modiloader | aae8699a908c3ca5211006647460cb8eb15c517a7cbf4a45bbf7909977317faf

Analysis

max time kernel
227s
max time network
228s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2024 02:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PO_2024_056209_MQ04865_ENQ_1045.gz
Size

943KB
MD5

6271861abdb95e51f6849c843acdae62
SHA1

66cc315ad98bd5bae2ffb11729bbfdae8eefa85a
SHA256

aae8699a908c3ca5211006647460cb8eb15c517a7cbf4a45bbf7909977317faf
SHA512

90a117bbfc1251361d0e8900675c6846511598544dd1df0d3eb6b2ec982a5b83bea4b81eeee9991ca84cdc44785573bc9e79eff9ff417f747990e635a42f59fb
SSDEEP

24576:yKMYBN1/giWrlz3+rRu+P+FBVIceG7VX6BUxWDbuLmfq/wTL:1MI/giUlr+rRu+2FE5G7VKCxlLmS/wX

Score

10^/10

modiloader collection discovery persistence spyware stealer trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 46 IoCs

resource	yara_rule
behavioral1/memory/3016-26028-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26031-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26035-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26039-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26048-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26061-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26057-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26073-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26055-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26054-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26071-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26070-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26068-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26067-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26064-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26062-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26060-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26059-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26058-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26076-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26075-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26056-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26074-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26072-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26053-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26069-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26052-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26051-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26066-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26065-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26041-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26050-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26063-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26049-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26047-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26046-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26045-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26044-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26042-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26040-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26038-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26036-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26037-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26033-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26034-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2
behavioral1/memory/3016-26032-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2

Executes dropped EXE 24 IoCs

pid	Process
3016	x.exe
2320	afvgxyoF.pif
4816	alg.exe
5856	DiagnosticsHub.StandardCollector.Service.exe
6052	fxssvc.exe
6132	elevation_service.exe
5332	elevation_service.exe
5096	maintenanceservice.exe
232	msdtc.exe
4132	OSE.EXE
5112	PerceptionSimulationService.exe
1084	perfhost.exe
3804	locator.exe
5456	SensorDataService.exe
5436	snmptrap.exe
5672	spectrum.exe
5828	ssh-agent.exe
4576	TieringEngineService.exe
3556	AgentService.exe
5108	vds.exe
1328	vssvc.exe
5020	wbengine.exe
5180	WmiApSrv.exe
5592	SearchIndexer.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	afvgxyoF.pif
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	afvgxyoF.pif
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	afvgxyoF.pif

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Foyxgvfa = "C:\\Users\\Public\\Foyxgvfa.url"	x.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
49	checkip.dyndns.org
59	reallyfreegeoip.org
60	reallyfreegeoip.org

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\spectrum.exe	afvgxyoF.pif
File opened for modification	C:\Windows\system32\AgentService.exe	afvgxyoF.pif
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\dllhost.exe	afvgxyoF.pif
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9512f5a4983eaefb.bin	alg.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	afvgxyoF.pif
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	afvgxyoF.pif
File opened for modification	C:\Windows\System32\vds.exe	afvgxyoF.pif
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\System32\alg.exe	afvgxyoF.pif
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	afvgxyoF.pif
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	afvgxyoF.pif
File opened for modification	C:\Windows\System32\SensorDataService.exe	afvgxyoF.pif
File opened for modification	C:\Windows\System32\snmptrap.exe	afvgxyoF.pif
File opened for modification	C:\Windows\system32\SearchIndexer.exe	afvgxyoF.pif
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	afvgxyoF.pif
File opened for modification	C:\Windows\system32\msiexec.exe	afvgxyoF.pif
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	afvgxyoF.pif
File opened for modification	C:\Windows\system32\vssvc.exe	afvgxyoF.pif
File opened for modification	C:\Windows\system32\wbengine.exe	afvgxyoF.pif
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File opened for modification	C:\Windows\System32\msdtc.exe	afvgxyoF.pif
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	afvgxyoF.pif
File opened for modification	C:\Windows\SysWow64\perfhost.exe	afvgxyoF.pif
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	afvgxyoF.pif
File opened for modification	C:\Windows\system32\SgrmBroker.exe	afvgxyoF.pif
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3016 set thread context of 2320	3016	x.exe	122

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	afvgxyoF.pif
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	afvgxyoF.pif
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	afvgxyoF.pif
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	afvgxyoF.pif
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.123\chrome_installer.exe	afvgxyoF.pif
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	afvgxyoF.pif
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	afvgxyoF.pif
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	afvgxyoF.pif
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	afvgxyoF.pif
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	afvgxyoF.pif
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	afvgxyoF.pif
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	afvgxyoF.pif
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	afvgxyoF.pif
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	afvgxyoF.pif
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	afvgxyoF.pif
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	afvgxyoF.pif
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	afvgxyoF.pif
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	afvgxyoF.pif
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	afvgxyoF.pif
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	afvgxyoF.pif
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	afvgxyoF.pif
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	afvgxyoF.pif
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	afvgxyoF.pif
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	afvgxyoF.pif
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	afvgxyoF.pif
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	afvgxyoF.pif
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe	afvgxyoF.pif
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85250\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	afvgxyoF.pif
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	afvgxyoF.pif
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	afvgxyoF.pif
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	afvgxyoF.pif
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	afvgxyoF.pif
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	afvgxyoF.pif
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	afvgxyoF.pif
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	afvgxyoF.pif
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	afvgxyoF.pif

