0000ff418f6251d8f390034d64de4558b41ffd7ec6944139c0f13e6594a15408

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2024, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
Size 5.5MB
Sample240403-wblklagb5t
SHA256 0000ff418f6251d8f390034d64de4558b41ffd7ec6944139c0f13e6594a15408
MD5 f297fcd32c12ba2752784cf7401047de
SHA1 431669b05cafc44490c41f140ff9576219805b5e
SHA512 8ce9ff92ca6703facd5538232a0f1dff0a9e4ba3e79e29e0a4b4e1aa04df29e3257badfa8d056c9572f818c447d9d521319447b5e45a3f6b243db74ccface51c
SSDEEP 49152:ZEFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1Ln9tJEUxDG0BYYrLA50IHLGf3:NAI5pAdVJn9tbnR1VgBVm5fFPfUNF
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4728	alg.exe
1348	DiagnosticsHub.StandardCollector.Service.exe
1164	fxssvc.exe
4508	elevation_service.exe
3576	elevation_service.exe
3368	maintenanceservice.exe
4224	msdtc.exe
4800	OSE.EXE
3504	PerceptionSimulationService.exe
4496	perfhost.exe
4624	locator.exe
832	SensorDataService.exe
3764	snmptrap.exe
828	spectrum.exe
1372	ssh-agent.exe
4592	TieringEngineService.exe
2568	AgentService.exe
1880	vds.exe
5140	vssvc.exe
5368	wbengine.exe
5664	WmiApSrv.exe
5872	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\45bd6d7546f975ab.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_79656\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_79656\java.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006a4f45acee85da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b79cf9adee85da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133566399024549203"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000061eeaaadee85da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d5b047acee85da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc6de7acee85da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a86c06adee85da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003f3970acee85da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f0a8e2acee85da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000075378facee85da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
1708	chrome.exe
1708	chrome.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
3828	chrome.exe
3828	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1708	chrome.exe
1708	chrome.exe
1708	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	856	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
Token: SeTakeOwnershipPrivilege	2316	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
Token: SeAuditPrivilege	1164	fxssvc.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeRestorePrivilege	4592	TieringEngineService.exe
Token: SeManageVolumePrivilege	4592	TieringEngineService.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeAssignPrimaryTokenPrivilege	2568	AgentService.exe
Token: SeBackupPrivilege	5140	vssvc.exe
Token: SeRestorePrivilege	5140	vssvc.exe
Token: SeAuditPrivilege	5140	vssvc.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeBackupPrivilege	5368	wbengine.exe
Token: SeRestorePrivilege	5368	wbengine.exe
Token: SeSecurityPrivilege	5368	wbengine.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: 33	5872	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5872	SearchIndexer.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1708	chrome.exe
1708	chrome.exe
1708	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 2316	856	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe	85
PID 856 wrote to memory of 2316	856	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe	85
PID 856 wrote to memory of 1708	856	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe	87
PID 856 wrote to memory of 1708	856	2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe	87
PID 1708 wrote to memory of 1424	1708	chrome.exe	88
PID 1708 wrote to memory of 1424	1708	chrome.exe	88
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 4636	1708	chrome.exe	95
PID 1708 wrote to memory of 3884	1708	chrome.exe	96
PID 1708 wrote to memory of 3884	1708	chrome.exe	96
PID 1708 wrote to memory of 1844	1708	chrome.exe	97
PID 1708 wrote to memory of 1844	1708	chrome.exe	97
PID 1708 wrote to memory of 1844	1708	chrome.exe	97
PID 1708 wrote to memory of 1844	1708	chrome.exe	97
PID 1708 wrote to memory of 1844	1708	chrome.exe	97
PID 1708 wrote to memory of 1844	1708	chrome.exe	97
PID 1708 wrote to memory of 1844	1708	chrome.exe	97
PID 1708 wrote to memory of 1844	1708	chrome.exe	97
PID 1708 wrote to memory of 1844	1708	chrome.exe	97
PID 1708 wrote to memory of 1844	1708	chrome.exe	97
PID 1708 wrote to memory of 1844	1708	chrome.exe	97
PID 1708 wrote to memory of 1844	1708	chrome.exe	97
PID 1708 wrote to memory of 1844	1708	chrome.exe	97
PID 1708 wrote to memory of 1844	1708	chrome.exe	97
PID 1708 wrote to memory of 1844	1708	chrome.exe	97
PID 1708 wrote to memory of 1844	1708	chrome.exe	97
PID 1708 wrote to memory of 1844	1708	chrome.exe	97
PID 1708 wrote to memory of 1844	1708	chrome.exe	97

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:856
- C:\Users\Admin\AppData\Local\Temp\2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-04-03_f297fcd32c12ba2752784cf7401047de_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2c0,0x2cc,0x2d0,0x2bc,0x2d4,0x140462458,0x140462468,0x140462478
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe87889758,0x7ffe87889768,0x7ffe87889778
    3⤵
    PID:1424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1664 --field-trial-handle=1864,i,5279789910384999760,16477259389272381353,131072 /prefetch:2
    3⤵
    PID:4636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1864,i,5279789910384999760,16477259389272381353,131072 /prefetch:8
    3⤵
    PID:3884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1864,i,5279789910384999760,16477259389272381353,131072 /prefetch:8
    3⤵
    PID:1844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1864,i,5279789910384999760,16477259389272381353,131072 /prefetch:1
    3⤵
    PID:4688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3068 --field-trial-handle=1864,i,5279789910384999760,16477259389272381353,131072 /prefetch:1
    3⤵
    PID:904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4088 --field-trial-handle=1864,i,5279789910384999760,16477259389272381353,131072 /prefetch:1
    3⤵
    PID:1596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5116 --field-trial-handle=1864,i,5279789910384999760,16477259389272381353,131072 /prefetch:8
    3⤵
    PID:2340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 --field-trial-handle=1864,i,5279789910384999760,16477259389272381353,131072 /prefetch:8
    3⤵
    PID:5248
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    PID:5436
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff7ba357688,0x7ff7ba357698,0x7ff7ba3576a8
      4⤵
      PID:5468
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      PID:5568
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff7ba357688,0x7ff7ba357698,0x7ff7ba3576a8
        5⤵
        
