
    PID:1512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3064,i,8723191348342114349,2352358522958496102,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3128 /prefetch:1
    3⤵
    PID:5068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2920,i,8723191348342114349,2352358522958496102,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3152 /prefetch:1
    3⤵
    PID:2228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4512,i,8723191348342114349,2352358522958496102,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4528 /prefetch:1
    3⤵
    PID:2584
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3776,i,8723191348342114349,2352358522958496102,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3068 /prefetch:8
    3⤵
    PID:2504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4420,i,8723191348342114349,2352358522958496102,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4744 /prefetch:8
    3⤵
    PID:1208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4916,i,8723191348342114349,2352358522958496102,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4780 /prefetch:8
    3⤵
    PID:3284
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4832,i,8723191348342114349,2352358522958496102,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4892 /prefetch:8
    3⤵
    PID:6140
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    PID:5416
  - - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x2d0,0x2d4,0x2d8,0x2cc,0x2dc,0x140384698,0x1403846a4,0x1403846b0
      4⤵
      Executes dropped EXE
      PID:5164
  - - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:5680
    - - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x2bc,0x2c0,0x2c4,0x298,0x2c8,0x140384698,0x1403846a4,0x1403846b0
        5⤵
        Executes dropped EXE
        
        PID:3228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4824,i,8723191348342114349,2352358522958496102,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5028 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5428