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000075393b2d2f5bdb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006615712d2f5bdb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f2025e2d2f5bdb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\acppage.dll,-6005 = "Shortcut to MS-DOS Program"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003ec5252d2f5bdb01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	mspaint.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	39	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
2360	mspaint.exe
2360	mspaint.exe
1432	mspaint.exe
1432	mspaint.exe
4532	chrome.exe
4532	chrome.exe
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
2320	afvgxyoF.pif
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3936	7zFM.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3936	7zFM.exe
Token: 35	3936	7zFM.exe
Token: SeSecurityPrivilege	3936	7zFM.exe
Token: SeTakeOwnershipPrivilege	2320	afvgxyoF.pif
Token: SeDebugPrivilege	2320	afvgxyoF.pif
Token: SeAuditPrivilege	6052	fxssvc.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeRestorePrivilege	4576	TieringEngineService.exe
Token: SeManageVolumePrivilege	4576	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3556	AgentService.exe
Token: SeBackupPrivilege	1328	vssvc.exe
Token: SeRestorePrivilege	1328	vssvc.exe
Token: SeAuditPrivilege	1328	vssvc.exe
Token: SeBackupPrivilege	5020	wbengine.exe
Token: SeRestorePrivilege	5020	wbengine.exe
Token: SeSecurityPrivilege	5020	wbengine.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: 33	5592	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5592	SearchIndexer.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
3936	7zFM.exe
3936	7zFM.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2360	mspaint.exe
4504	OpenWith.exe
1432	mspaint.exe
1432	mspaint.exe
1432	mspaint.exe
1432	mspaint.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 1716	1616	cmd.exe	110
PID 1616 wrote to memory of 1716	1616	cmd.exe	110
PID 1616 wrote to memory of 3252	1616	cmd.exe	111
PID 1616 wrote to memory of 3252	1616	cmd.exe	111
PID 1616 wrote to memory of 3016	1616	cmd.exe	112
PID 1616 wrote to memory of 3016	1616	cmd.exe	112
PID 1616 wrote to memory of 3016	1616	cmd.exe	112
PID 3016 wrote to memory of 2888	3016	x.exe	115
PID 3016 wrote to memory of 2888	3016	x.exe	115
PID 3016 wrote to memory of 2888	3016	x.exe	115
PID 4532 wrote to memory of 4808	4532	chrome.exe	121
PID 4532 wrote to memory of 4808	4532	chrome.exe	121
PID 3016 wrote to memory of 2320	3016	x.exe	122
PID 3016 wrote to memory of 2320	3016	x.exe	122
PID 3016 wrote to memory of 2320	3016	x.exe	122
PID 3016 wrote to memory of 2320	3016	x.exe	122
PID 3016 wrote to memory of 2320	3016	x.exe	122
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1576	4532	chrome.exe	131
PID 4532 wrote to memory of 1896	4532	chrome.exe	132
PID 4532 wrote to memory of 1896	4532	chrome.exe	132
PID 4532 wrote to memory of 5140	4532	chrome.exe	134
PID 4532 wrote to memory of 5140	4532	chrome.exe	134
PID 4532 wrote to memory of 5140	4532	chrome.exe	134
PID 4532 wrote to memory of 5140	4532	chrome.exe	134
PID 4532 wrote to memory of 5140	4532	chrome.exe	134
PID 4532 wrote to memory of 5140	4532	chrome.exe	134
PID 4532 wrote to memory of 5140	4532	chrome.exe	134
PID 4532 wrote to memory of 5140	4532	chrome.exe	134
PID 4532 wrote to memory of 5140	4532	chrome.exe	134
PID 4532 wrote to memory of 5140	4532	chrome.exe	134
PID 4532 wrote to memory of 5140	4532	chrome.exe	134
PID 4532 wrote to memory of 5140	4532	chrome.exe	134
PID 4532 wrote to memory of 5140	4532	chrome.exe	134
PID 4532 wrote to memory of 5140	4532	chrome.exe	134
PID 4532 wrote to memory of 5140	4532	chrome.exe	134

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	afvgxyoF.pif

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	afvgxyoF.pif

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\PO_2024_056209_MQ04865_ENQ_1045.gz"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3936

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\PO_2024_056209_MQ04865_ENQ_1045.cmd" "
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\system32\findstr.exe
  findstr /e "'v" "C:\Users\PO_2024_056209_MQ04865_ENQ_1045.cmd"
  2⤵
  PID:1716
- C:\Windows\system32\cscript.exe
  cscript //nologo C:\Users\Admin\AppData\Local\Temp\x.vbs
  2⤵
  PID:3252
- C:\Users\Admin\AppData\Local\Temp\x.exe
  C:\Users\Admin\AppData\Local\Temp\x.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2888
- - C:\Users\Public\Libraries\afvgxyoF.pif
    C:\Users\Public\Libraries\afvgxyoF.pif
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:2320

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Chine_ana883746D731374193D597990FF34780867FF886442loodatke.PNG" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2360

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:3020

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4504

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Chine_ana883746D731374193D597990FF34780867FF886442loodatke.PNG"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff7485cc40,0x7fff7485cc4c,0x7fff7485cc58
  2⤵
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1868,i,16283506830246798842,11354175462592273964,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1860 /prefetch:2
  2⤵
  PID:1576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2008,i,16283506830246798842,11354175462592273964,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1992 /prefetch:3
  2⤵
  PID:1896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2300,i,16283506830246798842,11354175462592273964,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2496 /prefetch:8
  2⤵
  PID:5140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3124,i,16283506830246798842,11354175462592273964,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3152,i,16283506830246798842,11354175462592273964,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3812,i,16283506830246798842,11354175462592273964,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3832 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4724,i,16283506830246798842,11354175462592273964,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  PID:5220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4472,i,16283506830246798842,11354175462592273964,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4228 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4940,i,16283506830246798842,11354175462592273964,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:1316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4892,i,16283506830246798842,11354175462592273964,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  PID:5716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4568,i,16283506830246798842,11354175462592273964,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5124,i,16283506830246798842,11354175462592273964,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5064,i,16283506830246798842,11354175462592273964,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4956 /prefetch:2
  2⤵
  PID:6012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5272,i,16283506830246798842,11354175462592273964,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5176,i,16283506830246798842,11354175462592273964,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:2308

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4816

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:5856

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5984

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6052

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:6132

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5332

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5096

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:232

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4132

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5112

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1084

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3804

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5456

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5436

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5672

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5920

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4576

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3556

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5108

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1328

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5020

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5180

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5592
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1684
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:2848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
2.1MB

MD5
d197bc6a6f2d6b1ea2bc47659d272aac

SHA1
3aac56c9be5d85f6c1a159d561a4f06372249e51

SHA256
ae686b77cba0f37a43f3a9f5c545475259b07b973c0af46e6f513cbce2aaec0a

SHA512
1c37084333a31c7a9a560bcecdc60417922b672df762a7fb2b6efd0ebe50bdfe20701b87a0d3215443396dd4cf66d1757910f12d23c1e2fabac78e968a924954