        PID:5608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 --field-trial-handle=1864,i,5279789910384999760,16477259389272381353,131072 /prefetch:8
    3⤵
    PID:5476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2304 --field-trial-handle=1864,i,5279789910384999760,16477259389272381353,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3828

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4728

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1348

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4944

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1164

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4508

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3576

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3368

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4224

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4800

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3504

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4496

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4624

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:832

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3764

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:828

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2772

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4592

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1880

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5140

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5368

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5664

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5872
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3860
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 c3c49812cdb403c74296c297709bab95043c04da7f82baf81c3505c28f2f27db
MD5 4b1d4cff50631929031e5574d68c751d
SHA1 b5c9ed081d398c7fc15cfaa1361f98a3da726b72
SHA512 ee090b1c5cc58af181cd5dd1d75a7df4f0bada6705882918e5f873e93455a1d277410520e2d1d15f32f6d07993eab94fd0f7154562a99fb62e9d49887ec45cbf
SSDEEP 49152:quYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5lw/3FPfUNDZ4:qPfTqi90bqfFPfUNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 781KB
SHA256 c207534b6848abbcf9d3e3b680a900c3b6daa04cb4a21a97aae46c23eea51ac7
MD5 612b53f126b28b1fda7f72578897e63f
SHA1 e9e9d82aa051ff9461b24fc0688af3a65921ed6a
SHA512 72c11dd876b3f080c7705d78bb190e4f9d3e9f8b7fda83e574eb7ce2788c1d90a00b42ca2474b1de0cb232ba99ddb5681f732830d1f49654ca817bb4549d123a
SSDEEP 24576:BPsJcuiH1SwPHU8X31PfU17DhZy0lxHZ9/I:BwcuBw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 165eb5ffd0412caf41cf9dc2625f00178af99122cc3e41d986f3711f0f8b41a2
MD5 e2bf5c3d9ad4219a078b0849a7194d96
SHA1 f69436b6b245c6fb48f020aa487a551915a0c02f
SHA512 9a82b2d0cbb462e787a904825ad352dc38064ec9875376f78943479a1a77f37650515f81a47a43429dfd26a1d24562309735c1fee7b6a0b4f96efe356f25aeed
SSDEEP 24576:h+gkEVfh4CoT1SwPHU8X31PfU17DhZy0lxHZ9/I:ogkExSCw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ec794929cc322b1a30912981169a94398d899ea31d8f7204b02024066f81ea52
MD5 c2c6dddd0b606482aa5029e3c74414a0
SHA1 a322759c144cbdfeff4cbf86bacd43329915d26a
SHA512 7157fcc40d82f97761217bca23bf4c83ff420e6bd83048bf09c741e435b6fc1ed8af57cd350f93435cdf92bce0dcc6709d584f59a229a9555766f6ff794f8c3a
SSDEEP 24576:wBpDRmi78gkPXlyo0Gxjrw1SwPHU8X31PfU17DhZy0lxHZ9/I:UNRmi78gkPX4o0GxjFw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9acf5c0fd541badd0a941f8df3235126336f6aafaf887f79813366090c00b33f
MD5 81874eba0e95f20b2e9ff589088559fb
SHA1 a235f21e98d45d905074a876f399abfa31400d96
SHA512 d73dc8c5c386d6b76c225670a3f849448a7273fd6746304725188040a50720168fec030c6ae756e64739f9aa75ed3424d9e134c5c7c177b3ebf50dce74904d9d
SSDEEP 24576:vLOS2oyPIXVT1SwPHU8X31PfU17DhZy0lxHZ9/I:J/y9w/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 cb4ad5affa8cd8c556a2715d0a98273a9b7f242f0b16c785e16a367584a98999
MD5 2b5416f9d003dbca693ae0f045ed14f2
SHA1 d3cfc0949a7f85eebb110015836c4333471e1222
SHA512 43f6c669b42f1f8d4810f401c23d5fa31dc9a018dd4f0ad3c9230ee4c8673d8be2ae46da7c626334833767a38cf1442f0cd645acd967f42408f9e66b88ed5e00
SSDEEP 12288:vfcJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:vfp1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 207dbd0f7ba583373902aebea7fa61d8c575a59b950617f3d2bbaed23dce6038
MD5 b469b0d88c40a1bcf71decdd945ac988
SHA1 1b5d23bf822958588e1e05bfc88b879646d77167
SHA512 a99cb827ab94ca39421c54f0ffb69f51cc06c9bf06e71cc80a711ecdf7ab866a2a2b7d4fca560523677c31741106c6f21cf4a1f958439b928c7e9ed51f084ed7
SSDEEP 24576:/JIUW1SwPHU8X31PfU17DhZy0lxHZ9/I:/JIUzw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 630922a96dbf36232f11b9dd1cc34120eb4f16f99b0d0009ac99893d03a4830e