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2492

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4308

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2008

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4820

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1108

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1604

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3640

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4404

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1628

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3428

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3896

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4820

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3024

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2972

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1284

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5136

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5224

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5356

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5452

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5552

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5648

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5936

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6092
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5436
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 e9a707ff05e174cba2947d2d0313e5979de50130cd6b2521e0de0fb791350d7a
MD5 4699548a7bb5f55b0bd90bb529fe3eb8
SHA1 5736680932fdbe86499426fe6c7ba436cf995a94
SHA512 b322a23095ce47e41e79cbca5a8d8a0ceacf41520f43db2deda06acd095be12ad648a10aee3614cc7521e2721bea1cfa5657347570f5a655be4c606b32ef1144
SSDEEP 49152:4uYk3H5koUafTqkkYLO/W2buywzMbOX+T7z5B/snji6attJM:4CfTqi90b9EnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 789KB
SHA256 f36cf06628cf3c451d04d8db3e0a0e574f2f79f86ac450b33947bdb967f6f5bc
MD5 d6485d614fd8961640c6a59bc3993446
SHA1 0197a35df0dc55833a7700d013de918be7b4cdc4
SHA512 68ee6761fb4498d3333485d9021c56125f0c89514f6a9e3d36b06656a723b9fe725895740e3f9dade61d1d8a924a1dac2ae89a40343489e65a6b4d3fbb05ba10
SSDEEP 12288:esixPwEsHuXz4Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:eZFwVuD/t/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 cb7ced9a6514f39e6e23b8c0122af1ccd579ad7cac796222508482dd39728941
MD5 16241a048b0681185c11e675317c99fe
SHA1 1ffdd1ba378216a30bb5515fcae6abc543290096
SHA512 4682eb28b1dd5efc74cda91b1dbe46dd63332481c47e426531a7de4905cb1d126fe5e459a52e10fd7260a182e6ef4c1dc10b5a50deb7307f626f675135580118
SSDEEP 24576:0+gkE1fh4Co0t/sBlDqgZQd6XKtiMJYiPU:RgkERSo/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 677d504ac93d7d774824a55b9a5e52f0fe3a4309e4448dc03c486315ff714c4b
MD5 210cbf860513bbab03e21330b0e17097
SHA1 48579b99155d16f983db8ccef67f01904da9e100
SHA512 08aab8d847c5958f06c16ddf768466da05f4f266cce4dcb8f1737d89acfa5628ef4681a0704c8be7ace9db016281a406d001359cffcd08e8f02ad64398591e60
SSDEEP 24576:YBpDRmi78gkPXlyo0GPjrft/sBlDqgZQd6XKtiMJYiPU:MNRmi78gkPX4o0GPjh/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f9beef2fa8c559c35b79873686e9f04c8b3d5a08a29f261a685d3c440379ca75
MD5 af2e6af512f79c2a9a0d28239d3f5df5
SHA1 5ea6ce00528c23c51f30dabb40d90ac73b2c72b1
SHA512 fe9464ad08a99101d835f34e693d7dd2eb1c218ea57ce50820ff3c244c01a8618bfd069b19876c95099df2330665a8d4ed2b800f61ff977eae9b2e339915f642
SSDEEP 24576:1LOS2oPPIXV0t/sBlDqgZQd6XKtiMJYiPU:f/Pp/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 ed67d288629ed311b96881c0a9256d015410e8e41736b20a1ba71fc72be73034
MD5 573c4736d3e199017b65178441399e91
SHA1 5e15c36d39069f3c73136ef9611fc8a855622152
SHA512 b5ce854a2da2ac54c265a3e7020186f0669b306b4ca41d78d7ca866014fb0a038ef8db729e2c9ad90e328c8b66913ced1fca60e805ed95af58832d96aa5894f5
SSDEEP 12288:6ZDGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:6Zyt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 09b30a127c67d731c148f36cfaa1bb1b737f627336eb3cb3238c606cc7589474
MD5 1f779c9a028259fb9f695409b0298745
SHA1 289d1edcbe06d3e6b0e63b8915ec1159e3ce8eec
SHA512 4707266436809fb53f39df343a40a12b6783f44015d26a4fbe8df9c0ea143489215bee474c7775d3b1956e8072a8c6906faa5c5179a75340c5ceb803a05dc7fa
SSDEEP 12288:1eBNUbTVO86USGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:1JIU1t/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a3fbeacdacfad7ec44c177d3b269a5a4b730ea076559a6800d879cfc386a36a6
MD5 1732e622e553d2b995933c3920805377
SHA1 a4ff2dacc27b5e760392b34a0953ac4334cdbae7
SHA512 44bea38d43254ee274a76a83605c50c1c587879b668db84fa0c0b4877f589e9760823ce4014a876b9cb62d4433f3fb015509fa110d1c0fcba0c09a089ce1d142
SSDEEP 49152:6QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THS:6QvGAdlCEL8c/RRNw5CiEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 57d970ed0f554cda85d6f584b1be15a4572c26afb3d312111f2f995be6af4ac6
MD5 3864146fc5a402294726e9992c9106ab
SHA1 4ee946dc5e70e049921ee58448726fca32b9cba6
SHA512 16d490cea9517130592a86a1355894dde87f4e742a3dd6e5642bf290335ef5ddc61566ec7a5d8ed7b6229b5e8d6e908f259fc219f840aa662aa85440fe7987a1
SSDEEP 12288:EAwSfxL/2Dc3DDLLmt0LDQewsAjQGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5+:ZSewsAjXt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f0d01aa4c69d830f531d4662e831e9de58e27569743257c277215e94da377c08
MD5 00531711351d83b8858cbfda8786f88f
SHA1 fb190905b1e3d957a9c87b0bca791a17587eda68
SHA512 589ba3d1b61b0649571911d152aa3c5dc260459cf3c11cacf3f64f6a93fb0ff1ffa51b4d0e3c9f843e73a8aa210e056537a92afe0a5b438320d13f11054449e0
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHqnW9:dUEtQevvqc2W1cpV2RI32q
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7d2df5ce69a99acf8741672caa16c209f04a5708d581be72582f2c46c252efda
MD5 21bd9cb9ed458018a5282a6e7f828753
SHA1 8b3256ed9a3c32bac650a13a719a29c23be7703a
SHA512 9ae7f1e823bece9f7c7a65e1efde7dd26e09527956391c32caa97b093e7aa7cc929800ffa2347b4eec41457f664215badb57403690ffca63e6d15e38525dfb7d
SSDEEP 49152:2CbRquA/m2yL5zifFiV+XenmE3/zd/snji6attJM:7oqHVjnmeEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b5a10c03c050c43f7c5f51a11287c61c70b53e38ba3a6f01c52666e4fc87f48e
MD5 d5581c219d74d584dcdec5fbd65c971d
SHA1 8e7c307826e3aad8fe6dfe4995a8e2aac720375b
SHA512 26d674f050d1410433bdc0180520bc5189491e4b9ed3fdf4b358f98e7ecbcf0e39a0fab683232d74f5bb4a84103f37d9ad39799c8b9a50f29cee111ff77f40f1
SSDEEP 24576:3AhGL2IFoiwtA5l7S53Et/sBlDqgZQd6XKtiMJYiPU:3AM1Foiq5u/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 7b9c1c4657a5eb52e7b25eca218db057cef2532d5cca4bad72554a35b2abefa7
MD5 47e428d2879afa0737a73226b2dc30f2
SHA1 13a2de61dcdcc68792e72945c8a61d43af0b592a
SHA512 217578807e5cf628a828d30cfda493dd7ffd22ae370ec609fcdb66815f849c6344194d544e14f14739e9926e9a01a602d565e8909d1af2ed3c0dc4936c9cd833
SSDEEP 12288:Hmw5HEjsChNSBFgl0WDm+CVGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNA1:GwuXOWjt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 2abde0cd9abc8e99404b378a45c917d004f1728f55b2df89c54d1ec3e66c22de
MD5 31e46c4ea483f875f06195143cd7cb83
SHA1 df7b8ff84f210e7222fd536b5e61ab7314f0dd9d
SHA512 77cc03b447db8e33c4eb3ec38b7ad10d7b7548db7c60fbb54b4921581dbd513215a60867b1dcd6ccff4ce1628975a0cd7abd8f074a6ee798e6aefa0e8f2b3f51
SSDEEP 12288:n/Z1IygGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:/Zu2t/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 d8f9d6e520fadfa51fc792ffb535f6eca0e9c01bab9346c621097ebd1a6cf2eb
MD5 4a31e1dc23566f0758e7f416c3772bcd
SHA1 e0eb3d555098dec5025962b642064eb2fce73d8f
SHA512 d0d98fea3e86923d36c219460a8858e68273abb8323af5a5c2f53a32ac413f03599324226ec70899ab12f9c1369babb7195845a15b97f731475053b701c4d094
MD5 SHA1 SHA512

