5b10c831aeb9b4bad3abec945de5f794154c5b00fbddfab1c5714962a89bf054

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2024, 09:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
Size 3.2MB
Sample240403-lq333sbf71
SHA256 5b10c831aeb9b4bad3abec945de5f794154c5b00fbddfab1c5714962a89bf054
MD5 030a82aef3365d5f1672198ed7702341
SHA1 8cdb63ab7a6f7ab045cdc316ce911c86e286c797
SHA512 b85251b2528927d74e8e5a5d46f1e1d86efb6407c1be375ff740b0ae9869eccd12c493d9fe50977c447655bc023133e6f553f605970b59a4af5df8d17b77db37
SSDEEP 49152:s5k1YCdptya507NUUWn043oHS3fTGYwVq1/xT3DDbw0TUqyFDmg27RnWGj:iNhSqYw8y9D527BWG
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1388	alg.exe
3652	DiagnosticsHub.StandardCollector.Service.exe
1436	fxssvc.exe
708	elevation_service.exe
3360	elevation_service.exe
8	maintenanceservice.exe
712	msdtc.exe
2420	OSE.EXE
1680	PerceptionSimulationService.exe
4416	perfhost.exe
1560	locator.exe
2812	SensorDataService.exe
2736	snmptrap.exe
2656	spectrum.exe
5332	ssh-agent.exe
5480	TieringEngineService.exe
5608	AgentService.exe
5704	vds.exe
5792	vssvc.exe
5972	wbengine.exe
6088	WmiApSrv.exe
3188	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fa5ec67f822cf6b9.bin	alg.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_75875\java.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{69188FC9-DE03-4F31-9660-69825F846706}\chrome_installer.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_75875\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_75875\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd0fc5adab85da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000967489adab85da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000531e35aeab85da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000689aafadab85da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d29ef8aeab85da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9d68badab85da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007270e6adab85da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000109b90adab85da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133566111197339691"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000014fe92adab85da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb3ed7aeab85da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
4524	chrome.exe
4524	chrome.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
2076	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
5496	chrome.exe
5496	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1896	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
Token: SeAuditPrivilege	1436	fxssvc.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeRestorePrivilege	5480	TieringEngineService.exe
Token: SeManageVolumePrivilege	5480	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5608	AgentService.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeBackupPrivilege	5792	vssvc.exe
Token: SeRestorePrivilege	5792	vssvc.exe
Token: SeAuditPrivilege	5792	vssvc.exe
Token: SeBackupPrivilege	5972	wbengine.exe
Token: SeRestorePrivilege	5972	wbengine.exe
Token: SeSecurityPrivilege	5972	wbengine.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: 33	3188	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3188	SearchIndexer.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeTakeOwnershipPrivilege	3188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3188	SearchIndexer.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2076	1896	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe	86
PID 1896 wrote to memory of 2076	1896	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe	86
PID 1896 wrote to memory of 4524	1896	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe	88
PID 1896 wrote to memory of 4524	1896	2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe	88
PID 4524 wrote to memory of 3256	4524	chrome.exe	89
PID 4524 wrote to memory of 3256	4524	chrome.exe	89
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 1200	4524	chrome.exe	97
PID 4524 wrote to memory of 2388	4524	chrome.exe	98
PID 4524 wrote to memory of 2388	4524	chrome.exe	98
PID 4524 wrote to memory of 3044	4524	chrome.exe	99
PID 4524 wrote to memory of 3044	4524	chrome.exe	99
PID 4524 wrote to memory of 3044	4524	chrome.exe	99
PID 4524 wrote to memory of 3044	4524	chrome.exe	99
PID 4524 wrote to memory of 3044	4524	chrome.exe	99
PID 4524 wrote to memory of 3044	4524	chrome.exe	99
PID 4524 wrote to memory of 3044	4524	chrome.exe	99
PID 4524 wrote to memory of 3044	4524	chrome.exe	99
PID 4524 wrote to memory of 3044	4524	chrome.exe	99
PID 4524 wrote to memory of 3044	4524	chrome.exe	99
PID 4524 wrote to memory of 3044	4524	chrome.exe	99
PID 4524 wrote to memory of 3044	4524	chrome.exe	99
PID 4524 wrote to memory of 3044	4524	chrome.exe	99
PID 4524 wrote to memory of 3044	4524	chrome.exe	99
PID 4524 wrote to memory of 3044	4524	chrome.exe	99
PID 4524 wrote to memory of 3044	4524	chrome.exe	99
PID 4524 wrote to memory of 3044	4524	chrome.exe	99
PID 4524 wrote to memory of 3044	4524	chrome.exe	99