MD5 43594b37f4870cfc8f8f302c9398a0a3
SHA1 ae1da76d8a4861bb24c52062b0a04c307bfb8ab2
SHA512 b7529ab647c9b6b6538bb198f1268a9caea17c9c7ac79fa3168001538fa452ef7f9eda77f624549e085f7dab6922a036ee7d444ba4b0f30ad5f225ee60524193
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH2:OQvGAdlCEL8c/yRNw5C3fFPfUNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 7aa42735d9561423e454721f00dd79ae57d48e372e364ef857fc04edf0845dc7
MD5 7cfaef8f394337863777d89d08af73bd
SHA1 a4a9c41edf543c4b06594e47dff5a49aad4c3ba4
SHA512 82bc8efe02881d0b73b6d8a5c908a78c2606ed2b99510ad753b91c661773138dd8cfab248382b0247c1e31d198446e8ae8b269609e5b33f751e819c9ab6d13ef
SSDEEP 24576:VdewsAjY1SwPHU8X31PfU17DhZy0lxHZ9/I:bljBw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f7733da82c1267c6da9d0735ae4f06dc827d95f99c636c5ccf78a321b31e37b6
MD5 550c873ce8cdaed3e8ab044424003796
SHA1 9a6fd3cb33b05e98298dbcd0128f51ee90a812d4
SHA512 7e2de21f2a1bea8586c847d15d1a285b163bb6a89ee5c496974045d05b80fce9d6e7455bbe787750b28601d8e44c4af14784e68950fb2316ba74caba0e28274a
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHEnU:CUEtQevvqc2W1cpV2EI32uU
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3cc2abe2b5dcbb696a38e456ee5069d18e5790838c24ff312f7c7956809cabf1
MD5 67c51beb2bb21228d211629213cb245e
SHA1 20dfb99d811e53e2e7512e5b7fce7953cf77728d
SHA512 fef2c28861b2096b90b7e9f0174cf77609036a8fcb1659eb675ccb137c7c2aa9048a1eea762e8e9d7ab4daeef34ec2b9718c6081142288898f5e8ce6e19dd9fe
SSDEEP 49152:MCbRquA/m2yL5zTfFiV+XenmE3/zhw/3FPfUNDZ4:loquVjnmjfFPfUNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 00703a37c0e3a33e17885f240b353d5f376864b6610999482b0dce4355c2c09e
MD5 1ae45258a2a48e21c583352127cf850e
SHA1 dbdcc10940b40a5c58a1383d3a227d1217fd3346
SHA512 9633d5f67b128573dcf57cafc49ffdfb10a7055ba0497ad2f052e8dd777b3d75c9c4b731dd9b8a0552db32f51014abe427b216d890aa5475a86fb0a3f83246c2
SSDEEP 24576:sAhGLJIFoiwtA5l7S53D1SwPHU8X31PfU17DhZy0lxHZ9/IQ:sAMyFoiq54w/3FPfUNDZ4Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 77366cbf0f36a4b3bdc31d555ed8b2f8cd6971d745dd8354c7d09b8bdcb73a4a
MD5 faf453c5dac38e91282787ab162db0a3
SHA1 157df18346af696cae3a9bfd5d68543f6c3fbb5f
SHA512 ecd493aab872b30657968a632c2b31647e7a3224713ea7af60f1aa924f1472d563de64717a2db9a5ab4c45273de05bcac7451a33e131da8673e885eb4fd0879f
SSDEEP 24576:awuoOWc1SwPHU8X31PfU17DhZy0lxHZ9/I:awDOkw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 56b3c008732c7d88475daf6d30d519377d4e5f03ba807cc50ae7b0ea2ed0452b
MD5 f61d46846848ad5d6855d3e490be6b62
SHA1 67e31baa8605cea93980b2e003318a7489540954
SHA512 6cf6ef5214a73b21ec33685a16d06bd9aadd575f2209b469692924efc0b8acbaaac1631db8ca8c41450a7d45b2448fd0d1b471094ce1e31a7b247d90d8d8810d
SSDEEP 12288:1BZ1IyLJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:jZuF1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Size 4.8MB
SHA256 722f4bf5a4a30208b417237b1ac5e600d22e6aff08cab16bb2bc6bdb5d576e2d
MD5 3b0cf0bed8b080afd5bbb76ff6dacb82
SHA1 44f6f084173f4cbeed7f9b9ad3cd05ad1136e529
SHA512 3de902bcc994a5686523525648ae74db38ad4c8312886ddce0ad26d511a601e88d95ac371ab806b0e4874b40ea6ecaeec8798eb17e58a5a859213ed601549b4a
SSDEEP 49152:Yj8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbDfiIerM1R6ZPz:TrZ4K5M+XDfiIewG+x6xZ14UfFPfUNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 5fe5f3aa824705568957991bea2ff9312459f8e7f15f3fe931bc2e67a608a4a7
MD5 a0e9976ba2d6454a5ffb489da0dbfc65
SHA1 3230ad36a8b08bd0cd3bc91ffec15d7865f23f4f
SHA512 f6a64831c99cc891e468aec7f54a2b899bb6ab2db06951d45611ec55f3967a8344879e41c03446025342269cbc9466a90272a41ddc14e1d36a1d2e64092acbee
SSDEEP 49152:0fzabJ8llj+SWWi2mkx+X+diIw/3FPfUNDZ4:Vui24fFPfUNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 f2df759f9c8b2f9323f77707528eab0ce17a3d0ecff72ea7e9debf6c023f7c06
MD5 89dbfed148ad2f3891a5dc3481f90dcd
SHA1 ae2b36634c2400d897b8d48893c964eba12ca217
SHA512 6d26386e2cf5de5fee209c84e8c423d1d0ead1f35f072a656cf9db8bb11f7ec08a57acea5a3eae15f34c6ffa4297d99d528771a69d158b8ecdd176e23f5b3789
SSDEEP 49152:2a/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4TLw/3FPfUNDZ4:4Z4K5MJabfsYN/fFPfUNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Size 1.8MB
SHA256 eae189b5a0625f3e05978a5726eb00b87fbd3e70aaca6f276d6c10ff77141dbb
MD5 f0c9f6687665d5d90adf606f9f6811ce
SHA1 42904dd99a1f36ddfedf1aeb645ff68477758e48
SHA512 291183d785ad9e517ed85b146ec8778d50ef52de084dc294d0aba68741f4dec8d4ea2aa0e3acce7f1c940be96dfc4ae871c6510ab60014e4c435b14f8b8983d1
SSDEEP 24576:5gNJw85yUKzDu/9gKPlfLO8C49BgKK1SwPHU8X31PfU17DhZy0lxHZ9/I:5gNJtUzDu/9gKPxHC4tw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