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
Size 4.6MB
SHA256 564fbb19778bc977adf0dbf47510f0e7e92e57f14373222a627bd828428b0bd0
MD5 285eb1cd799a2cde3cb0fc363c1a388b
SHA1 890beffc3809d272d3500579aedf06a3c6f268fa
SHA512 a5422a8fd70aafa3cd3f5b2e9082e30dfae57d485eb8f1ee11c1b7978ce4e14d97d59028c2a3009f15b184360f1b18ea0da984b258d47d9da18b3f4c4d613610
SSDEEP 49152:GyEKQ5E3ieGR0PEtBFUow1b89eX61t+2xmepn/TRijbqYW3qkCbDypSfe6qwiXEe:Yq9ceqP+2xl/SSayiEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 8c61881131ba90148630a14f8e8302e0832f285a3698a0e094c4b3c198e837ae
MD5 f62e1cc32dec630f16b80d72aca14c36
SHA1 4d75a11cf282257c37c6a5316137757c465737b4
SHA512 21c6185f3bfabf3b5460b8b6ac30360b6e6d26e47bb28f58b87bfac27524b0e1bd264e78189db361e1f92028adaa838a97fd3df5597ddc9e917edc4c388a24d1
SSDEEP 24576:dVN8FYh+u0m/YOn/xvNSkt/sBlDqgZQd6XKtiMJYiPU:dVOyh+u0zyxd/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
Size 2.1MB
SHA256 73672e54b34d7359817d0186702328d8a6ae97cfbbe15e033b9b4e1eeba7fb50
MD5 bc778ab2c6617748865bd87f667bc74e
SHA1 352b0ef1bb0fa9c2bc2414df0e039499f63c4d2c
SHA512 6b85ce4d8a2f2d4eb2bef3b44f6b8e86bbd3f09c082f1b61b63466dc1ab2e1497948e7a73cebba3ea4cc5ce331d082d55722e82b8d7ce95acd163a82a56566e0
SSDEEP 49152:d59PYHvI7wi/AIKuLFrFXlMWGxbgz/snji6attJM:dGgAIKgMkEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

37f603e4-b321-4f4f-81f2-7c15533f9514.tmp

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\37f603e4-b321-4f4f-81f2-7c15533f9514.tmp
Size 520B
SHA256 db3be7c6d81b2387c39b32d15c096173022cccee1015571dd3e09f2a69b508a9
MD5 d7bdecbddac6262e516e22a4d6f24f0b
SHA1 1a633ee43641fa78fbe959d13fa18654fd4a90be
SHA512 1e72db18de776fe264db3052ce9a842c9766a720a9119fc6605f795c36d4c7bf8f77680c5564f36e591368ccd354104a7412f267c4157f04c4926bce51aeeaa1
MD5 SHA1 SHA512