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Users\Admin\AppData\Local\Temp\2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-04-03_030a82aef3365d5f1672198ed7702341_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=92.0.4515.131 --initial-client-data=0x2c4,0x2c8,0x2d4,0x2d0,0x2d8,0x140221ee0,0x140221ef0,0x140221f00
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd64af9758,0x7ffd64af9768,0x7ffd64af9778
    3⤵
    PID:3256
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1884,i,4646702448013780153,8243698179377133102,131072 /prefetch:2
    3⤵
    PID:1200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1884,i,4646702448013780153,8243698179377133102,131072 /prefetch:8
    3⤵
    PID:2388
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1884,i,4646702448013780153,8243698179377133102,131072 /prefetch:8
    3⤵
    PID:3044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3092 --field-trial-handle=1884,i,4646702448013780153,8243698179377133102,131072 /prefetch:1
    3⤵
    PID:2060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3112 --field-trial-handle=1884,i,4646702448013780153,8243698179377133102,131072 /prefetch:1
    3⤵
    PID:4484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4644 --field-trial-handle=1884,i,4646702448013780153,8243698179377133102,131072 /prefetch:1
    3⤵
    PID:4128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5028 --field-trial-handle=1884,i,4646702448013780153,8243698179377133102,131072 /prefetch:8
    3⤵
    PID:1688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1884,i,4646702448013780153,8243698179377133102,131072 /prefetch:8
    3⤵
    PID:3340
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    PID:2268
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff7835b7688,0x7ff7835b7698,0x7ff7835b76a8
      4⤵
      PID:744
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      PID:4652
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff7835b7688,0x7ff7835b7698,0x7ff7835b76a8
        5⤵
        
        PID:2056
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 --field-trial-handle=1884,i,4646702448013780153,8243698179377133102,131072 /prefetch:8
    3⤵
    PID:5176
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 --field-trial-handle=1884,i,4646702448013780153,8243698179377133102,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5496