8165a899-0626-453e-98b2-3a816ea7f24d.tmp

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\8165a899-0626-453e-98b2-3a816ea7f24d.tmp
Size 488B
SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
MD5 6d971ce11af4a6a93a4311841da1a178
SHA1 cbfdbc9b184f340cbad764abc4d8a31b9c250176
SHA512 c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f
MD5 SHA1 SHA512

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.5MB
SHA256 c9763f8ea837a2f8161f745b2a6f85a67b007704f694c2cba8dbcccd6f28cbef
MD5 ca58aa8a3341176bedc5bf15a80354e1
SHA1 ed087442edf107d553d2aeab2d809987ef788472
SHA512 dae1362d9137eff4688ae8354776c98446c28f02aa0e4fbdf1d5f279179c3d1ef4346a40e222d06a4c3c73b403120c4b4643fcf49215e6a06fb03fd871ebcdf9
SSDEEP 49152:oOBynH1wM+v6UJxLQd7BHjdfDw/3FPfUNDZ4d:Mn4LQd7LUfFPfUNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 92d45c9fdd03a98ac030597ecca7b9bf5ed764a51058e3ac29bd96ba011b3bff
MD5 81f5af94233dcd37b450705cdec0fff4
SHA1 41b22d60767a2caccd1ff8ca55d5ed039838fae7
SHA512 5bac4cc8e0e05718f43663c49e267c5c4b1ee7fdca2a9b816c8b71e73b150be4e70384f057c7e61cc9d80d040b6d43674082b3884efe1dc7c93873685dbb6b90
SSDEEP 24576:pcP4mcvIjkGOxhKP2l71SNKbrh/8KB91SwPHU8X31PfU17DhZy0lxHZ9/I:eP4m4IpOO67N8KMw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 696KB
SHA256 60018c5fea9a5c184d7ddfcecfdc652d253d5d9e45ee19cc750273ecdd2dda64
MD5 36d4f9d1d520f17d55b914ec045fd57a
SHA1 3e62c5575c9d78ad068a307bc43f1a26eb52824f
SHA512 185989df98d7985e502ea68a052b6e4d22fd15323689ff756b04a79c0dd0032fec472b3d541445673845fc8a41de9b7820288046f8e6c1bf5f31ce6c00795b52
SSDEEP 12288:iFYq0SjJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:igSg1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 ce57ea98de4e5bc14ef94248254970c775ec2c2e1105acf460333f725b3366f3
MD5 1a7cdcf21794595155d9daf1ec65d8da
SHA1 40352477e8e67dcd08926c4d5904886a59ca052d
SHA512 3e1c27fc5dd19282fbaec773dd87077fe1749a450b2ee15bf001548751cc6293025e3454482706126131febb642021ae655350bbe8d43c5cd057b73708241895
MD5 SHA1 SHA512

Submit Download

4079ed42-9648-4f56-b52f-9c5bbfe8aacc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4079ed42-9648-4f56-b52f-9c5bbfe8aacc.tmp
Size 193KB
SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
MD5 ef36a84ad2bc23f79d171c604b56de29
SHA1 38d6569cd30d096140e752db5d98d53cf304a8fc
SHA512 dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be
SSDEEP 3072:HXm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4g2rJBXCy9enoN:HXUMCm4U6q62MEBi99g6JVCvoZhhl+No
MD5 SHA1 SHA512 SSDEEP