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 282255dae072fbb7a879a6b3b70f153c8655f444bd966c672b68a04757a3af9a
MD5 5044a894f6596a68ec340dfe20c13b56
SHA1 f37f8c5fa88ca9bb2441bcc144200975443f7a90
SHA512 ca9d5a9abe6c681f0a3ea2e3317508268bb13653148886716a18d864b5915af787fa943317b49c554c47102ab50836022a47d458b9a1b78ca40b547be02764e2
SSDEEP 24576:jcP4mcvIjkGOxhKP2l71SNKbrh/8KBet/sBlDqgZQd6XKtiMJYiPU:YP4m4IpOO67N8Ki/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 1f38780e26d345c172793bbdc0d81534fd86a359c80d80ffbb8b830841a8f56e
MD5 68c9f335d91dc07c74fff896118b1f07
SHA1 054392d89449678f34bf7f3aeb8738e641a9e990
SHA512 d60387623178f618798be9b66e4f741cacf68a1d84ee8f2111bd53aaf56dbf0aae398855f08067da2939ff0913eb0a6624d99e9b9e12ae36db53b282103ee00f
SSDEEP 12288:wUFmDDLeGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:KRt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 750530732cba446649e872839c11e7b2a44e9fb5e053fc3b444678a5a8b262ac
MD5 0cbe49c501b96422e1f72227d7f5c947
SHA1 4b0be378d516669ef2b5028a0b867e23f5641808
SHA512 984ea25c89baf0eb1d9f905841bda39813a94e2d1923dfb42d7165f15c589bd7ff864040ec8f3f682f3c57702498efff15a499f7dc077dd722d84b47cf895931
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 7507bcfad36d2054f51b3691ba8bace925156a0f757d3f13f4afc0eb6a8b034a
MD5 7b3a1afc3e7721567650904b869e9168
SHA1 632fe5f86987db990df1ca51680d634251403d08
SHA512 0807a93dccb45bf4bfe872358f0a85ca9fd4ae5c9877df433dbb796d7b067af4c05f5da711372e9f01650973d5628d392dccdddae5f6fd8946184728601174d6
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 b8a7649c907c010db609d7143f3f0601a385b9cf803f4b0bddb449c41151cc1f
MD5 a8cf54419129b874864cf206392ece0f
SHA1 2d8f78e5d6951faedba3257d5794227f34c50967
SHA512 02a77857be5123636fdc44791f6cf7a4532fa53e34576be7f6ab21da51ef400fc138d7dda6a2880b2b42ddb22a803a1897e4f95ea3479487af61a199c7929a8c
SSDEEP 3072:YXm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4g4c3FDznFdD9w:YXUMCm4U6q62MEBi99g4c3FHFv0vQ+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d8512d3ac8c77844f4f31a828d7e866694dea3e1380a63a5f299a59c31f928af
MD5 69ed7046a80482920c946a9ed8ff3eec
SHA1 c622291587c79b9edb497a5cacf5cbee21ac3efb
SHA512 8d35f051f73ef707d2172bf09cef194787b4531a26aa277377facda773cef815b7f17d75981d3457fa12ac5513c890c7d29955bf425ca17ae65ee301a1ad7535
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 55ccb7a862439061d5805bc41d11ba337bd3a91c6c205cb10364497aab52aecc
MD5 7e588c5115eb91c0d9cbc37d7e33e66c
SHA1 d45d179d25db77e658bf0691314d5be317fdc71a
SHA512 b28787d573ef27d5bcb6f08575ca849a7697f74808a0ea986ebb2b4441c32305242d9d56dc8653b5570ceb9413fbee0950428c23ca761a827bbc33832b89bb24
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 58a15c20a676c7b7f7ac3b382d1ec00b64474086ecedaf6fb46dbadccfb2a712
MD5 32476b19bca6abe88e47b831af7d4730
SHA1 1e4014e72fc672418c0ebb750bdf6100dfc8dcf8
SHA512 c5511582c868b3daaac9cad8280fea31fb500ea5673fc70c9b372dc16a31e42b65a12cd905144b59cf1758945250d5ca8c819f145f2f5af4fc135faa1dfdbb9d
SSDEEP 96:R990X5GbrKCHCWY16Z7X7/x+6MhmuecVRBO6N+Bwq2CKoC2MoAy8yIsnVqAhgtpI:RT0pOqWjXV+FRbYeq2CK1Po6yIsnVdg4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 c73ab635fa8f52e51c752a64af10d587acb1b39785809ff8a4a5ed5a11b518f0
MD5 aeb4a871f3af4544dceaa805e0b434d5
SHA1 cc32cc98d98ae13d04f272ddedc974051f1c528c
SHA512 0c2b80780ca61c2727c79aa73e7c452f3ce666765290593552466f8441bd64654501b20113acedfe6cce5787d008633b33e4da9653632903d70eea746993210e
SSDEEP 96:R990X5GbrKCVCWY16Z7X7/x+6MhmuecVRBO6N+Bwq2CKoC2MoAy8yIsnVqAhgtpI:RT0pOwWjXV+FRbYeq2CK1Po6yIsnVdg4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 eabf4b73f3d4fcbbcf93b8fe9c299e2d7f1ffa4b51a354952be9b325f3812dbd
MD5 8b5762bc8a81a9a32cd814ed82f38517
SHA1 d918ac63c01d9a44271409815515a9ecb06814c4
SHA512 eeac2f7092919d9ddb4876b715d0372fa06688f32e207cbabf2624d779547084f6f6e4e343a35e054121c0fa051d0c8bcd530e007b26ee1a87ca675b25e5e15c
SSDEEP 96:R990X5GbrKC6yCWY16Z7X7/x+6MhmuecV6O6N+Bwq2CKVX2MoAy8yIsnVqAhgtpI:RT0pOSHWjXV+FRneq2CKtPo6yIsnVdg4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 91e17eef9c665e3eb29b4484be1026c9c63194dea32531aae29b13dd18eca1e7
MD5 db320a70bc935e2374e54c5bb5a72bbc
SHA1 0f351991124954246c94d3da6b5f81d773ff1384