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1388

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3860

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1436

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:708

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3360

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:8

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:712

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2420

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1680

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4416

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1560

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2812

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2736

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2656

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5372

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5480

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5608

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5704

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5792

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5972

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:6088

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3188
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1060
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 25de0b6ecc0b0f51b5f4561c3313ed64dfc58adbd24dae1ecac6039c6199739a
MD5 719577cf28e6aaa42a800313b4e569e7
SHA1 9d0690eaf26aafa58d32b4ace9d6a97f88cc5d53
SHA512 63906692b06a7c9bb9ada9db78eba3b3abd2b832dc46603db770806cd712d05112fdc97f234ca61a7d13958c8ef3a875a117d992e878389abbc3a129de636e0a
SSDEEP 49152:+uYk3H5koUafTqkkYLO/W2buywzMbOX+T7z5wDmg27RnWGj:+CfTqi90b0D527BWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 bee922cb748fa14c5951e4e594edd1a4756ecab3e9963fc17c3de6db68dd409a
MD5 f89d8c3cb7df039af5befe8eb0133f0b
SHA1 c3fc2d37fa96808935416c134ede932c36fffd8e
SHA512 0560f4e3beaea2b4bf818600a9cb6e9d8a83bda9cb4eddb41130a91ee3dc5a9f5c297e62605d6ce4a46cd2bc72afb2ffafd8b231c1055ca8c71168bf46bb252a
SSDEEP 12288:JCHP9Q/JcuizXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDtL:oPsJcuizsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 af9c65998407d66b81c559d8e7021b8e174071c3b52ea3ab7cbbf955399dc5c2
MD5 7f6c8ef8cdc9cca911113892c714d87d
SHA1 386cf50e2901ba91090d3320d3ac3440f51231c3
SHA512 5ffa0fd32ca910420bac51923afcac89f2d14bafa193c7ff63c8be2b36c001ffc9ec4c97d29df267e7d5ef406ef7e117a0b50e18b06dba21b4825fecd04bd02f
SSDEEP 24576:6+gkEnfh4CovsqjnhMgeiCl7G0nehbGZpbD:fgkEfSlDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b3c6821706ea0756584671977c5807e06ec188feb66298264da3fec5099a6726
MD5 2e77ec5731a286426c094c8e6193b9f2
SHA1 893c2a6e59f1d8e780d95630ac08b2f8c42b79c5
SHA512 f40bea40cffde613d7df0b0d6ef3b60131db11f6af07491aebb4bf19143d818988ea53655a97692d7bca00b3ec971125c3359d0704e144eff8a3e469ffa6363d
SSDEEP 24576:PBpDRmi78gkPXlyo0GPjrQsqjnhMgeiCl7G0nehbGZpbD:ZNRmi78gkPX4o0GPjQDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 14c26c7290089300e771e95a788a22ac848349fd588e11d7f0a793c7cb64c4b6
MD5 22e7ca28b863be7246bd9e7f0242d73c
SHA1 2e9c527f190bb582982886515a6f36eef34ff539
SHA512 1f0f593df2db7e615928b4ca171c80642cd8f05c403b33506107db06a6376b17904b42796d928379b944e7bd83f9c8f7a5b4f013ae22ddc3100ed8dbcd0c0b04
SSDEEP 24576:5LOS2oPPIXVvsqjnhMgeiCl7G0nehbGZpbD:D/P4Dmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 c0f5d9670ffe8d6f1bdf9a152aea5043bb7d25a97b67413cad3162fdfff1f2c8
MD5 ecc1100183276546b54a8e918187c613
SHA1 d4d81e4677a507bf6d73a8f39afa339b3368b468
SHA512 f93dd285dce8e7168ada26bf717b4a17a1744687bdd698044846766c78f9d06c8958dbde81e7f01ec60faff2c0936083210282948feb7c8b30c370cfcf43bd18
SSDEEP 12288:+HxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+HxsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 fa2bf0fdae42da183a1738de6870dfeb32820d7ccfa925f4185abced29a45664
MD5 20e4cd3579e6fb6de1d9cfd0fe0e7c19
SHA1 74035ab3465f0547bc32c4ba2e619375bad2c037
SHA512 b64d2830739bfe472c994578372f3339b221f596da0878301fbc8e69d48c5d763b2efdbdc2253365046df280fc6dc80528432ef3820c111c6fa5bbecd8f8d35e
SSDEEP 12288:zeBNUbTVO86UiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:zJIUisqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 002c6ef8e456b6a511b754625ab9ea52eafe0a112a2beb205ffbc69fa9fc87f7
MD5 a9f3016f4b40df3f4b30551ed45d3d0a
SHA1 b68af17fce2328eb52edaf9d068dd1154d854b12