Submit Download

8a84d0c6-684e-4e2a-be93-b4e3691e11cd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8a84d0c6-684e-4e2a-be93-b4e3691e11cd.tmp
Size 4KB
SHA256 84a7af4cb30a4c0a245f1595f94eb9aad83e384bb26a56d1976d50095f47e079
MD5 5bcd790c4727c70a3a35cd2b70900298
SHA1 3f57a71250b29c73fdf9ff643177d4ba2e1abac9
SHA512 ebe513dffca74b649846ea771f3cdcc387d97d7debe0dd48d5ea6e2bc409826605c36a97cb6c0e1bb128e3e5534f33c0440d2c17c14ba06c4020cf23fe1aec5f
SSDEEP 96:gJgIXpEPChC8iZRy7Di+6MsmdeeUObU+jVlVup:gaIZE/8syy+Fda+jS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 945B
SHA256 658eaae4fa98854691c51446090aaecfa647af31abd17b44f32c218ad2a91c16
MD5 3b3b4197fff80f33c6c4a2c60d55c275
SHA1 d6bd1acc31a63f2c05f256029a1284429b5a54c9
SHA512 9b21b57bd95441a019db3c0f4bf9ca85588eff11882260b924320d57fe1a7edfdfbc94e8989bc8bd2acefca28275e314b8f06ed8876e517af7c24ad22c6252bd
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 371B
SHA256 fdf4e35695d0a4db9fcbbe7b35b1e6c2c8a8bdd9b271cf0b7cf9d4a007f57cd6
MD5 1928ab0d0ffeda45044382248e18e37f
SHA1 46579c603d6bb5a293126c77d904652dadc291fe
SHA512 d002946af216cf7fbcff299a8c86c0408f0972343ea5981dc79aca9bdc0173627b369ab26cbb21d740ca435ba3d3d46cf9303c5e1de72b6d399eccd3162e3980
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 e4d24f79f635acc065e9937aef66e1bef3ad5ccf65c33f7b473dc31d9cea5dc5
MD5 60cfdd62ca57ad40a135bcc2870b085a
SHA1 5de2446f89d8f0991ed336261c3f522bee0cbe02
SHA512 acf2a500aefe1702539718ea74e41c0703a2a1a1b783a7462f7de825857a99b5b37d8894482089bc306709c1ddcdc12cc322843092fad9d024f0cff234810e10
SSDEEP 96:gJgIXpEPChC8iZRy7Di+6MsmdeeaObU+jVlVup:gaIZE/8syy+FdM+jS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 4KB
SHA256 a6f6c84ff78f352e22ec458abde8959863be1419b103bd095a8ef60589770792
MD5 2f6be70d7df4d75f5822b83747c508d8
SHA1 8cebc76634a41a67025ceb08402ec4ff3bc81565
SHA512 edafb08e7ed5660f04fddc455e29cb48e53fa6def8a483d85c0694f2fd01fed206371a4294cf7b908385fccf87fb68ea93f1050a2b3f0d5df647c6139972a72a
SSDEEP 96:gJgIXpEPChC8iZRy7Di+6MsmdeerBObU+jVlVup:gaIZE/8syy+Fdr5+jS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe576486.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe576486.TMP
Size 2KB
SHA256 5cce19535dbda5de3a87b5853ef092e281c10b1ac94a8103adeedbebb269de8f
MD5 f17dd383c8676e8278df4555e1f52807
SHA1 c05d24e34597ab70955806f2cc8333fc8268f6b8
SHA512 a6bca5bffcdef4b078f4807da14acf8dbb286fe1d71e591f59c7cdea0eec5ff7f4ed9eda8a55127e1e8e12c990f74b08e243fdff9796b525965a5c6e3328f116
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 2d311b316f63c5a078ff1edbca6dc432bd7d5ec7d8ef0965af6a821c8060aa22
MD5 682815c6b608d9f8c339c0c94d9db023
SHA1 90554cef5731e8d6224e9a9c803641f31a3e5d04
SHA512 054a0c5f7271e377ddacb54df7690a609de2dcad6bfe9a0760ccec87fc3168276035834082981885c000d60d81f5b48f44f153765d897d8e7ec4d860bd0606a9
SSDEEP 384:NKLPLe8Xt1kXqKf/pUZNCgVLH2HfkgrUpHGVa0AFW:8LPL1t1kXqKf/pUZNCgVLH2HfHrUNGV9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 260KB
SHA256 a41d1091c731cf40198cca27d6432df544b483fbd9db39993ed60f8ca4d218be
MD5 28ded0831d8c36fb3425bffc3e0bc9bd
SHA1 c8b3a83c92382351fb2de70ab971b877c4bec4f1
SHA512 05321a43421f13773d1d2a942e91b30c4996fb3d3767619c2c9114771f170a254973ad6965e14cb118bbab65d8bb58eee2a151d70d1e9951fc459345bcf287a2
SSDEEP 6144:Umk8BePlHpgfw4iyhfBASNdvXCNpbMHtCMpSG:C8BklSC+ASNdpHtXr
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 7KB
SHA256 5e91a787298223247081cc276545454b240412f7d5cea1664310a4e149dd6cff
MD5 1ae124f5bb84bb9f6c434a897cc5068d
SHA1 37d76b3b157dbba14526ea3caea3308531900d52
SHA512 b87a83f986ca51230cd43ca4bd3d96f698960b12766136c57981af2a7ccbf88eb37afe1987fd39a75f402e15959ded646001ff81cc712818597c31869dd6496c
SSDEEP 96:Maf5QYtnECT4hxK3oK3SdkqtgrGxK2tK2qoO6sNA:35TWVZtga3dsNA
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 8KB
SHA256 92b2c41aa26bd4c231f58eab1b2d0b355ff56331df5b755a980f55ff93308269
MD5 20b69ce7fe22c8e26e6867296c6bd823
SHA1 c038f0ea0ab6440f5a7724832fa2e1773e39942a
SHA512 655b2e91866349535580ea8eeba463bf80a554421e25427bae82cbb3f58fb2002f2a22f914bdaaa7dc9b28ec15dd015737e7437045f25ff9d74dc93247693980
SSDEEP 96:Maf5QYtnECT4hxK3oK3SdkqtgrGxK2tK2qoO6sNICtw7GxK3zK3ce:35TWVZtga3dsNhwie3e
MD5 SHA1 SHA512 SSDEEP