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.3MB

MD5
4b41fd1705751d6e88a2fad4df9a3f7a

SHA1
3f73e61f089805aa12bcbf027da52d76e1db67f7

SHA256
079ce26c508d4de093747ee2bee0ce053b5c08888519a0f01c07ecf3b332401b

SHA512
9aa3ce3bb3c64c5e45d4bfa6910595bb39e3f9b27c528c198be90d13cc28611cf53076412a01a89b2e708cafe093f5c83481ae837b768a9966cbe4ad2c3614be

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.6MB

MD5
7cbde2e1937eaab412c355eccc6b4806

SHA1
65af8656e94175de1d6db4aba120ba83a1637943

SHA256
eb562e6b804e0b0bc2c1e45091d8c590e70fd59c5f5c0f66ce347c61cb573042

SHA512
4978c9b454babc4569b74847d109195bf1cffe5b466b5196390c456f89178312f99c761f04c91a2e36b3554ec7e5218a27232135f4aa1ac54bc9b3a3edf2c624

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.2MB

MD5
87f4216d9f71045db1acb17a59784598

SHA1
687fec04d2f4cff6a9ef14c5669306bd3341800c

SHA256
ddac6270f6a8bf2bc22dc8ba6caa3315408d6857f9039b00d9a2f26b37aa46a4

SHA512
0e45545837077a065aa88259a180a7369e23cd34fee669f341d124221209e2af3b6ffa832230c130403540b1c6e33fb2098afea60657d5ab292fe5802376f2e9

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
1.1MB

MD5
e7ef3f9c9e32cbaee61f2edd84b91b1a

SHA1
621c666bfcbe834d9740272f4c4bd7d05f963a34

SHA256
80e0186ccc4322d7951e75066423c95d4bc392cbe943408d637210282f3d578e

SHA512
35652de93102c2f1257a2f64d292debd3cf9065c885e1dce91e373a242735ac5e094c2073cb19263e29aadb3e1a81dbb061e9eec008bfb61e774217558be6093

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
1.3MB

MD5
1998daddb842faae3ddecc8db6c1ea82

SHA1
3c3f783bd68f15d40db128657c32213bf74d6b6a

SHA256
7f45903940bf48a76f49eb68be61f826a8622d4a76a2008c631a4f7b34101f3d

SHA512
846b5da46575d95935437ee5ec6b1172c6192cba729eeb6dde4048539a6b90d341a4e5da51c079b541c68dc326087ea7c4b6024f064343dc4d198c1f76c97807

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.6MB

MD5
757fffc7bbcbcb85977cc2da1eab0f38

SHA1
d922059de247ea0cecada9c53b063e0c8176938f

SHA256
118fed107e9afae30e5ee4b015bceb4da4c7e83fcef2553be320412cd134c796

SHA512
5395f24bcbf92e9e1727f19d76861e412f7b62a93b9a7823b342409ab327a11b86b14c12ea8124f71854e7d5438dc2534a0552c718171d5cf9abb68a728fe358

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.7MB

MD5
943c313ce34d8cf72f135f30a887095b

SHA1
4d0f17b9e00cec33c18033ceea31aed0bc1942cd

SHA256
b70cfe0cae89bbf5754287baf168cd5bc98a5e3783c956ea24eaad2f13667b4f

SHA512
8080543617985f94fbaa631392431abde6b32c5de89cacbeafb47e31971fc27dc1a86acc946a3fb73fa318d831163198794907c72d26eb10374d19a7c6719f22

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
1.3MB

MD5
bfbb2ce829af56f04c05b46db7ffe70f

SHA1
7240617a6e9a3152eee6f08b3fb8f4c3a732a67d

SHA256
7db9b45605d446083381a7d46d3b67ecb009ad6e1dcd39e0bcb3496c5ab5d3e0

SHA512
209e7b030dfc8a506f544a4a66472522dd61350755c27354215c45ca15e2557e51a2def3d903b17309a78ba4dc98b1c3c1f501948201e42b9c7500aa214281d9

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

Filesize
2.1MB

MD5
47d8e161dd5b110116f770dbc9d94a6c

SHA1
ca510d4d16333faf123b575cde656d433da370b2

SHA256
aaa12d3bd12471740f6ffded41cdbe85cdb37a348d8bb0fea0b18a4749c133c2

SHA512
c11e6255f55f8b2c3b1098384653aaf5edd59cda5a1c85ada68edcc5e27bdee1b49a8705a509cc3d07472addebc16ed97b7360f09cb8b53fc37c90e9e51f92d6

Download Submit
C:\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
1.5MB

MD5
01e909fb7a0fd3313485d11b2ceed79b

SHA1
9927665cfd6729393f6fa141ba234ed9429ab814

SHA256
9b136540ea20558415d920036a72679465dcde59b4b9aa539af6d2289030b4e6

SHA512
b2ecb65ddf46d852abf49741cd7c72dd578b46f444d624738b1c22668b24f42ce544f3b3bb3deb430bb2c5e70576a7b8310ff99d9934d631940d33285c7b6394

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
b0a0a0bd1b4488db180fd0f5277bc827

SHA1
3d11177647431b75ddf8463daab9d7036ed2bdca

SHA256
512d17d8470a84d49107a10c2c14a37a6a8bd063bbfbcd53d6309258df50302c

SHA512
d551325ba6698885b69f1a05e79625fa14544917a671cb4371b07e1aa3eb6d70729dae8e1012ee09ec24a0e0a817a56a288c0887be52d87917b4f824ecb4374b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
b0fe310c2a75526ef00bceecf33a49b8

SHA1
8fa8db45274ccddeeee25a96980d0e429d2ce991

SHA256
e3e53c8e2cdd84a2d760d7786e1bbbb8ac7ba9a9e6d42141a9f8e0db90a1010b

SHA512
4315aac58f1f6b7bc10d2390d14fc985421055e620cc3fee203a45007b80a020bd98686909a7545016336c3ea9b1ac04d81b08308f879e83e80a499eba682e79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
35d8f635e8e93ae0edfde916cb29ce81

SHA1
662538dd7c4694a964a79b5de8249c73c319916e

SHA256
93ed8b4adef4ad0883b83f36e0389020b14270ad4204588daede311c9f1e2c71

SHA512
8ebe8a41fd98c92484821cd0a020f32c90a45f93e9182166f73c0bca83ad58cc554a522a33ef9483980091f2680680324be69e96fc7ca666f199c9011449b5ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
88358655defab347ee843291714f5fdd