SHA512 3f5080ae2e0b00ef7502a2c180a8aef60b2b3add48a0b520f98691767e7219951dcd06c25589ec36715842f2f7c919b6d67004085d49fe696140122c6a692b87
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THV:OQvGAdlCEL8c/RRNw5CPD527BWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 19b226518620eacecfa59b32763763c81b01c769a56f7ec323453fbb2deb9a41
MD5 a6850c9001bd9918fb3994cfbe9a0af2
SHA1 c376fe2f57d2abfd1b567c3706ae42959cdc92be
SHA512 03c230729f7ccd86316db9a13015045b55e2e9ca53604bd967233936c7d87f3c97398148b2b2f95e57dd2592f698f329e5fe512b2670624ebfcd0e3e7e024752
SSDEEP 12288:PAwSfxL/2Dc3FDLLmt0LDQewsAjIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:YoewsAjIsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 269e76d9989eaee9184f689d7a25e6722ccf86818b243b987a96761f8a3b0877
MD5 3727a12f86a323ff759bd4ed470dacb2
SHA1 9d76eec22b6cbc3e5d8f396dae118c44106cadd9
SHA512 a785c0448c973376d7fe7ebc513a936142d17fe15255766ef72e98f622d7b85eb013492e657c3f9fd315c6c53184b2c152c30e304b871e7ed1ce67713292b71c
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH8VQBWG:7UEtQevvqc2W1cpV2RI32DB
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e0ef1d5d6629100b5ec50e7672283d77b0134f6c0b7864aa2d64b7a43a32dd05
MD5 27233cac51aad5589050040c023e4531
SHA1 b6012fbe1a64d4b0a52cb81ef71f25cd35285197
SHA512 f7746709b509e0b71800d37ca54e22bba6020f39c276bd21b2a3d37f1a323e6b62182a2c38e56379163ef61c560ed018b87bb826379f67e57c55765c27293bea
SSDEEP 49152:PCbRquA/m2yL5zTfFiV+XenmE3/zUDmg27RnWGj:IoquVjnmjD527BWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8b89e8e1169c01e350ea4e6d071fc58681764a91c808d1177bf424e4822ac8a8
MD5 d9769d23ab4b83519a54bf4eba1154d1
SHA1 70051595c149f1105fdaaf46649cb224e73b41aa
SHA512 2212655409d7dfbb54090edfb7e761409131167fc553f9266a5ff7b0759ff4a3656406c5d3b750f7ecfcf3b6267163fb92dadc345892af749f193d1e5b7b12c5
SSDEEP 24576:gAhGL2IFoiwtA5l7S53fsqjnhMgeiCl7G0nehbGZpbD:gAM1Foiq5zDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 8fdc017dd252b3cc553237d25e16ce28b0bb1eba0b580222d3d33e18f3522d12
MD5 3ec2a347eb9c6ac9ae47d83dd367cc49
SHA1 a71fab393e260fa338a75e526d0c596c67240111
SHA512 01e18361266b8ee1ab9877b209d69edd10977496d0dfa9f2fd3326495cab009777c7390602cb91a4e6eebdfb8f8c4d5e85130c9619ef9deb1c7aff30786fe8bb
SSDEEP 12288:emw5HEjsChNUBFgl0WDm+CrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:3wulOWMsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 163a752f61321a7cc136f6f40ca0d500a85a028666083781e5c5665437573049
MD5 3bb8f2971fa8c24a0897ea616cc52e26
SHA1 cfb0443dcb76e0bd382b7c6d323b2a034d0917a1
SHA512 b44a06a58738e7591a1127180c1410755bbf3542fdfe322e064c18d8f76491af540ab8435a30babbc5ac9fe267def7e58a507b01f2c5a85d1a0e39e1e678f1fa
SSDEEP 12288:hJZ1IyYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PZuNsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Size 4.8MB
SHA256 6acd808c12afbc74d85455a629e97cc20036253bc029030493e1ec8d31204187
MD5 8511299fc58c44a1bd2491295db8866b
SHA1 d64c2debbe73bec335ad37d8702f1f8d0ce00782
SHA512 4a01d590f4c769faed8ea0c1c1b112a104a49fbdb5504b6c44b08f97bac61bb360a4327cedd1bb2fbddaac3688fba3765435705b7815c8d048236bc28a3264ee
SSDEEP 49152:Bj8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbD4iIerM1R6ZPS:KrZ4K5M+XD4iIewG+x6xZ14OD527BWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 168b08545bd325d1b53119b160ba7a5d6b2e2d1e59cc5255dbc1d7caa8f4b466
MD5 2a40c8fed4ab7f9ec3c29b9a0e86bcc3
SHA1 68c268f8d8b3971e5b2878b92154801756f6cc1c
SHA512 cb641ce86ed6275fec225ee28b758769a0fa12c5c1466b4edd41aebd0d327ce267afa6c35670e9520fe587d9c88d20f4d300f639fbf73a98d8db688fb63125d6
SSDEEP 49152:PfzabJ8llj+SWTi2mkx+X+diDDmg27RnWGj:Ebi2KD527BWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 5fa692515ad3dbc01f395990e077629b4701db170487d7a364724da4339150e8
MD5 97ac1082fe76759af551272f1e7bf3dc
SHA1 bed95f193b6ae71508c0374a937dde8f50af51de
SHA512 282c7780957e297de4b7187eba8019bdffcb30025b3228a6ce196c1726741d372c011a0599d915cfd3791b74f4c4e7950eae3bd32c9001bc4207570eaa0efb8c
SSDEEP 49152:Ma/3xXBSZ4K5MJ1LvTMxbYsYBYSgxu9+fw4TuDmg27RnWGj:OZ4K5MJabYsYNHD527BWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Size 1.8MB
SHA256 db39923b6e7e9f565aca586bdaf1a61800e374d36a08b0d2965686dfdc09a7cd
MD5 622b934dcf03099414140d7629663c19
SHA1 8e8c0ba8f296ced24189973f68ee0964d5ddea2d
SHA512 ac406826224c80caeed72067a034cf081660670af417b3c5a712d222bd049977e17de42eb20da7a6f94fad83807e420cac1fd0a7ab8937d8ea0cb042cb45ca3d
SSDEEP 24576:cgNJw85yUKzDu/9g+PlfLO8C49BgK2sqjnhMgeiCl7G0nehbGZpbD:cgNJtUzDu/9g+PxHC4oDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