SHA512 6592a39c44b42889ea20fcf040dd9d484dc90fc6fcb2523e10020d4b6f3d9ac64efe7b7c1cafe920b17c4881b68eb99348041f9ebd9281fcbbdcf8d3cd8a59ae
SSDEEP 96:R990X5GbrKCcyCWY16Z7X7/x+6MhmuecV6O6N+Bwq2CKVX2MoAy8yIsnVqAhgtpI:RT0pOUHWjXV+FRneq2CKtPo6yIsnVdg4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 e0c5d61b3c33eff0a36ad78363e531836a2ed970fbbeaec0f4223e86e338fae7
MD5 91d85563986dd45ca0e35a10f3939c50
SHA1 fa845151606a26d96b6f3478c0460d48e967e5d4
SHA512 c48b550ef870cea7765e3ff2089a2114df1efaea9276b08303c94b5285ff97cc8602bf572021b445923bb96dcfe882d624aec99702edd54ac128eccd7be22821
SSDEEP 96:R990X5GbrKCSCWY16Z7X7/x+6MhmuecVdO6N+Bwq2CKzX2MoAy8yIsnVqAhgtpup:RT0pO/WjXV+FROeq2CKTPo6yIsnVdg4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 45936a1c4cd37f2980068f47b6dd65913c4e0cd31b0382109949a4052cd49ee5
MD5 1dc20de039a3ff61dd9fe4b71be9b6c6
SHA1 5665f2a51a77525cf3279226af05a01f74fa8d17
SHA512 8da123260d50dada804a2bf5cf502a26a2a0b9d3f74c847e17a51c56cdf029868c83f89307a8dbb772d4975a88c95ec2fcf2ba328fbb875b2f66f854da8ddf9c
SSDEEP 96:R990X5GbrKCpCWY16Z7X7/x+6MhmuecV6O6N+Bwq2CKVX2MoAy8yIsnVqAhgtpup:RT0pOcWjXV+FRneq2CKtPo6yIsnVdg4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 fc802a73f75de54215f993df5c17b50862aaa4ea94889d24b250cced0477172b
MD5 949a4fb3b66c2924138661c2d084e2c4
SHA1 d9eacb0375ce27860a9282c412444ff030125c9d
SHA512 23cb074150cb527d5b51f821c74b95c6dec644db25e2395b0011f06111b94947c0b5baefbbb6810999786e10ceac710be63e20e45620f63b1d491721f557caf1
SSDEEP 96:R990X5GbrKCIyCWY16Z7X7/x+6MhmuecV6O6N+Bwq2CKVX2MoAy8yIsnVqAhgtpI:RT0pOAHWjXV+FRneq2CKtPo6yIsnVdg4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe57a141.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe57a141.TMP
Size 1KB
SHA256 fac02b374327f114e2e82b642acfbc31f7814c6a3245275658dc73d9cf1883eb
MD5 537a9e53b104bce731a71088b038c187
SHA1 3ee635e8355696f136c1aa7aa358b5a43c977dfa
SHA512 28c7c0b9863552ab3f24fe4137270951c737fa9802d0ea39d99cac241b4449e0fbdf4da52ee37db36c0175b81cad2bbe22a42b57bc2d743be3e87bbf265e36a3
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 d61b476faf454986d9718a62c28195707388b4f4743f0473ea7ef770447e9874
MD5 e5c194ab10535a41f9c8bc08fec5d672
SHA1 51aec978d1ffa416ace834ccf48c3b55a361149f
SHA512 dae74d7475db76b65bc4a497fdb11b9bd5fd98a15241d9e4f84c3e368fea727db5204480b2f274e6d3a6d935da56efd02ab892198c8ec42a5eae66cd4d7898f7
SSDEEP 384:xFbX7pLhLcGQJsX6I1kXqKf/pUZNCgVLH2HfSp8rUqkHGr0DMKgccGX:xRX7pLhLLo+6I1kXqKf/pUZNCgVLH2HC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 230KB
SHA256 5278c970093b2cf7ac090a92e81290cbd96a1d675f860da15634e74845b7a249
MD5 00264c05ebdd203ae37db15fc5528e88
SHA1 5d4cb3cc58f8cbcb95723d1c3ea177921b5708ca
SHA512 1a659da3cb188c021275c4854464b62bced9ad0699e2fa23d2ea40a3510f7be266a2f4ce62d520b38f7d3d6319401359a85a7f1e9455d611cc7059df6f2035dd
SSDEEP 6144:C7MKWl6o363NH7jXqlQnkNUZt46Jlxse6HWNj6YHgta9eX:uWwo3u7OqkNY46Jwen6qgtaS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 230KB
SHA256 7db8ff87879749f30df817fd77b55ef7bffe71d6a6667a11cb02f245e0a1da0a
MD5 411afdbc0b0f675ebbb6bc2fd131db53
SHA1 25f8d81ddf775048957a53cd16bd181719dfe46f
SHA512 339fd852687043bb191be5d43377ae475d4f3f6adffaaf981359c257ba451f052cadb8096d6f317dd55f12eafd5cd1fda86b7c78a3605acb0096779b1357b7e2
SSDEEP 6144:D7MKWl6o363NH7jXqlQnkNUZt46Jlxse6HWNj6YHgta9eX:PWwo3u7OqkNY46Jwen6qgtaS
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 7KB
SHA256 a93607ffcb411861b0c5dcd5a5e4b50693812f71a49cd358aef1f50a62e13d09
MD5 a385306f3255688382700a7ffbde9300
SHA1 80b3995b427e8c248498f060eb5bc6cac40e5801
SHA512 d1eb9165cf0c53703e99d0342807f349d13e6e014c10f5ec2d0d890ba53bb038c6bf0babab4c0c773ef4b88e3e33234960ab935039d2e25045869c40648b1c1e
SSDEEP 96:7R0hmSW7qxP9RRqcPigvK3HK3izqtNCCqMOrAvK2fK2ujq05UN0L8diUq8:7zSW+xlRYMiWKxmTCfFr2JYWNdi98
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 8KB
SHA256 81fa530a28144a82d658844add9a0ffdba237c400c6be2100c4b4a7d609f3428
MD5 72f29e4384743d8e24bce997281d26fa
SHA1 960935de0af3083602a4161ba51495d88b44e536
SHA512 28568970092d1a2a59dacc9453f18fcc0235630c4052d486a35188b51d5091991d3c94e42ad366032abfc5e7acbb04f4da1d38e3f114fe037251c6c421c8ed28
SSDEEP 192:7zSW+xlRYMiWKxmTCfFr2JYWNdi9cCijk1A:6j6eKsTuIJ5jESj+A
MD5 SHA1 SHA512 SSDEEP