SHA1
569547c4721f0058f51eb26b973b69a6c5822727

SHA256
52dc9a31016bbf52f8b2948035ab85ea8e6de87b4aa8a780ccf08a23cfd89d04

SHA512
cc8404595c5528b264200b3557ebeccec19336c3dbc9e89742f215df46d74cd8d47c8ab3cdcc8e97f5b6203ae522936ab1f9b3f2bcf2ce83fc05f811ee1db7c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\_locales\en\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
7beeaaf29e6445158ca14b9eb98a70af

SHA1
2f6aabca0080734077ba2c3a496dbed51aa23776

SHA256
eb3199d818a8289cc1838fac3f646e5efa30102df365b278f150daad0f231a7c

SHA512
46a40528568805ad8cc2eff42f7537bc8a8f1455f5ba5c5f7ddd1fee275f0b8902ee24989b398bb119b23023251cb45a41534427c73d629787f3a5c593bf1a76

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
d1a98155d5809761c53f9676807019f0

SHA1
b09fd4426a4606c1888e77a67b8a92f8a8ed9839

SHA256
f5ceee263cd98bf4557c72c517a893f581b220e7370150ac2a1dd016c81a7fc8

SHA512
3650d5038009c74ddf64df28d83a377ca92662f01f1e7c006681c3f662425fe216a7e2168a7eb2401b95cc8412716243c220064fa4b3b28e458895a5ed93c9bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
4f9e6cd7eac40558167016ee3141f708

SHA1
acde2f67946c1d059f0a30b8b578eabee3abad3b

SHA256
caac6c853827d90c9a2574f82ac883650db77c45142985f50ec92852b9ac6b7a

SHA512
ff8aecef9f99da2a8172cc573da9d1c470d047416bfa16dbab0ecdf98b907da995d5a7c7ff54cfb29b93211c84f0a99103bc75b8c0dc62b8440341f61854ca07

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
9afb31c983e15a02c59dfff522146c57

SHA1
7cee1f65bda436184b67f8cb6ad863964d10e749

SHA256
dd465d9941710b7f1453183b62cacd52091d6fc781169bc587ab24501e6c13d5

SHA512
d3288ef9b84f3e2ecafd3c26b50079695a1ef61bfb383aa299828e7750ccf7ff3b523440cb07e58ed092dd019adbcb931d33ff9ac2276c4af97d866e95db318f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
bb02034e1226f6e112415d6d6a7f6775

SHA1
0c2783885340bca1694220c009e4222e648ff7f4

SHA256
89f7f950322e50dbcf14c27c7cf7783e8eab5114194193e4aca2e77946727358

SHA512
539f7170f75d56377162cdd65ad4abe4de6bf2ab28b84a202b608d70f5fcb36e3268b6dda0520dcd93d15251c2ae71a7a41e008a8897be7851b1e21621546b51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
72fdb525604e33849b5ddf1a7b5e8fc6

SHA1
e5df14a87520b9d3a0f420b84ef629655ac0dd62

SHA256
cfa8d9a017c6197ada75d1c70074d568bde6fec996c50763d747bb41c44ca748

SHA512
a14d5337ffe8e37acd11be311b8bb74467e8e296b2252a0db54d13931c23a6dc85f1a753ecf10d66ba6819887412fdb34e4e6045cc0cb51784db113965afd5cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c95166b1601700abc658c4cc01dd7f07

SHA1
fcf79022bfdb7a4281ca26bf4e8e306d67df4798

SHA256
305bbe3d82bd0de051532d638cfbe4a1f3f9f2af5e4548d11cf8d2af4b597ec3

SHA512
2fd1794a180a4c39fd133e777734dcd8a63d0754e43611beb53b7efeac337422a9304e79086e375c0db9bc9dc5a0ca4d38e8c793f497936c9223cb9134f4c4b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8ad489734a69a45205bfd1b554840506

SHA1
209f71c2b35e3bb7da651b14d93382fa933c6282

SHA256
d42afbbad0322d2ca52da9bf44824a4403ad1807b0f7be766986a1aef0550568

SHA512
a55a42ab1068d3483670ab43b33020d2cae2045c42704935ab323f88352c5c85cbf5404f4399c80b5e10099a75ca7532405369c613a571b3d88bae640b6b03b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
37251be9d1b61dec5d33557e0ac72cb1

SHA1
3e4107ff15f89906187a52545b2722784457d80a

SHA256
a91eace38a2d823068f8340d9d914921341a5709e84cba26535b989b6818433d

SHA512
7bf1e19c818e3ac2f907ad202b30d4da53688ef8ffc80b2f31f028e90cb46c9be2a1a96b89778d95fd45ccae6faa52a0e107a4d127a69ab062e32a6039dca154

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8bc5f25b15b59734a233c031cfa98801

SHA1
a122b63eccfdd45350f844c49bdda576c74bc896

SHA256
4b7b82cd9b08038fdc626098ea5fa52de498a6e97f73e12bc1c48fe543ff4c08

SHA512
89e61707799054eb12889d01dd76071dbe2a89f241583dd7bd18d33bebd6ae9a1e7b6a52102ccf413081ed636df6ff1b86a13e208a44279ce25845bd9d68f4eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6547b7994fcea130e0bda55129483725

SHA1
faa2c0490106e19f5966c13a0a66660bd1f148a1

SHA256
067f2dc4f750cbb62bb1df9ad8a6ca115c8ce9abdac94acdd38aee539eebcffe

SHA512
d9dd1811c006804c265169fc47dfd3003f4115922e5f2c5f088b6e913191ea6cfa8aa5fe20bb48476c79e37e32580dc6aaad797adf41ee2d02adfa1b3ddab7eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
b129159baf6a513b9c6a68052c210208

SHA1
5ac4867a05a58e296c27c8327ac87eee5079d29a

SHA256
16787cf595b38ea7c14b86c9fdeff61eee86394eb8cf387cba3a284e2559e594

SHA512
a3735708a53a286c11f16c9760c348f06f6022fbfc508eebbf7eaf4d9853fe460ab66f541d12ed7ef50f5516a214db8bc17ea5b4d91b5631b96e40ba0f3cc1d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
f64ddef0f4d495f3a98ec52d162eb9aa