Submit Download

45bd6d7546f975ab.bin

Path C:\Users\Admin\AppData\Roaming\45bd6d7546f975ab.bin
Size 12KB
SHA256 2fe24d0da82fd324d797d777cd43739ca0e4c4b1056fe2f9078303b5bd311054
MD5 8c28bdd732200c1a50777c27876d5928
SHA1 fb0b9aa963dfe52eacd8512649197e6384c2d7ee
SHA512 d089b3fd25ce02bc2c18958ec13e573ce23cb0471855ab3e5ab0ed82894aea9507dddb3b43c1c9f8a27c41eafa1a5622b0a676aa23c56cb079b5ce1b231df9d5
SSDEEP 192:q8MYdS7m+rgXpz22gE2MloELx2mlPmmaXwDDXm311jbuwQ5rjcCy0d7fjb7OwEzm:/Sy+cl372mtpmkI1QT53cOpb7KPSb2s
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 9ca7dbe45122362e2ae8bcb06ade1db093d6b2803fd71b59714a7f0077894c28
MD5 20db431b923c16a0db344f6d5eaf0926
SHA1 1c14eded52539ae9d9f7c426b8a7356a5b5212c2
SHA512 fd9a32e069f8fb5aa47a050487b3f92456df10beb5280224c1dde0ebcb9bcf8192bf69505b7117f7fd5265dc551499656b8b96c094f0ec558c256410402a5cdc
SSDEEP 12288:GwJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:Gl1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ba962922f6e4cb2ccff0896f0d9485892df006f306e6f0e3449d8421ceb033cf
MD5 f0b88ec10b4dfa6a0675042517e70a02
SHA1 13ffc508fff39a4109a13e719ea955b4cb2f45e3
SHA512 591fe33ca6fd2968f936e438dca8f5e46bec6d5973ea02e04ea72f0b830ef78a79b300f82120303801457fd98c3165c883900840ca1a8b5fb7a95b1bef087cbc
SSDEEP 49152:La0h2GEkuAe73q3pp46zwwQAw/3FPfUNDZ4:La0hNYG4JwifFPfUNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 c599b8fe5e88d3552fb9b4fd0f0a60afd4deaa0b4fe8ccbc147ee6f718c069a1
MD5 d0b59ad5d5071a11ec21cf71f069bd09
SHA1 525015d91513285b61843992ce9547b74ff5ffdb
SHA512 2dce51c0732f504ce2cbf6c16317011f955facbb16acb3923c82922b5c8e0bcf4972ff805e7d984f655f7d58ca91e4711e3e1261a163e56c01a6fb6b688ad370
SSDEEP 12288:mhbHjfXfJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:mhbHjPU1SwPHU8X31PfU17DhZy0lxHZK
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 1ed262209aa4d32ee0b97c881a7394be327e824aebb54fb327d6e11e7744efe0
MD5 05715685f0a9198d2d64267668aabd2b
SHA1 466c8ce2ad437a2df9a4239a4a3960928b2f4418
SHA512 5c992f166bed23e17e990e9628b72293981648189172061afcea931a50b5b4cc30db52051252f4f2b4f7d49a518efeb7dc990fa2dc7ae595e2fab6fe3c5072e7
SSDEEP 24576:c3YgnJcRTk4yti+R5dpR/c1SwPHU8X31PfU17DhZy0lxHZ9/I:cIgnaTk46ppR/9w/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 148bdc181401cca14d4c2ee93780b437004c5a9c680f86075e2ca76db46df3f3
MD5 e8f3b8b62d4bbf00ad00efacea156752
SHA1 fbb468afd1fee7726cf189e39e24a68b96b80f15
SHA512 d77e68e0520840c9768c6a4a926f021676e597816e5773ef92d3bbf8ab78246c1aabe151fee4f84bc41f8b9b0c5d4383e9f41b756f08c8abdcd458e166222803
SSDEEP 12288:48JKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:4J1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 a29429f88d9498670dc700f1d6ac86b5685c8b1d4c778ee7ebd1ba6d8448edf2
MD5 0dc505dd874c6c64ae8f8f0ff760e134
SHA1 24175ad3db4ffe832162849e3c86037dcc948dca
SHA512 56315e91d6a9e55c0fc485c603b9e9a07114ec69fb1bab37cd3db90d619d81c571630f454769eeb7dea86c895b6ff5cdad3ee124227a51916bd07f53fe1242e5
SSDEEP 24576:ypL3UTy1SwPHU8X31PfU17DhZy0lxHZ9/I:ypL3Uzw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 7eef96b3a3662b45f446e00c393602815b6db5386d07406084cd3ffaafa1f953
MD5 4dc7bed7e517ea92761f3ef849bf82a5
SHA1 3f5619d8507798e4fa5a43d74693a70980434009
SHA512 45cd43dafcd3b9a27e2c8091d34e1c889560fea5f6ba747de1143bc106ae9f5268b60cb36bd153d4409be9fd1e83570bb01714c4892f8af8cc2c19601178bef9
SSDEEP 12288:7pFtpOZJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:HO21SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b1ff6b233a6ab4eab50d9616e3b10ecc25555436e371d6f873a9613c2173e9e4
MD5 6835d22d9ef9f48aee4c295af5a826e4
SHA1 51db87768e2756976595a6345c26e88fa2c0d2a6
SHA512 a5a13b9b933726673df9b277d6e51713bad46f186d3d461b611e0df50e11b68a696b35f8594daf4f9908ed8ba06f34c2f81ee30693618a5475dfb0feef2800da
SSDEEP 24576:Z7NM9YmZqmWMUkPjZM48Mv6bEhsV1SwPHU8X31PfU17DhZy0lxHZ9/I:Z7cBWMpPjN8DbEhFw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 9a84ea020a4acce3e3d82f2f6c48eb295732379cef7a5919824fc5beb4ab831f
MD5 f3a1a471508bbbb66edf9bb52893b7db
SHA1 2c6a4f3635bf37eff832af6b1f47b4749660142d
SHA512 bf84678a55f8fd40f7cfd1bc824ab97aae6f059ad0f0cff1792186eae1c048f84d8a1c93458fce873f53be7908857a3fc9cd125ee1b1fc3d7bc214989c3b86e8