e54fbaf2-6384-4e96-802e-94c03117b346.tmp

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\e54fbaf2-6384-4e96-802e-94c03117b346.tmp
Size 488B
SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
MD5 6d971ce11af4a6a93a4311841da1a178
SHA1 cbfdbc9b184f340cbad764abc4d8a31b9c250176
SHA512 c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f
MD5 SHA1 SHA512

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 8cae494ed8d04709b5caddd5a8e1303de14227df5daa732dba52a6b72f0581b1
MD5 94a3b45ebbb6976b1a93a858666ca84e
SHA1 fc6815c798329901632e193e2f02b4ab561e7cda
SHA512 4005907f9cb51def4532be3b11142073fbbdd731baaded63b517d5e11dfbaa230b2a5bf7122158ac10d50fd430d1b69f0c1bcffc28ef198b3a90cfbd5ef0f7e3
SSDEEP 24576:wcP4mcvIjkGOxhKP2l71SNKbrh/8KB1sqjnhMgeiCl7G0nehbGZpbD:bP4m4IpOO67N8KPDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 6622c8e67a4a7757e3f02da06fd7b46f214b35e604e81b25542741046b83b1ec
MD5 da28b9b3395fce577f9f3f04e7fbec44
SHA1 d7d0d810841fe31fbe8eeeb4592c5f2e05d40618
SHA512 1650cb7ef59dea193435d345e2e2ea28509c5bd71df14b3c39d20d0f6741827868ed46547acda2c6e129c0cc4786804e154ff4f05e9b9e8936cb5c6f393f3f8d
SSDEEP 12288:sFSq0SAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sySAsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 0c08e7fe9a70023ad15bea10d76035610c1d52a826ac1af4fffb88953e4b1ced
MD5 ebf424291670dda4b391fd882059506f
SHA1 fdf5196e0b5d872e7b8e9c35abea4e779329f606
SHA512 a9731e463b3a62211a105c4de220c460b3e982728a8630d9821814d3fb774316ec94a37ea8cc1668206aa83ba4b8f42df08dd61255da3b7fb8941eda8adf4ca5
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 193KB
SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
MD5 ef36a84ad2bc23f79d171c604b56de29
SHA1 38d6569cd30d096140e752db5d98d53cf304a8fc
SHA512 dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be
SSDEEP 3072:HXm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4g2rJBXCy9enoN:HXUMCm4U6q62MEBi99g6JVCvoZhhl+No
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 944B
SHA256 8337b9e6c893d4bbda83b7623fabd42cd20dec41f185e68c77ccff5234f974ca
MD5 76e7016f7c13786c3ec6b027e6e2f5d4
SHA1 c2190a0cbeff3ca7421b0115e3def0ad366dcbde
SHA512 7ab58346cfaa34606b0c89355e326e2db641648e363bcaf2d1ff2a41049fa7deca8c8c429e34a9d8986ce7286c0029085b4cf6997597b30af0ebc4862315fa26
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 371B
SHA256 800cb2987d060f114aa1ce74a26ef97a287cb9b44144145243cd754a131a1521
MD5 c969c208e0ddb7d6733b0e3e092a068f
SHA1 2229c3c61148715644e71bfdd12e8d52564fb24d
SHA512 bbb3920efd5ea8a35954e7f767d595478c8d91799beb409c3ef57753728b51e89a6c83f249e5e7ba67523814e9d050d137784119b151629a886d3fe08c287b60
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 f160c03c029ee6cca2d1b96d7ee1f2d962f4e28feb0228672b4cda02dac9f432
MD5 b01773236ac5ed74be5278756b0354a7
SHA1 6319585c26cfa88ba91c49a5a976682cdd9814e9
SHA512 5b2bbcc1cc685acbf5b25dea172653a1b0d59e4d915de4f424b9ad624c62c76f51052d9f6b21c416dc63e0c1a667f26643233b1406c7b9867e88206f714dc8cc
SSDEEP 96:IJhIXgjk5yrV8iZRy7Di+6MsmdeYq8XOY+jVlVup:ITIQNh8syy+FUjS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 4KB
SHA256 00d16bbec63533ac27c7f0c9bb7cbd90e27b0efc4b524964d7297604e4722a69
MD5 7d98e41919a9793a140a42a91eb4ede2
SHA1 7c68d66fc2a666bc9f6df88dd7dbce032e64db8b
SHA512 4ae82ae052d8fabd32e65033c597f26178c7174e56290c6227fee087a5c4a25b21814d8789bd4dc24e0929fb35bd8874cf86ce6c850167314d950bfdb969b68a
SSDEEP 96:IJhIXgjk5yrV8iZRy7Di+6MsmdengOY+jVlVup:ITIQNh8syy+FujS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 4KB
SHA256 4b0cba9ad09e64f7895ee712e1f16b9ceeafa3278bc49f48ba0eb7aa74bc3f73
MD5 1b70747c1edde3673f98a36367916146
SHA1 645ef9efce84bebb0302d64c1a350ae44e03eaf7
SHA512 93cff95afab7a8eafdeba1471ec7721ee17a7ffbbf1884d99fc8d01b613c83756e71b1cd1a23f26e060145bf7ba56d4e7195fc8536d92fc5c16e3d3889358ab0
SSDEEP 96:IJhIXgjk5yrV8iZRy7Di+6MsmdeXBOY+jVlVup:ITIQNh8syy+Fu4jS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe576726.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe576726.TMP
Size 2KB
SHA256 8ad9b41fac5669e8a2efcb59587645fffe2ef0494a7aebf17c7cb0781f87d7db
MD5 6fe4bad5e77f6d29673dd3adbad450a2
SHA1 70183705e4fe1ebfd9cfac7c1141d1982d85085f
SHA512 1221c99e1cfbc36789d3a37b7536da2b16af9b9423642dac9f12e91022eba1e93d3850ee2c80eab6e017dd20e8229cd56f491d824f35dc627ef34eb917c51736
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 88e8b115754e263f384b77aa60316e081d6ab7dd86e7c6ebbda4c74016f8e0ae
MD5 ae5cb1f33392a43096635c2f534acd38
SHA1 22a86387ceae593a8b3f4f47f2b0b4f783905391
SHA512 1dfb78bf7ad9cc504558e5eaba6fe91903d795305170ce08289de60495b87f72e1a5c0ee042184b719758c0964272ac8451058adcc46bc4ae2512a990cb0af3d
SSDEEP 384:FeLPLeUXo1kXqKf/pUZNCgVLH2HfkzrUbHGWP83FeYdb:ILPLBo1kXqKf/pUZNCgVLH2HfArUrGWy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 260KB
SHA256 a89276f05bea62ed2231c35fc3f39182449ff2f1937defe0b9927f2ed2df8015
MD5 464cf47b05cd717a689434ab246d860d
SHA1 204de27efac356b7f3141fb6e4127629dd204a3d
SHA512 37dc26af357f97f43ece2a728d794551c4a0ca74771a0e972c5be2b971b25d9ef5cec2b263d8efab2c9c877b0eb8d36cf6b52e876b979820b74f520185708057
SSDEEP 6144:ismA8mvu7et6sIPDjgGnh5N+oDEASNdvXCNpbMHtCMpSM:ismFB7e4sQDhFXgASNdpHtXZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 7KB
SHA256 727606933d5bc1295ff48bc6f9ffa80c138806538fa6f7f565fc9672e80af1bf
MD5 972d4ca9e1cd8bb56cb110dabc43089a
SHA1 47b1224878d84cb93f1d83d38a3afc5c0bfaf0ae
SHA512 b1447dfa49a6e9594a355293199eb7efe956dabe3a308cab269a066603482cff5d6e30834f01157f258fbeccdf0b0011442320d6b26cb8b766a9fa41d34f660d
SSDEEP 96:xCACmZjZCNcHmxK3WK3YMLS7+l8xK21K2GsKArD/:PmcGXuy+SbbrD/
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 8KB
SHA256 afe391ad91c29511697b7fef98cd8705ee1a1946cf9bd31e1244da3d0e7010f9
MD5 c4da3c3a434330187882bf9d5afad85f
SHA1 ef80dedf58a2a613704524b49da0f1fc0e1ada53
SHA512 4286728f887ff07c310f62477f7f80bbe0a16d2113ad61e98cb3f45efba4192bbc9bac9b9fe738028dd30148af55a0cac6b9599599fe31d5056a5ed6082b5bc2
SSDEEP 96:xCACmZjZCNcHmxK3WK3YMLS7+l8xK21K2GsKArDZ0G7gVxK3jK3Iz8:PmcGXuy+SbbrDj7qGnI
MD5 SHA1 SHA512 SSDEEP