SHA1
0bca12892450d24ea06697c39608c40da13418c0

SHA256
a9267e8a29495eed1760a34346a143610a2608d8256edd93bd9740ef82c7cfe3

SHA512
37a77365c52803a07da583e760ce8341a1f131c03b968ede99a03a4fb2ce4d21ef023fbe44bf9ad231a81281347d56168e40203fb0726b9118c7072441300e5b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
231KB

MD5
94536bfe95166da7aaa7268c9dc522f0

SHA1
8cb397ecf54be22eebe3e2213c11ca5cdad8dedb

SHA256
9d6b6c1b71906edde84f019f35e4f47295286197bb980ee825e7b429ce1f21b6

SHA512
790d35cc50ad241ef3f773fdf23d8712419434fdefd78d5f6cda872a82454123a0a3c9ceb4c7a70d1f0fcab07387e716ded0994a3a8337af548f06633956b4ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
231KB

MD5
6f2ff90135dc295a6b95232f02f4b897

SHA1
2788d01cd9e7d78f2612d24e24de965f28d1df80

SHA256
505453ae8c0c6754eb96123f0106787075b1b558e28404d2b16e72a8e4687ea6

SHA512
b747d165f3a1984e707042f77adc61c9970357e7d4fc98b0d57e43dec5d89da18cb4f1ade5091a5e3bb68c6a6f457a3710dfb0f37c011f4dc0acc47a53dfdbf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4532_66394919\8442b157-4a11-4d55-a50d-de2b5ebceaca.tmp

Filesize
150KB

MD5
14937b985303ecce4196154a24fc369a

SHA1
ecfe89e11a8d08ce0c8745ff5735d5edad683730

SHA256
71006a5311819fef45c659428944897184880bcdb571bf68c52b3d6ee97682ff

SHA512
1d03c75e4d2cd57eee7b0e93e2de293b41f280c415fb2446ac234fc5afd11fe2f2fcc8ab9843db0847c2ce6bd7df7213fcf249ea71896fbf6c0696e3f5aee46c

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4532_66394919\CRX_INSTALL\_locales\en\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\x

Filesize
4KB

MD5
c088f8f6edcd9767aae7592ebbe96f5b

SHA1
8bcc6fc3705f58aba585f18862cf8de2b99d1fd3

SHA256
3048aee6b6f3a9a0f4135e0a8257153cbe8d9ab2e43125dfa24923daf028ab79

SHA512
b49df3a1f3581b5cb176441876b4e11315b30d2a7f1f7cf2fe700aa016d7c5a8a4bc86fcae1d935e863d012d898c8181f67ad454fd743896697f90cbb6b5714d

Download Submit
C:\Users\Admin\AppData\Local\Temp\x

Filesize
1.8MB

MD5
bf38536008977969fa57ff4fca96af75

SHA1
1ff7c41ce6d80f772f6fa32e667285587ee21cbd

SHA256
5171548d61d342b89a92969bb13e4431ea8acd46a7146f448ebdb49639f19e9f

SHA512
f14c7a41d2e1b40b735071648db81d8cac2e5180a2062351365109ce384bcb317d7bc7ecbfb416d7614c1cdcae8c29180f937585e87b6ef43bcca8bbbe4046f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\x

Filesize
5KB

MD5
c2c4e5ce42bd82255da9b9359a6da244

SHA1
1cd3fdf6ee3da84711f0df530bea5d980dbdd52e

SHA256
a78b71a00b54a27e3ee1b6c4be025d3c92d17daa72944eec7abfc4358a5666b7

SHA512
5ab99801dc8915e5e2e93e56ce40386c28e29b79f30805d67b6cdbe4e43759c2bcd2fef0f00945be5bf4481c97eeaccf8cfe8bd141277b3490ba0a713b4e0a8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\x.exe

Filesize
1.3MB

MD5
d1f6b3bd433945255249291310f2e59e

SHA1
b5a2b9ec979e17c4d1074e7d1a23b550cce578d5

SHA256
7886e0dcb78a5d5e67f9d28272c24a29139accf9ff7616b659ffeb3eeaf1603a

SHA512
116e88e5e5b4db7086d5efe759a3b7883ded9cd691327e3f71aee61f0920805a21118d801231b7c091c4ee8e7beca6f5efadd577031336775bc93f2bcbec2b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\x.vbs

Filesize
380B

MD5
ec9a2fb69a379d913a4e0a953cd3b97c

SHA1
a0303ed9f787c042071a1286bba43a5bbdd0679e

SHA256
cf8268d158bb819ef158ff6ccbed64d5e379148a0adb1f73a082a01d56d0286b

SHA512
fef8e24a680991046bd7dacd6079c7e48c3031fe46caae722ea93797ee16c052073ba97959e992ea71ac7ab72fbcedaa5cf4a410657aac4c10ad24de6935e9d6

Download Submit
C:\Users\Chine_ana883746D731374193D597990FF34780867FF886442loodatke.PNG

Filesize
9KB

MD5
dc156637aebf04336700a9bc71c78aad

SHA1
ec388fcdd4a3228bb1202412c8d25386eac63114

SHA256
e739a88ac8fb4fefa998f8dbf4402a8d7a22eb079edd05bee412c4d4c99014eb

SHA512
8df48dc4f32fdce4af890770e988fb47ab1e35e106f8efd73bf056d5e4a6b22f7ee975f9f440399aa06379b9d3809e85f92a2a3a2547aa1866759241c96509eb

Download Submit
C:\Users\PO_2024_056209_MQ04865_ENQ_1045.cmd

Filesize
2.1MB

MD5
e74e6f735a0aabae7ea551ec00081be9

SHA1
e21c6050c4b5598be0db7fff9abefdfcb8a78f04

SHA256
e66a156bc6d1ef4b56a572c4133de2559388152dc36d1f35860e2defa566caaa

SHA512
e26c43246087b24b40642f7fb412210a0cce295ce3009136d08596bcc644f74f4734e7f1375f2117d89a8935636d002d7b6c3065cd9aa2380a50c96d54c093c0

Download Submit
C:\Users\Public\Foyxgvfa.url

Filesize
104B

MD5
f4c3d4435ecd274526c9d36ca3c6e234

SHA1
de7d33d1c7ef72bf4ca431408035921354fe35c6

SHA256
163d676ce3a58f5cbf1c1acd9e6da0d5eb8940ec748d93a5b8f510e28c2a09a9

SHA512
b4a766e19826ac634225ddcf1de42b8a33ae57683dfd456ecda71b61f19529ab0d845fc267aeaeb872699c77cd005d3e84d8a13d01f10db94280e20c6669ea7c