SSDEEP 24576:4W6BApg2YuyuNDYTabvcRvNYf8km131SwPHU8X31PfU17DhZy0lxHZ9/I:4F2YuHNETovcvNYf8kmmw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 541ad368f2221ef45b45635ce652316bacd00dfd0f51dbaf2173cb5f0b85ef03
MD5 e62ccdc4dbc331097385bf172350e776
SHA1 9d0a78abefd218ddbbc66a801c85f4339c419ea0
SHA512 ea9743a7927828949f25b64a70324f1232e7cbc04ccd28c6605ec1b5dd8396ab5318228ab6cfb39ab2801d2eddb076bbe28ca481c34bfd0780af980d4d93fd8c
SSDEEP 24576:IAFs06+Omlf3NXEbToK1SwPHU8X31PfU17DhZy0lxHZ9/I:NFs060lVXugw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 785b748ae991e4ddc483b0a31ff6bc6b28de123706d54f32a30196015c533ac2
MD5 c1379d4452d6a91e7f0d46fe49fbd9f7
SHA1 7154976d79a50a120bf3fc722c1309544c50ffb9
SHA512 40f842978c6bd523989f7167710269a12d77b59c2ddb9ffb04d8a41abf1ca850c121d1a00f9abe5910dcb42208ad74481649fb4db1b954e0ac83c92d2f401395
SSDEEP 24576:rJnJ5D3WtL1SwPHU8X31PfU17DhZy0lxHZ9/I:rJnJ5DGtgw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d4f2409a9b3f968f919d0bb0261134d63d249caaed56cb27e0d5f112d671a75d
MD5 104da8e0b4a763c68fa1c4ebcd3ca162
SHA1 dcb213f2069b3404794843c0789d5192cddcdc17
SHA512 e02ce49837ee49520e075a83828412d73062af968b912e2848b45c8d3d9755f350c79cb0d7bb6b0b60943284266577192800ad3099785c32c6a40abb11a43ab5
SSDEEP 49152:Bo06DIKdwc+eQnSt65aVqw/3FPfUNDZ4:W/fFPfUNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 db5c11d7eb8b3ba7acd7268a7306a8bb658d7dbdb47edb23899d77446465164f
MD5 38eec688d990bfdc98f3edcca7e2d26e
SHA1 7b3d0aaa5ddc7190a8c7f35c3d5029cb2d639815
SHA512 e3003be0a94ee215a8e6fdb4c46219072b1b34dc1c084829b83dcb564c0223dcc6f5c45e1d1e9b49be452dc9721685cfef57604cbd2398cad9d32bc89c47c9f0
SSDEEP 12288:EEP3Rr2fJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:/r2U1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 2b6c09d65a77fd1ce06b71057a143d9ff7bf64b3cce869ea9030ebff0499277e
MD5 439a554552b1420fd7ca642e4c86b8a1
SHA1 2a35901d537c42bc00afcd94aa8547d58ffb4b6f
SHA512 be1d472c7a3a0d3fab155e5df3701c6ea163b72653a6b3906163c369084b63a8c6548117abb53518c33518d4ab5d207eeb3e868ac72edd18929b4a5f1210efca
SSDEEP 12288:bjkyvJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:bIyk1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 ffe79bf3a4d49f0a68035389d2048f51837c50eee59e5f466b87b64d87932bc2
MD5 ca2a9dad3095588dd68bcd094e08f4a7
SHA1 84e8b80383cc1f06e2cbae6860c616d45299e0f5
SHA512 1c95329d5e31e6623cbc6a67d501cfea3996387673f8194f1faed0834e0d233453afe952dc18549b6bec9e2625774f28e95b70aba871d8657db802a67b964bfd
SSDEEP 12288:RFpJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:XG1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 813e0768c7d7c68a64d165dde1062e05af3de41e21d5fcc27296d466b74b92bd
MD5 f7318c1dae4a830e366ce99e2d7b8449
SHA1 5209a9d2e652a181d7b04b3a6ba880c5dd420455
SHA512 22ba4b71440af4111e2c821cf68bc97d87c2fc91624fd85fb1857a34752bfc33d40b0d61418c7e5c1d09bb60a478622e3a911f1fa87a507c5d4104f9e3983bd9
SSDEEP 24576:+Q9MxZKdcz97w3t1SwPHU8X31PfU17DhZy0lxHZ9/I:+VKXuw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 c02c9cd67fb8a3d2812c35199d35aa7edf13d0ae45f5f11212532947e81b5cb1
MD5 dea7313bd8dc8f60150a1442f5388c58
SHA1 a5a677339e984ec159f53aa34a0cbf27276df541
SHA512 d7b47792f12a12ed1337c4d733f25c56c44e99fbbea92bbc18fda17856c2e2516cf9b66f33da5de8abbeff25ac828fcf64d931703bb0ffb799eb1f2ea912c78f
SSDEEP 24576:kyocxApY1SwPHU8X31PfU17DhZy0lxHZ9/I:ZocxApBw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 bd0af1274a0abd1747e40993ff2d86f2cb8b8423faed6d511c7899077b43ab62
MD5 a4107641ae9514a3b0ac8b1ced6b9b2d
SHA1 31c2a5c9b7a5bd4a59ca0a28367485d7f87bd0ca
SHA512 ade7c93325301c77a3faf5f7bd60e3a964d93bec4367e4e19ce5ec4e0772b77a7146b7d2fb1b55c42c9c7c2321e40552f04b7271ead0c52d9614656e2cd31363
SSDEEP 49152:fWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKBw/3FPfUNDZ4:H0zuNImfFPfUNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Windows\TEMP\Crashpad\settings.dat
Size 40B
SHA256 003bb916b42cd772096ff0306a9ae0c724b6d41fd3a7f1f30508e651973068be
MD5 93639f5ec6435bab142797333d625b68
SHA1 f1e8d9462ccde482a58fcdf0825ad2f234d84168
SHA512 e7ff808ada00309e48c2b5921ee0d0ce5a1c608889c34352e831633a9913879a236ef20a640949a470c652f96b8ab4a9765c45cd14fbb9da346e4c3af68748b3
MD5 SHA1 SHA512