Submit Download

fa5ec67f822cf6b9.bin

Path C:\Users\Admin\AppData\Roaming\fa5ec67f822cf6b9.bin
Size 12KB
SHA256 b68c1ad3f09ca3f5381f836b67aaaaea7bb4e58e999e23a7de73ada3418bc0c9
MD5 af84daaae33f1fe65c7521c660d5ce44
SHA1 bc342fe73a5f3a75078b1dd3d9d4124a6e2c596e
SHA512 121edb17f81c255b43b03fe65535ef1b6480f49806d6e7ffec2973f082669ae063732c0cdffd4c2a5a51bd1fd8cd9b5ef872844e10f9bb9c99bc515306191af6
SSDEEP 192:ZIU4A8Qp2jCctFlabSRQ6kbZxGET8wB902pX1D1ojIR+XSHamjSsv2/MDw:e3Gp2ekbabSRXkbu6h061o0iS1SzMU
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 2542968c98c2026747c711eb6f9ecc96fb8140a11ab4081867cf2d1e34c2fe5f
MD5 264a7c6e07f00eb69de62dc16354e403
SHA1 492d837046bdcd932539bb9bfb545fa56e9a5942
SHA512 fc5b1b0dc8c0d7bfb6f9c25e6b68545723b8ee166243a08428048b40667f8b9a6fd49c22c8f9dcdb9c4f96bd75057b819cc0f61551aeedcc28c8bcd915b29c39
SSDEEP 12288:ItXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ItsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 27c9c34fd5dd64f45ddce91e7340b5c72d1c6af7f196e9458b6f4fda641a34ff
MD5 97549f2394317baa68d3cbae67c59490
SHA1 10b095900773d90bacce56f0205c2e127195763f
SHA512 1b20f3f787656452960695d234662b0b6c66dabf91f4a284c9b0e81197f199594f770c133e543fb6f526167fad320cc2f7f6ed5c9733e83b26f3da7fe3af6a03
SSDEEP 49152:da0h2GEkuAe73q3pp46zwwQLDmg27RnWGj:da0hNYG4Jw8D527BWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 e94023aeca349e10d22267d621ea79b960dbf64308c60e9dd808bdc8a10dffc0
MD5 7c76671e696231c66725d12542a9b8cc
SHA1 5e9a0baa53df4aabcb1b145448a73c0e8ec4ad3f
SHA512 9dce9262c220ee88f78763a739ac67124a379db5220095d3e5816670776450d8fe373297df95f0749c9946a0dba05a8d6c8ec0febae25ff3e2d71b3f47950bd5
SSDEEP 12288:ahbHjfXUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ahbHjPUsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 a2ca2049da9504057c5b0744e319b3f7409b92b359b16b8bddf7caa65cf01bae
MD5 c8529c7902deb5ba7d582104fde4d4e3
SHA1 44994e6d49146800f6cb7d94ee7aacc1717985ea
SHA512 4bf3f53936a956b0e24a2484528ae65a0af9d16aa74213c409da9b9ae5571a39cb79d2d2110637de7c7253344f9be0397ce71348e6717163cc351ecd21254657
SSDEEP 24576:Y3YgnJcRTk4yti+R5dpR/MsqjnhMgeiCl7G0nehbGZpbD:YIgnaTk46ppR/4Dmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 61d0fba538a8f26fa5ae7783b1e3d5a9d8c093fda48f110536a1b1d39a4ce134
MD5 82dfa51a36586a83f4ebd3957f234938
SHA1 c0b75f18642b727b1535406c752de19feb2eddd4
SHA512 f7c251c25825cb0fc1c8bb79a02dfa4ffb77d1277a5ce5f87932141e865b52b5e26ad32b98dad2c3f4ceb3e765671c316caf2d22debf298bae7e0bffbc048815
SSDEEP 12288:5RXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5RsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 59cee3009cf3b64a30960ac8dcbd540f8245de50eb26896ec5c78efa0c1ff8a4
MD5 46fef1976c5c290d5666ffe7531c49d5
SHA1 15d913a1d376daf709c767441d7b3cdf9d42acd5
SHA512 447a7b04932f6e4fb819093fc0cc8b237dc19fcf765fe72b63b19c40cb0ccad1357b8e6b017f7976f31b1fc089156b2cbe1e75773d0c9b54a0991c91019f8990
SSDEEP 12288:PObtA4LWOsvAYFTuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:QZL3UTusqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 ad71035dbd17be201142d6ca7967212c0a6db805de22f6419b308b5f59426ffb
MD5 35711e56c161386d524f091f45bd358b
SHA1 4fc65eb1f53b6c0e5f66a846427967275b9bace9
SHA512 cd7b798511b17749199a6653c1a5b0796d37d2ca24ccb1fee6ab6e015caab1084e9ecd0013f2643b79a64802cad9a1d9077eecb30afa97759ac9fa3b79add572
SSDEEP 12288:7pFtqOCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0OCsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 449846d6c7058fb166289dd97af8172cc6741907f91074eaee5035d9cfe7a795
MD5 7ee9db37ed6b7d37655aaf78af0832d8
SHA1 8eae44e19ec21be8019b0139935de93cc8f44b83
SHA512 b7c8156378e2349eb2a3a6bd7afdbdddabe2d0ceb9286182e4ed29c79521f547c10532b9b60c7bcdb7c91f4837dbc60f91e4a51d8f004f3433e894c2a80dab21
SSDEEP 24576:l7NM9YmZqmWMUkPjZM48Mv6bEhsdsqjnhMgeiCl7G0nehbGZpbD:l7cBWMpPjN8DbEhQDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 3dae1945d7509c29006bb92204b280706f07b9bb461cab9ec0f2697f41939737
MD5 a2e94109dec13c230e289e0082f3a042
SHA1 67cc09f35883443ea43c730c49f00f46cc2dbd3a
SHA512 ad9fb74db2e32ec1aee08fe8f662d81736697b4f1adc2c3d4d5645487771d0d25bfb442211f852aba770c934616cbf1b812c61620496107ee06f4141d2521c7c