Download Submit
C:\Users\Public\Libraries\FX.cmd

Filesize
8KB

MD5
60cd0be570decd49e4798554639a05ae

SHA1
bd7bed69d9ab9a20b5263d74921c453f38477bcb

SHA256
ca6a6c849496453990beceef8c192d90908c0c615fa0a1d01bcd464bad6966a5

SHA512
ab3dbdb4ed95a0cb4072b23dd241149f48ecff8a69f16d81648e825d9d81a55954e5dd9bc46d3d7408421df30c901b9ad1385d1e70793fa8d715c86c9e800c57

Download Submit
C:\Users\Public\Libraries\Foyxgvfa

Filesize
1.6MB

MD5
a87f2c7be53c69bdf5071091d14efe6d

SHA1
99aa43b15a01e2c980392e3b70ecfdda9bac2922

SHA256
044aed9b4930ef71a7dd78301fdb45d52bddc600991ba39f1070988a6cf65c06

SHA512
a965a4dfaeefaf685cf42a0394230ed7e0538deae91dd9a982da0eec9bb2a1cce582f2f1d4800814d5760393dd097589f52df0f55a79747ab4f05ee3fa671e95

Download Submit
C:\Users\Public\Libraries\afvgxyoF.pif

Filesize
171KB

MD5
22331abcc9472cc9dc6f37faf333aa2c

SHA1
2a001c30ba79a19ceaf6a09c3567c70311760aa4

SHA256
bdfa725ec2a2c8ea5861d9b4c2f608e631a183fca7916c1e07a28b656cc8ec0c

SHA512
c7f5baad732424b975a426867d3d8b5424aa830aa172ed0ff0ef630070bf2b4213750e123a36d8c5a741e22d3999ca1d7e77c62d4b77d6295b20a38114b7843c

Download Submit
C:\Users\______________________

Filesize
6B

MD5
e585aebe838b7edaaf13c8a9afae2542

SHA1
fd9ded9a24131521af9f29995cf17837f104b42c

SHA256
daa0f3095724bc659277f470b7632e73f10429b94f88438bdf226d2fc34ab757

SHA512
c2f75ce970a85d73cddf860753db212c67c47a3c0bf00fbd9ddbab757efc1d597879af9c37a15a4a9f8481f83ab5c30045d1a1cfb091ba3ef899901bb3c879ae

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
1.1MB

MD5
168bf70be73257c0f5c59225b36ff84f

SHA1
7956e945f87558ae998045db7ccd4dfeca74f59b

SHA256
50d18ad70ca714e4c9823e831f7847e2e21d60500786e2ebead76d15009c8cec

SHA512
cbc1ac153b51afa8e5cde52293da5bb63b6043e65284031eb9e947c971ec00e7161718fb54156045880f6b58096321647538fb699ce3ce3d3f0d7133f2db750a

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.7MB

MD5
da8e207c6191b6ec4d2e53ce0f1c0322

SHA1
572ad92b30e6967e6986f276877e2fad7d52a71f

SHA256
1ae4e07fa0003ed7465c6f1553665282358852358e66736695896cc6b77aa18d

SHA512
69aace6eff63a15e70e37e8cf77913afa52c85bb1255a618a629b828da64c420b36a7dea4c52d1e381bdb813b950d2898a4f45f6f6a5a5a801543e44b2d8abec

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
1.2MB

MD5
b3e054ab70e9be981738f8cb60004fdd

SHA1
c398682a1a8a677e302071b51a2caf3c5df00729

SHA256
2f634f7e3e44b02444612c5830b3e96038b5ef01e105648a07bae499f6864ed6

SHA512
0f8da870d1ed22e464ce41d48ccdb189efcef501058f25aa5690709029e666555c47474d39b4ea09d59542c525308c71365e1ac8112a862ea5c24aed1d54cc61

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
eaddb2dc3777d2c13529113ecdbf4a94

SHA1
45b641cc0ff84129ad16be6e1a044116db9253ba

SHA256
caf56998a9905fd5515253eab72a56efdf6568096c1a389c9ec412d3252f7f79

SHA512
89b6f5fc227c48e20dde0eef3f217f982dfd51c11cae45753fd08b55e0426e7d6e5bf3d3d6c9f4bb2c0dfe7238f9dd3af68858825d02376f035314d55156395a

Download Submit
C:\Windows\System32\Locator.exe

Filesize
1.1MB

MD5
fc49cb121fc0340fb95be9cfe1e64f99

SHA1
3dc67304db833aa7310679c79e08381268a7d4c4

SHA256
29140f3868e3ca59e2f8ff0365a7fd61969fc0190c2ed32bb6e7e3cb892feefb

SHA512
e16a6351ef5625960c259ee4a05372738169a4ca0bba71b0687b0ec89c7dc0fe6aa957922f75b4ab801b759b31ede51e2e37cbf50f3efc02f58342342afd6a58

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
1.4MB

MD5
62b27f1719ee0a27c1d201244f4fb449

SHA1
c3a3dd5af7b77dfb7d8778469cb75621576e7c4c

SHA256
56461d582633468f26184a8f40d3b3198e6461dd687aaf2da9423e97d9d63466

SHA512
400b5dc07d30c58b854a39213f0e657b73ad06cdee944ee17663d5709f10f08e72cf97c1d2051a15acc954744e10abf208cabe7632de0d1a6966de29499a7fd5

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Filesize
1.2MB

MD5
b85c767cf1ab0c58881947ed51d7247a

SHA1
4bd627f2a5e79584bb5a4044e96d3c997e9bd0cf

SHA256
8ba40bccf69b8df87e38ffb4cd4b77893469d58249dd52ad4eca80cf05565579

SHA512
044514f4c7e20e8747db1cad55fdf7ace6d4d2efd8d16af010943b2880270a158cd0b9c5b65920269a431bb450f5984b7065fe4f6b88c0bd797ab3f07127ccac