Submit Download

ac98edf23e6c0d63.bin

Path C:\Users\Admin\AppData\Roaming\ac98edf23e6c0d63.bin
Size 12KB
SHA256 6fb5cc3bf149d8215b56717c9702787969e44233222f4115aa0f45176a6182c2
MD5 0bfa7c588764a3ca9238eb1918d48d0e
SHA1 8a6c16fb7a33e8797019da263f6b961df9fdc954
SHA512 3a69f39aa813c0e658c55cc93332f40ec61c10b467a4942e4f1ac544b59a2f23c40058e01140d368e3438fa1200e11071e4c0ac9db4c9260e1dac92953aa1d16
SSDEEP 384:zwFsu3+7kfSQDdh8+ycc5ha8ixZK4/AaZnbFUdAER9S4:z4+bQDdh8Wc/aZu67dKdAeE4
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 5f052c88664bf1378b1d58a956de6596f6a79d1517b7529d6e58ee90c48f62a1
MD5 adb87193b71354ba7b5c5605353b149d
SHA1 59e248e0632d5450e85d374a5fb4ce5b7384541c
SHA512 4c20d0a59fc12c2cfe8d4a214b40df6a1df61da7494e07fcc8538b96a2d09f649a6f710618b9b82b8eb5e8236813479f79fe0a1165bbf0154916fde973a9ed61
SSDEEP 12288:FXGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:FWt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 136f3bca56ed2a9de8732dbd4e55008b1a4c52a01f638d1e2620fae9d5ea03b3
MD5 d6455e567f4ac857660d854d511356a2
SHA1 d88c5b0e2682de5623387e8265b51b4da5d60700
SHA512 4042721b3efd7d000307abe67bf1e96572cb7aeabcd349cffba9e418dd626c17791daaa0da0520f2c3d9fc2ce8e6f1ca7dab6e6ff0dde49b1faebc81af5baef5
SSDEEP 49152:6a0h2GEkuAe73q3pp46zwwQG/snji6attJM:6a0hNYG4JwlEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 5ed816f9d5f30fed411da1fc9a8664548b806d81c0b04f911e86f427bf1ff7ba
MD5 e6f2dab099ce12c005e40591e12b4514
SHA1 28ee90fc470fbc0f988bafafe7bc381a2a1b4d1d
SHA512 f872939ff51f82c41a5f8698c965714b3363e71fbf96a46be40c4629eb5832e4f7f11b85ffc6d6962f2d506a3a41b9254c2c81b3ad4790771cee999dfcc32f87
SSDEEP 12288:xhbHjfXkGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:xhbHjPrt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 0836513b06ac87fb57056125b129cedb4df052faa615d9b08f67747747046ad3
MD5 7aff058451f8449d9f718392b6c88baf
SHA1 1796569182ca25faac206f3eba401e01014205d3
SHA512 1122784610d4cc1a77ee289dcb9c5f5d13ef71e8153f8407d0382dcc1832c0d05637239305171041ae56750500e6984188ea18b708fb635911b024a2473585d9
SSDEEP 24576:R3YgnJcRTk4yti+R5dpR/jt/sBlDqgZQd6XKtiMJYiPU:RIgnaTk46ppR/p/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 7ab1ecbec86c81fa210118311df36397c46b99363f6d7b03210306bf1e673f69
MD5 ca14fab5df31d1a12f71728f757fd77d
SHA1 09010d85ecf17bd1430fa89866db134caa8f2602
SHA512 76a84ae0c241df7e09bda72eefaff48aab39088983c87fd4dc77e63a7b89a451dc15ecc2b92e8c8421ad295dd59d431cb958f2f1f5193b7e9579c57a5d43ee41
SSDEEP 12288:WjGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:WSt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 1778c6928ca03967a3dbaf2d0e7715a579f0cf3908a06f6ebca53ba205e13392
MD5 37c39fe2d40403a7d1678e60c00b566d
SHA1 bf5b1c372f58602b5c59de4332af0be581f0e62b
SHA512 c1c71a9cac8ec38acdbe80a9341519b8316ca7cfea4c826a1e651069e15db78ddde3c42bd2e3ecc66003ff2ec50448d98737c2787ea86f0d66f04a6c33070420
SSDEEP 12288:kObvA4LWOsvAYFTmGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:JrL3UTZt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 1138bc8655b62ed382b2e15f834eec4d7efc06430707045f0613a1f07a774d03
MD5 cefa604252d673d5d19beb7e86fe68ca
SHA1 86d0eb5e8253994243df1c96d8c99c3212a98d73
SHA512 159f81f38f824d2ba042ec92621ec4c7e5fc04b1cbdcdeb66724f961b492a3c19c73678baa44e3b4cf69601e246087efc973cf1231cf40d26d8ea39304157a87
SSDEEP 12288:GpFtYOyGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:9OVt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c0719be2561ecbbce4ddac7c37ae75e7fce814d640c28750a282bad31657e21f
MD5 16025e58b11df19eba91ec21830cf131
SHA1 d7b4b777b2d57be1902e5ddba723cc42cd8c0c15
SHA512 260633a4411121c0971455aed11b57ba18995d634222d8d2d731c0266ab0c2e164c028655dc534aaf78c22dfbac00357a8e17ba803f1b9ec72e20f03c9074155
SSDEEP 24576:j7NM9YmZqmWMUkPjZM48Mv6bEhsmt/sBlDqgZQd6XKtiMJYiPU:j7cBWMpPjN8DbEhh/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 a3fd392f404dac1e9f6e395ab493cf36ff06b7df02894961ade1722b9079cb25
MD5 030cb1ea944d1b1d240c1d69c826558e
SHA1 f9a039d54668dafc2732c2e3e90f1a29a764876e
SHA512 032c482f4e90daf7e19719d4de42f450736ee51b5e551036bbbb8a44b74dbdd547a2079f136fd40bc50dd5c89bcf485f8b8cc3e2df288325379ec3bcee645049
SSDEEP 24576:fW6BApg2YuyuNDYTabvcRvNYf8km1wt/sBlDqgZQd6XKtiMJYiPU:fF2YuHNETovcvNYf8kmM/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 2e51faffcd36678077af02c924225872293805d84936c584d8be650616b59733
MD5 f982431842fbbaa8f2b9034058fbb3dc
SHA1 6f70668ba7aedc79cacba3b83d02a0380b885dbd
SHA512 4a93415be633d5de5e9eb0632524073596fe983ee2f663d526d345434fe2ebae9bff08a704f0db59715c07275cdac3102bb2eb09b30667f81a3130270eb347c0
SSDEEP 24576:WAFs06+OmlfQNXEbToBt/sBlDqgZQd6XKtiMJYiPU:/Fs060lcXum/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 01959d745d582bd1353bb30a10ecb05dfd5dd740b9d6b5ffd0cf1b595014bc6d
MD5 58e28588771d686f3b2b026fc2d83c47
SHA1 4a79502064576ce2f57c01a790242a2a42fea4c6
SHA512 6f7e695528187cea9ca6957e6cc0119818b9896de8951d8a3ae4a5b025195f13289659c7090118ccb18c2ad1f9176059b0a9a630bd4fb56a0c0205062abffd2d
SSDEEP 24576:AJnJ5D3Wt8t/sBlDqgZQd6XKtiMJYiPU:AJnJ5DGtm/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a39b097e2e3549ba4d17dae9fd6e2f1ca87cc41efd4788cf417efbdba68ed490
MD5 726296e43edb874fe23e18efc84757fe
SHA1 0087deda98a82cf620bd7c78769bcfdb3e04f522