SSDEEP 24576:/W6BApg2YuyuNDYTabvcRvNYf8km1jsqjnhMgeiCl7G0nehbGZpbD:/F2YuHNETovcvNYf8kmhDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 a43f94772496b49f8ab9d99380841d4a8817f6bb61c02f66e43e6f4cf113b026
MD5 ba49ca5b76902c1644a9301dfbcfb3df
SHA1 6264b1c3033811838d00551fd897b33ec22ecb36
SHA512 8fbb833c60d6a3a49f9c72293b2ffe9b84b8fb23383c5f54a0c2cb70ec510627d207dff82c98660a312a488275b2722b502d350c6b9c3631424d6bea97719dee
SSDEEP 24576:XAFs06+OmlfQNXEbTo2sqjnhMgeiCl7G0nehbGZpbD:wFs060lcXurDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 e2d7312ba741cc21d9f8ab02632fe896780f00e1631d08970378344c6c465926
MD5 5fb845b0cc3cb35eb659cfe9b0ceaac5
SHA1 5d3492b503e286476b5d0280407956fde8e56bfa
SHA512 adf0e04cf94e5a4719dd88e9fc0a13719affa835c59367f2d2b01d95dee250739aba9b36bdbfaaab4715ca77940fdb5fb9b0029292e318e56aad188d9d870ff9
SSDEEP 24576:yJnJ5D3WLXsqjnhMgeiCl7G0nehbGZpbD:yJnJ5DGLrDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 14375e85fd5dcca12116118ec1392f444a61fb86d91535ee17cc3c377f628480
MD5 0c5b470a8370c02c9e55e3cb747b8d5a
SHA1 7cf0c89142b7cfc09bcca214f6609f196da98cf6
SHA512 fb086034c89af37e81db2c26bf2579e10b450a885de3fdd17d9d87fb5f7c120a52a3a47256efedd60a69fd79fae7b82428eed8858f8441a0534c81f00e4a5c13
SSDEEP 24576:oEPohm6/7IIXdwcXrif7qQncjlP65i3VuMsqjnhMgeiCl7G0nehbGZpbD:Ho06DIKdwc+eQnSt65aV9Dmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 6b876c25a2dd5611bf904257003d92d2182cf741df1d253cfa350c5f9d83b400
MD5 60147ed92ec6c120d307b313d35aac84
SHA1 f29040314946d178220cf41c501517a551e0ce0c
SHA512 1ee41440d957c6243f10ca8b9af2f90a8d92e5ffb44467de22b17569d860df03198bcbb5b7bfde8cea3391fb410e89565e896ede266d6161f03900142bf3dd27
SSDEEP 12288:dEP3RBiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+BisqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 c1c11fd505b23996f6770fd2c0c10db06c45893db0315e4dd361fc3a2a97a157
MD5 80d80a48d79d107a74fcab752cdae8b2
SHA1 672ec18f70ff48be5f645c54cf7f32ab79b6fb59
SHA512 b574820401576b5eeae451009d630ee052b31cd599d8a27c6ece2f87c225f2af0cc17fb30187d187cc1ad7dbcb43ad8424f6a4088d2540639fafed20a650a38f
SSDEEP 12288:HjkykXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HIyksqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 59604be333438f3c4e4c077c9d040e7c27f8370a75a89bca9ed773cf739d7e6e
MD5 502a83acabe798de27075232ed2af117
SHA1 1696e34aa4716801cb69be397a25b61d14a52bde
SHA512 0815771c7444bc60cd6ef22ac0e34c538d0f64115be46d1dce7a60bfd801769b3aeac808636361f9307085ca81c62f6eede739b28ea94425bb90d76a419dfe65
SSDEEP 12288:KrSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mSsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 ef50c3b7dd645cdadc66775065a4d99c42033773e70dbeb7d977671a3c78a8f3
MD5 eaf74cc014f937f0375e16c4a62b704c
SHA1 aae12a2f6a6b4997ea040aa78b4d5c4a561dd53e
SHA512 d0e6c4e91cb6035df89423adedbdad33a7da1b7b023c1f06565c2796a70db8f60206b4373908b17428edd7dc1f2f4aeb3d911cb96734fb7514dc2728fc97fcdc
SSDEEP 24576:AQ9MxZKdcz97w3lsqjnhMgeiCl7G0nehbGZpbD:AVKXZDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 aaa3718ed92d64d88bb392ede08d19521be58c90f02b642d7343af277141296d
MD5 97eff7b55e4baabccced54d78ba8ed39
SHA1 0a9f874a4f9a34cd476ac39ac3cc08ed0bab6860
SHA512 de77085baf50349e7f645b9a36d678738fdb356a63ac4655f85fb4a7838121505674eacd1057f84491cc72a60f3aeaa66f3a07f0cd23e7c2c2f623dc4eb1c91a
SSDEEP 12288:4yoKo2hRple9pIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:4yocbApIsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 4bb4460bb1e017cd2d5b533e02033a1b566393e969fa44233fa04d966b9f28af
MD5 1ce4713cca6241c490288ae206d0a942
SHA1 a3bf0b743f41302179b86bad52265a5d45679d44
SHA512 8f5102b0b148b35906792f08568d9f17d52f8e41f5c58cb35716634bf59cad0295c0e438a2e8f38b6492e2796c6a712e88401d0235ccd80cd0014e1704727d2c
SSDEEP 49152:/WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIK0Dmg27RnWGj:n0zuNIID527BWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Windows\TEMP\Crashpad\settings.dat
Size 40B
SHA256 4ff4abedc31b5dde5475b74633f6885981d29ad36c7d0a68c034a3a40a7e8d19
MD5 a9192caed8f01c6787ad3bdd1d229175
SHA1 00c9b64675e398322180e827875ebaa059450717
SHA512 b5e788c1ac18e745d2779925cd6cbe80d65da8f2667d66ffeb37da0748cc9720d8f56fbf55c36fa3825de404bb60741fe85489929c1d793d3365d7766eff8da2
MD5 SHA1 SHA512