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.4MB

MD5
325076d1c662a1dd5421c180a755137f

SHA1
010ac22ecd7c7fcc720af9844b0bb10ec18b5d3c

SHA256
3517b0a229a31400e6289337ed93af9bfe026b5e8ae6300f27825bc017270d4d

SHA512
a30ecd184177411cb72ecc4170ec613d270a33e75a856f3bba2b48d6a4fdfe7dc43cab141c05ce8a5e72b2e6b8b1f200e3f4f75156649ae401c5501b73a023a8

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
a58de13ce7f3be46e300c727ca092fd2

SHA1
ba1ee97df9021d52d7e2901d9d4e35c4f35add21

SHA256
9c6c82196d39e9e87d3cd659436d102dd48de832950530e472839747b41db0ee

SHA512
a66cb2358fefdb106d1c552722539d0c912e26712925a556159f7e4dd8679c7e91effccc35c5911a47430332053b64c4cd51c9241a6cb39c47ce24acf1f96b24

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
1.4MB

MD5
d4f170583da13be61fa8176e6915c5f3

SHA1
ce04a3ab2f12fbc846ac0662819d1a169f4b1d1c

SHA256
4e26a210d9b68cf175afca45fc26e751362eeab583d4b0fc95478e1d47158cfb

SHA512
aec3237b7d71496750adb4cfe6af02187b9111fac7e5f28664939148df399a992808b387a8dddbb0161e1619a119ceba6e881023770495b6cd3fd895c739a0d0

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
1.4MB

MD5
b6a95141bd721ce0c2ac3bf3310e0e5e

SHA1
5f18749e52778660ae94d62c3b67c4c3d621a145

SHA256
6f14abe13ec4d861e72c0e93407a11122cdbb2a3cb4cc1bd4c80ca52e0d2e0b5

SHA512
06d1f23eaad2403c0a18a66f239b3818d51af38b3a11a068d535e8d75dc4b71a83cc5fb7d371af955079e021710a92b9878c9e880ee25fc45a4cb94d716f2418

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.0MB

MD5
07cff56049ffb0a860da845ad46287df

SHA1
9691b61516387a755966ae1e52c45c8b89a8648f

SHA256
25c4cbac3b4c3e167cae6c2108479d715e98e7a733f08504eed1c4c81f473d95

SHA512
af86b0b18c739a0b34ccf2a82636a8a7f12d162b8645800de68f1452598931d90764a11d6b21c3789ed5d2a923900fa98dd47f12502d16200da44818d7513bfb

Download Submit
C:\Windows\System32\alg.exe

Filesize
1.2MB

MD5
389a2b23649123ab752b0f7ee9f823d5

SHA1
0266f0e844329297d4ae06f88069e2aedf4eb3ec

SHA256
f3c3e49ec13e41092ca173b9093ea79c3812ef0d714af052b4227be0ce962b88

SHA512
ef466babff83385428bef3fca1758542057c86c0c77f31115419694ccaea78ac04c6adc3f137bb99288e7ba74d10c0fe23ceb02f59d1b6ff82a3cc856fd4a9be

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
1.2MB

MD5
1d7db7c36c8809b12b8b85b3182ca092

SHA1
6c8cdeb9a27979591a07675f93c5daed9a201c9c

SHA256
3cbf8d3fd8131a830a075468e8374aed76b6dd6db338d02f6af822863d1ff4d4

SHA512
2f644a02fba11b785e3c11c1c927be914c96e467407f9c5ba1b3da0c4103fc250ff596c6714d0cb722e488aa6bce2c76b7e82a8b5db7ecf49fec4da1f5956205

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
1.1MB

MD5
a89cd79983c501a6c30ad7e0e8bfa9c8

SHA1
afd1f1e1cccd374c9844102c6cf827548555ca1a

SHA256
710ae1b01fdc188b9cc1beb51d7252f3a4a9cd61012766ddbaa435182a27582e

SHA512
774972b139587692e0fc0859a7dcf9334a176d0fa7d85c3dd80db58fddf5ff32e750d3f539450c1da8f63f2ae1ea0dc65acd44d28441b71fee9cb79b544e7690

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.3MB

MD5
723db06dda3fe53de7ffbd0e0a632b49

SHA1
f123d913678813962c61d71c51c57260a9ce95aa

SHA256
184f5a9ea6bf7fc4295fbdd682c786441761d79ab2f5945b3611dde1f51da063

SHA512
7aa3edfa00812b514f9f5aaae1042694efdba7f38ed1e30a6148eeadeaecae7eaa2d172541c53f6941ea13ae715a10d0dab40fbb341e75cbe68b82a9972322b3

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
1.3MB

MD5
b64e215f259c7189a1692c1c318264a5

SHA1
ec8d1b63057170669f49981fa48f45ee3da12ac8

SHA256
2b238cc715f52a3d9d4d3e3d1663428b87579c15a0e21000888e67eaf4fd0e75

SHA512
14fc9d1c8fb10669dcd8757d740512da4b7e3243e78ccde8a70adb17f70fb58ffb60f82f098ba6bf5819bbf54b4118c3c881243b3046ba7fc2ba836c7a8ffd0f

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.1MB

MD5
084f52bc87cc4ed9689a67fe323f8167

SHA1
1f536faea0d2be5bd6e4cfbdb6a2b795be0c9763

SHA256
03cd6a2043d60f7e191a0f6a4dd5a02ba2d8520d829c475273ee23d65f3b6aa5

SHA512
b57564fb7a0299dd7ddd2bc710e0a26501d90b069211176be90d145956ab57d61c9745d46906331b8ab661b9920d9525b3ddf42cf376480caf0d8c078666eb68

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.3MB

MD5
e4dbc6e6fed333e4d58be92e8a2d1db6

SHA1
0a12093a9070f0a3d98fd9cddf2eba8790ca4e53

SHA256
0073b323dcd2eb4b9f55eff59830fa848820e710dade0244e02a3c6779a8b514

SHA512
265779d77fe64463381cf18d25bd62bbf8b93be91fcdca37829b7a3b9e51117b31b824704843298df3a7c8c289da4118778e92e7b2bebc9206d971e92b90bd21

Download Submit
C:\Windows\system32\SgrmBroker.exe

Filesize
1.4MB

MD5
f52eacb7104020efe4054de38efeee66

SHA1
799f1a7489f4e98c9ba39fb2077ab743a6568525

SHA256
f8f0e8cf8715929acf0e601cf88d33046bca0fcbf038caf258bcc83a33391da4

SHA512
c6fec960332046f418b2b2e5be35c955630581e80459b789bf3f75e6256f0c63f58210491ea45dd9d870c30ab8c7279e5dad333059b6b6cda58f7f6dbec68032