SHA512 08c058aaac3589de0e5424cb7241d64070fff14a1851d68df45e28ed6a9ff91ab8e4618326b8530026562a207d6980249fc0d4887428cd714bba29e6a5870fee
SSDEEP 49152:+o06DIKdwc+eQnSt65aVA/snji6attJM:3aEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 9a326121f97f3760a4dccf40d0dfabd5038a360ac8e483bd487d27011fca02ac
MD5 b4266133d784e8dc17df255217024440
SHA1 47f9e857b3de62925ef31e44504c7fb1cc795b9a
SHA512 e9a2783d6bcb914d4e0daa7314ef6de4201685af0c691f4b56ab1bff66fa5be92ba17b70f8b2871b55570886b7017d3dc06b2b5ae7da8611632cad56677f1258
SSDEEP 12288:nEP3Rr+Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:srxt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 9e2f513f5f9f06ef8b2c3cd45214111640d85b63aa45def3ccd63f3643298765
MD5 bf2399cd7fcc5c0241a201c776aa92bd
SHA1 36bc2409778f2f7e80274e5cb0bc38b8e4ab825d
SHA512 6993102aed31e9125035578c0d98d70aee69511f0798052d8b1267ed45016da929b19b2e83059def05cc6976025ce10b335aa8d62aa46334546a40bb12bcbfeb
SSDEEP 12288:Zjky0Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:ZIybt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 28a10ef33d6ec12e2619a9da53803d5c73ea52bfd0484e6db425c6f0116a1b12
MD5 15759764aaa8e1073b7a72ec442af6e4
SHA1 6e97fb27270c6b40216d8441fadada631b51d9ed
SHA512 335d4c0f783a2229bb82aef9891e018d8f76b27dc53f883346a5a24a95fc64d138a03dcd928f58e484ec852b6264641736df820a30b3858f785ef92b779b594c
SSDEEP 12288:yFCGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:gFt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 03a376927d9ff80384c01c8d36e5ec05dfdf6d09242a6522add03349b08ff946
MD5 9133226e0f95f121491f3be78ba11436
SHA1 47eac5c6cee061a458675d4a236bcff9ca8bbe7a
SHA512 aee25b965eff74c022fb9e6d7cdf6bbb621e1795753bc32ba9bdaa0ec251a4fc9ec58916a5bc5d97554945514f039d09cd0d1c925c71c2bcaf4c19778f7d17df
SSDEEP 24576:bQ9MxZKdcz97w3ut/sBlDqgZQd6XKtiMJYiPU:bVKXk/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 d684d61cf1af5c8b29c1ea0609d467cdaa8e5aad7a4dea1b0e53056541a410a4
MD5 b695583119a09c84841701d19deb8fba
SHA1 e8e304943ff120551635087c4d933b1c98a5bfd7
SHA512 4bf062d753d16b38107995b8b9e4f3eeff1b5e5e2229fde3fe09df62f38ae1ef94d6060f915a9fae4653adfd6ec83d22c6b62126c592ec9b822c31a77c33f34e
SSDEEP 12288:IyoKo2HRple9pQGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:IyocxApXt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 3de8fd10efa253f4d8302ebc76739a33f8b3bb8dbcbc510e51d5008cf0e9149b
MD5 09f81fca5996bdb72406cfe21f432294
SHA1 77332cce8fbd97a86a96b9412cbf275660132fe4
SHA512 935ee7d95d5ca8efe9279b38d171d8cdbc896dc05216136187ef9b3fc45a6ab76825028c1862228eddb952c49e38353fc320e0ebb6935002137bbb6fb4f287b4
SSDEEP 49152:eWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIK9/snji6attJM:40zuNI5EnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 76a249d817f91a897de36486727e6917e56cedcfb75de3ba8bf1aeb4c316c22a
MD5 be86a3a6e98629d156ac1cf9f97380bf
SHA1 d439a9183dbc1a6dd9cf8b002cd8e5603127d6ea
SHA512 08b37aac8ef5d185e48c840554fe4e5c0d61a65b2471b2be1d994843f6922471b26c90ecc14e9ce7eb5d0e766d8e466bd4d36f3652714a608129e31646c1bd28
SSDEEP 24576:w1QT7EcpfxR+N5AWAz3ooiYsjMqb4t/sBlDqgZQd6XKtiMJYiPU:NTDxR+N5YzTujM3/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 63e9a4abd11772de59971323712125618941e88cb86034353e34c8ede1a7575e
MD5 bc403dd85d817982d776b3acc15a3223
SHA1 4a4aee4926a2d6316952b65b62d28815dbc8fa8d
SHA512 296b48be90e6c26b785ef1723ff4df00f4a424ff0f53a26add4228b57701e13cfeb2bf57abc527c64fbaebb498e7a9b55ff565c451b6f03a23c76299edd0a34f
SSDEEP 24576:8TMdOz0FFS+hmSLkt/sBlDqgZQd6XKtiMJYiPU:U0K+hmSLe/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 1a152e52be3d8458c3e6882da85e7fb5be67cf8fe8ae0a506b282de50a0e994e
MD5 a33c4e31575562141c42b15ab1f50d24
SHA1 a3d47cbb5051d02783ff3be633831befdbaea148
SHA512 acb4b0e0f01390e545b7b793306871e7cc2bb2153c7005deee46361a97b6f0ae59a6d5968cb65af87ef4b58021961cf711dfea1f07cb09a66666ad8d406868e3
SSDEEP 12288:j47mGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:mZt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1108-106-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/1108-159-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/1108-74-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1108-80-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1284-221-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1284-499-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1604-104-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1604-90-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1604-84-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1604-220-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1628-146-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2492-39-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2492-183-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2492-30-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2492-38-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2972-397-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2972-207-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3024-339-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3024-706-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3024-197-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3228-713-0x0000000140000000-0x00000001404AD000-memory.dmp