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e9f92b60b9f4b52bf143a363b82e9c58b1f3627da37b8b2db71fac9ea6948571
MD5 1e41b7bd84dfe49059d46dafb08568e7
SHA1 dc15c4395524c009ced7f31a67530b1bc1ebcfc6
SHA512 987037c00b899c52c4b8aacbf178fd135145226420605db87b1aec2c4de6724f6cd1588476e8091335495580d4416132de300a313abea1d9b573869a09e5bc43
SSDEEP 24576:91QT7EcpfxR+N5AWAz3ooiYsjMqbrsqjnhMgeiCl7G0nehbGZpbD:ITDxR+N5YzTujMmDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 1cc8afce52a091ad9499d725f056034a83d3a2b950f9b18a0ffdfaf325195dee
MD5 270e640b095e4d47f6805d9a1476a1ed
SHA1 bf565729c59dab18e39eba5dc43da0b5acb487e3
SHA512 da635f93d4703b3e52763609febeed1281e9acde958cb6dcefb7f065966a1eb69ca18aefb6fca1269c0eb9d3830b456da44d98ffec8512c5c3c673f579c9d487
SSDEEP 24576:zTMdOz0FFS+PmSL/sqjnhMgeiCl7G0nehbGZpbD:x0K+PmSLjDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 6d2124b122a7e6bd6aa3b7285faeec0b298e9e2afcbad975a92e6c3e2a006bfc
MD5 91a9b8f4f65c720aec53e6d1dad05797
SHA1 397f178dea8a747f5476e6b8fe76d2563f72bc33
SHA512 bb2171036a9ec8becc56aee7c3b7d1ab92bced664ccf5ae9bd1e3869006f4339fb00bbc272f32bde8430fd6ecd630d277df19523b3c12adf9e759baf77a8179e
SSDEEP 12288:14puXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ausqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 dea2087c88ffc9c8f06489e6f4b8ed81951af7d63492e3e3a56b01a18c6ab922
MD5 bd943c835195690ff9d045bd39e6b989
SHA1 ddea001a2a9825a1c4354fb4491f656d2dd3f9ce
SHA512 e9b4af783e71bc589b28f85d57c3546b8521efb4232676d9d443e346695fcd3a4f804189209cbb02bd24e86c593ee0d1c986fc2466fdcf7aefe5e87e86db4cd4
SSDEEP 98304:d7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gG4/QmvD/cTwY2h3FYD527BWG:hM7pTXexZPGzURnBh6gG4F+W32VQBWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/8-131-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/8-111-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/8-129-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/8-122-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/8-110-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/708-69-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/708-68-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/708-78-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/708-117-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/708-113-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/712-204-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/712-139-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/712-133-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/1388-105-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/1388-32-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/1388-18-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/1388-19-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/1436-57-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1436-58-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/1436-64-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/1436-72-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/1436-76-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1560-184-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/1560-175-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/1560-270-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/1680-159-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/1680-168-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1680-236-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/1896-30-0x00000000020E0000-0x0000000002140000-memory.dmp

Download

memory/1896-36-0x0000000140000000-0x000000014033D000-memory.dmp

Download

memory/1896-2-0x0000000140000000-0x000000014033D000-memory.dmp

Download

memory/1896-7-0x00000000020E0000-0x0000000002140000-memory.dmp

Download

memory/1896-0-0x00000000020E0000-0x0000000002140000-memory.dmp

Download

memory/2076-12-0x0000000140000000-0x000000014033D000-memory.dmp

Download

memory/2076-92-0x0000000140000000-0x000000014033D000-memory.dmp

Download

memory/2076-11-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/2076-23-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/2420-156-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2420-219-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2420-149-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2656-312-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2656-237-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2656-223-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2736-220-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2736-299-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2736-211-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2812-282-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2812-205-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2812-188-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2812-583-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3188-352-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3188-361-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3360-104-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3360-171-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3360-99-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3360-89-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3652-130-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/3652-51-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3652-44-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3652-45-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/4416-265-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4416-172-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5332-267-0x0000000000A30000-0x0000000000A90000-memory.dmp

Download

memory/5332-257-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/5332-325-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/5480-279-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5480-272-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/5480-339-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/5608-296-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5608-297-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5608-291-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5608-283-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5704-566-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5704-309-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5704-300-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5792-322-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/5792-313-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5972-333-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5972-326-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/6088-348-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/6088-340-0x0000000140000000-0x00000001401A6000-memory.dmp

Download