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 aa8447a98e62eb87492b3aac5bae827dc96f2b658353c2b0a27e4adf998d0066
MD5 6efded3a07e9a31131c56cae66fb8035
SHA1 7ecac5d358e69975f0480131ec0bbf87a1157895
SHA512 32f256119ce28eed09c758e26592f0ba29c1c8a3a0e17659b528817be8ba2a51edc15a654e9656acf6e9cc26a9c70abf62c5048da66bac2e16557d2638b5e862
SSDEEP 24576:N1QT7EcpfxR+N5AWAz3ooiYtjMqbv1SwPHU8X31PfU17DhZy0lxHZ9/I:4TDxR+N5YzTfjMzw/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 6a1f1796da6368d4165204251d4d570e18a6161cc8d660cffce6b4cd2e2346d7
MD5 dafe6e1a117fc5448c8fedfc17ad27cb
SHA1 8552d232015e0c15780ebc3ac2237ad1fa5f2ee6
SHA512 6cecff72251e0bd919da081f2ce19c0b0397e5905b4bbf4aff602c8e9dc8f2ade96ee264d26fd95e61ee6e4a827991e636d12d55442aff3a4269e1d3bfb02a94
SSDEEP 24576:tTMdOz0FFS+imSLj1SwPHU8X31PfU17DhZy0lxHZ9/I:X0K+imSLow/3FPfUNDZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 3c658d90f827a69978ac34cdb3ab130286991c2076c47e6aae12972acc008c8b
MD5 c12cb0e77bcde93e686c6c61a5a79188
SHA1 cb8546dd3a7e6447894a672b70fbad1090bf56d0
SHA512 7f1dfc0d1e4e5d893f5e3e42c169ae0d8255f7c76d7e6809d4dd0bf47850b63589c114c22d98f01a7bff79c37d8349012712039cf725cd62bb18a57a058dc88d
SSDEEP 12288:Z479JKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:sy1SwPHU8X31PfU17DhZy0lxHZ9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 fb3111ad755707e51b2586500b837e41897f3b1efdbe3eb9dd0c35210dd391de
MD5 7d02315cfa405a58c5d835a7e79df348
SHA1 37eb78d3a840dd2debfdd5c4ccd3feadbd722092
SHA512 e40744eec3380418c5f9c12481cd939d57ad5cf1b23e3828b3bad68c951ba7471b312edeb50d9d49efb219e025a835ab318dbed2f60579c276411766a7c4de59
SSDEEP 98304:G7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGL/QmvD/cTwY2h3FWfFPfUNF:gM7pTXexZPGzURnBh6gGLF+W3inU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/828-214-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/828-224-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/828-286-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/832-188-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/832-255-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/832-199-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/856-0-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/856-38-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/856-7-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/856-2-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/856-31-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/1164-56-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/1164-63-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/1164-66-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/1164-55-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1164-69-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1348-50-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1348-44-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1348-129-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1348-43-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1372-228-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1372-299-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1372-239-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/1880-273-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1880-282-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1880-557-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2316-12-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/2316-22-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2316-99-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/2316-11-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2568-258-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2568-270-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2568-269-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2568-265-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3368-113-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/3368-130-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3368-127-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/3368-121-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3368-114-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3504-160-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3504-168-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/3504-221-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3576-97-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3576-102-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3576-108-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3576-171-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3764-272-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3764-202-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3764-211-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4224-196-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4224-132-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4224-140-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4496-237-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4496-172-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4508-77-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4508-104-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/4508-100-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4508-78-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4508-71-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/4508-70-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4592-251-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/4592-325-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4592-243-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4624-249-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/4624-183-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/4624-175-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4624-241-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4728-29-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/4728-19-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/4728-17-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4728-109-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4800-157-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/4800-144-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4800-209-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5140-295-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5140-288-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5368-301-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5368-319-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5664-327-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/5664-337-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/5872-353-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5872-360-0x00000000006B0000-0x0000000000710000-memory.dmp

Download