Download Submit
C:\Windows\system32\msiexec.exe

Filesize
1.1MB

MD5
84c3009878fa18fa8ce270311cce8e2b

SHA1
4825b2d703adba263c77f56c9ee466c9d4712e90

SHA256
ab95035993ad7e20baaf2b85e9f0276e522b8923fd8b378d0987b037b8ba3ab8

SHA512
12bfdc04274d42b9dea9c8f2b0b317dbc0c9da6c75e207131cd2fdbbb4f1e4e9e54726b92bd0e75b6336c879f7ffaaeec748cd1afc1463e714d7d0beadfb58e4

Download Submit
memory/232-27139-0x0000000140000000-0x000000014013F000-memory.dmp

Filesize
1.2MB

Download
memory/232-27003-0x0000000140000000-0x000000014013F000-memory.dmp

Filesize
1.2MB

Download
memory/1084-27178-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1084-27047-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1328-27821-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/1328-27167-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/2320-27298-0x000000002D800000-0x000000002D80A000-memory.dmp

Filesize
40KB

Download
memory/2320-26473-0x000000002BEF0000-0x000000002BF24000-memory.dmp

Filesize
208KB

Download
memory/2320-27295-0x000000002D760000-0x000000002D7F2000-memory.dmp

Filesize
584KB

Download
memory/2320-27292-0x000000002D590000-0x000000002D752000-memory.dmp

Filesize
1.8MB

Download
memory/2320-27040-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/2320-26445-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/2320-26936-0x000000002BF20000-0x000000002BFBC000-memory.dmp

Filesize
624KB

Download
memory/2320-26470-0x0000000029BC0000-0x0000000029BF4000-memory.dmp

Filesize
208KB

Download
memory/2320-27018-0x000000002CFF0000-0x000000002D040000-memory.dmp

Filesize
320KB

Download
memory/2320-26472-0x000000002BFF0000-0x000000002C594000-memory.dmp

Filesize
5.6MB

Download
memory/3016-26042-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26065-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26074-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26072-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26053-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26069-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26075-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26076-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26032-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26027-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26034-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26033-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26028-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26031-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26043-0x0000000000400000-0x0000000000556000-memory.dmp

Filesize
1.3MB

Download
memory/3016-26037-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26035-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26039-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26036-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26048-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26038-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26061-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26040-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26057-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26073-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26056-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26055-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26044-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26052-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26045-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26051-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26046-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26054-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26071-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26047-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26070-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26049-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26063-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26050-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26068-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26041-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26067-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26064-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26058-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26062-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26060-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26059-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3016-26066-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/3020-24001-0x000001EFBB8B0000-0x000001EFBB8C0000-memory.dmp

Filesize
64KB

Download
memory/3020-23997-0x000001EFBB870000-0x000001EFBB880000-memory.dmp

Filesize
64KB

Download
memory/3020-24140-0x000001EFC3CB0000-0x000001EFC3CB1000-memory.dmp

Filesize
4KB

Download
memory/3020-24049-0x000001EFC3BA0000-0x000001EFC3BA1000-memory.dmp

Filesize
4KB

Download
memory/3020-24199-0x000001EFC3CC0000-0x000001EFC3CC1000-memory.dmp

Filesize
4KB

Download
memory/3020-24063-0x000001EFC3C20000-0x000001EFC3C21000-memory.dmp

Filesize
4KB

Download
memory/3020-24123-0x000001EFC3C20000-0x000001EFC3C21000-memory.dmp

Filesize
4KB

Download
memory/3020-24196-0x000001EFC3CC0000-0x000001EFC3CC1000-memory.dmp

Filesize
4KB

Download
memory/3020-24135-0x000001EFC3CB0000-0x000001EFC3CB1000-memory.dmp

Filesize
4KB

Download
memory/3556-27152-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/3556-27140-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/3804-27198-0x0000000140000000-0x000000014011B000-memory.dmp

Filesize
1.1MB

Download
memory/3804-27062-0x0000000140000000-0x000000014011B000-memory.dmp

Filesize
1.1MB

Download
memory/4132-27154-0x0000000140000000-0x0000000140155000-memory.dmp

Filesize
1.3MB

Download
memory/4132-27029-0x0000000140000000-0x0000000140155000-memory.dmp

Filesize
1.3MB

Download
memory/4576-27498-0x0000000140000000-0x0000000140168000-memory.dmp

Filesize
1.4MB

Download
memory/4576-27136-0x0000000140000000-0x0000000140168000-memory.dmp

Filesize
1.4MB

Download
memory/4816-27054-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/4816-26506-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/5020-27187-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/5020-27837-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/5096-26996-0x0000000140000000-0x0000000140155000-memory.dmp

Filesize
1.3MB

Download
memory/5096-27001-0x0000000140000000-0x0000000140155000-memory.dmp

Filesize
1.3MB

Download
memory/5108-27817-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/5108-27155-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/5112-27041-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/5112-27166-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/5180-27200-0x0000000140000000-0x000000014014C000-memory.dmp

Filesize
1.3MB

Download
memory/5180-27893-0x0000000140000000-0x000000014014C000-memory.dmp

Filesize
1.3MB

Download
memory/5332-27116-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/5332-26982-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/5436-27101-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/5436-27277-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/5456-27830-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/5456-27213-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/5456-27089-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/5592-27951-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/5592-27214-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/5672-27104-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/5672-27328-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/5828-27392-0x0000000140000000-0x0000000140188000-memory.dmp

Filesize
1.5MB

Download
memory/5828-27117-0x0000000140000000-0x0000000140188000-memory.dmp

Filesize
1.5MB

Download
memory/5856-27080-0x0000000140000000-0x000000014012F000-memory.dmp

Filesize
1.2MB

Download
memory/5856-26938-0x0000000140000000-0x000000014012F000-memory.dmp

Filesize
1.2MB

Download
memory/6052-26961-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/6052-26957-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/6132-27051-0x0000000140000000-0x0000000140234000-memory.dmp

Filesize
2.2MB

Download
memory/6132-26971-0x0000000140000000-0x0000000140234000-memory.dmp

Filesize
2.2MB

Download