Download

memory/3228-563-0x0000000140000000-0x00000001404AD000-memory.dmp

Download

memory/3428-288-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3428-160-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3640-96-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/3640-112-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3640-107-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3896-300-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3896-165-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4256-19-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4256-145-0x0000000140000000-0x000000014033D000-memory.dmp

Download

memory/4256-12-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4256-18-0x0000000140000000-0x000000014033D000-memory.dmp

Download

memory/4308-43-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4308-52-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4308-53-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4364-8-0x0000000140000000-0x000000014033D000-memory.dmp

Download

memory/4364-40-0x0000000140000000-0x000000014033D000-memory.dmp

Download

memory/4364-22-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/4364-0-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/4364-9-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/4404-118-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4404-260-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4720-229-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4720-510-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4820-318-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4820-70-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/4820-63-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4820-64-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/4820-105-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4820-93-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/4820-184-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/5164-712-0x0000000140000000-0x00000001404AD000-memory.dmp

Download

memory/5164-526-0x0000000140000000-0x00000001404AD000-memory.dmp

Download

memory/5224-519-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/5224-249-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/5356-265-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5356-261-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5416-517-0x0000000140000000-0x00000001404AD000-memory.dmp

Download

memory/5416-604-0x0000000140000000-0x00000001404AD000-memory.dmp

Download

memory/5452-554-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5452-275-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5552-605-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5552-289-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5648-615-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5648-315-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5680-593-0x0000000140000000-0x00000001404AD000-memory.dmp

Download

memory/5680-553-0x0000000140000000-0x00000001404AD000-memory.dmp

Download

memory/5936-327-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/5936-619-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/6092-340-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/6092-682-0x0000000140000000-0x0000000140179000-memory.dmp

Download