3a4740c0dd18905805c465b3d9bab8e8722716bb4e05aa6ef5098ccbfc9887f4

Analysis

max time kernel
156s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2024, 20:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
Size 5.5MB
Sample240403-yrehbsbf27
SHA256 3a4740c0dd18905805c465b3d9bab8e8722716bb4e05aa6ef5098ccbfc9887f4
MD5 560d35368a33cbb05b703b93148718b1
SHA1 cb790b54bddc7ad6bd960bdb62e1637b96312384
SHA512 9aa4725a951b1881552e7527e7f3c681c1e3f670d2edc29c9992ac39cf4fd2b65c24b678b29570071432b077f90a7d6473bca45e3ed6f4fa9462c3b0ba080a85
SSDEEP 49152:5EFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1Ln9tJEUxDG0BYYrLA50IHLGfd:tAI5pAdVJn9tbnR1VgBVm2qj2FAQL
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
824	alg.exe
2492	DiagnosticsHub.StandardCollector.Service.exe
2932	fxssvc.exe
1696	elevation_service.exe
4380	elevation_service.exe
396	maintenanceservice.exe
2932	msdtc.exe
3920	OSE.EXE
5244	PerceptionSimulationService.exe
5376	perfhost.exe
5564	locator.exe
5816	SensorDataService.exe
6024	snmptrap.exe
2956	spectrum.exe
5496	ssh-agent.exe
5776	TieringEngineService.exe
5932	AgentService.exe
6080	vds.exe
4404	vssvc.exe
5672	wbengine.exe
6056	WmiApSrv.exe
6048	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8b7d94ab8642d83.bin	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120515\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120515\javaw.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120515\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005d90afb90186da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006070e0c10186da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000563fedc00186da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000513061c20186da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005d6632c10186da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000003c4f9c20186da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a1705c10186da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cab7e3c00186da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb7907c10186da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
3896	chrome.exe
3896	chrome.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
4604	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
6044	chrome.exe
6044	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2808	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
Token: SeAuditPrivilege	2932	fxssvc.exe
Token: SeShutdownPrivilege	3896	chrome.exe
Token: SeCreatePagefilePrivilege	3896	chrome.exe
Token: SeShutdownPrivilege	3896	chrome.exe
Token: SeCreatePagefilePrivilege	3896	chrome.exe
Token: SeShutdownPrivilege	3896	chrome.exe
Token: SeCreatePagefilePrivilege	3896	chrome.exe
Token: SeShutdownPrivilege	3896	chrome.exe
Token: SeCreatePagefilePrivilege	3896	chrome.exe
Token: SeShutdownPrivilege	3896	chrome.exe
Token: SeCreatePagefilePrivilege	3896	chrome.exe
Token: SeShutdownPrivilege	3896	chrome.exe
Token: SeCreatePagefilePrivilege	3896	chrome.exe
Token: SeRestorePrivilege	5776	TieringEngineService.exe
Token: SeManageVolumePrivilege	5776	TieringEngineService.exe
Token: SeShutdownPrivilege	3896	chrome.exe
Token: SeCreatePagefilePrivilege	3896	chrome.exe
Token: SeAssignPrimaryTokenPrivilege	5932	AgentService.exe
Token: SeShutdownPrivilege	3896	chrome.exe
Token: SeCreatePagefilePrivilege	3896	chrome.exe
Token: SeBackupPrivilege	4404	vssvc.exe
Token: SeRestorePrivilege	4404	vssvc.exe
Token: SeAuditPrivilege	4404	vssvc.exe
Token: SeBackupPrivilege	5672	wbengine.exe
Token: SeRestorePrivilege	5672	wbengine.exe
Token: SeSecurityPrivilege	5672	wbengine.exe
Token: SeShutdownPrivilege	3896	chrome.exe
Token: SeCreatePagefilePrivilege	3896	chrome.exe
Token: 33	6048	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6048	SearchIndexer.exe
Token: SeShutdownPrivilege	3896	chrome.exe
Token: SeCreatePagefilePrivilege	3896	chrome.exe
Token: SeShutdownPrivilege	3896	chrome.exe
Token: SeCreatePagefilePrivilege	3896	chrome.exe
Token: SeShutdownPrivilege	3896	chrome.exe
Token: SeCreatePagefilePrivilege	3896	chrome.exe
Token: SeShutdownPrivilege	3896	chrome.exe
Token: SeCreatePagefilePrivilege	3896	chrome.exe
Token: SeShutdownPrivilege	3896	chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 4604	2808	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe	91
PID 2808 wrote to memory of 4604	2808	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe	91
PID 2808 wrote to memory of 3896	2808	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe	93
PID 2808 wrote to memory of 3896	2808	2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe	93
PID 3896 wrote to memory of 2084	3896	chrome.exe	94
PID 3896 wrote to memory of 2084	3896	chrome.exe	94
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1636	3896	chrome.exe	100
PID 3896 wrote to memory of 1432	3896	chrome.exe	102
PID 3896 wrote to memory of 1432	3896	chrome.exe	102
PID 3896 wrote to memory of 3352	3896	chrome.exe	103
PID 3896 wrote to memory of 3352	3896	chrome.exe	103
PID 3896 wrote to memory of 3352	3896	chrome.exe	103
PID 3896 wrote to memory of 3352	3896	chrome.exe	103
PID 3896 wrote to memory of 3352	3896	chrome.exe	103
PID 3896 wrote to memory of 3352	3896	chrome.exe	103
PID 3896 wrote to memory of 3352	3896	chrome.exe	103
PID 3896 wrote to memory of 3352	3896	chrome.exe	103
PID 3896 wrote to memory of 3352	3896	chrome.exe	103
PID 3896 wrote to memory of 3352	3896	chrome.exe	103
PID 3896 wrote to memory of 3352	3896	chrome.exe	103
PID 3896 wrote to memory of 3352	3896	chrome.exe	103
PID 3896 wrote to memory of 3352	3896	chrome.exe	103
PID 3896 wrote to memory of 3352	3896	chrome.exe	103
PID 3896 wrote to memory of 3352	3896	chrome.exe	103
PID 3896 wrote to memory of 3352	3896	chrome.exe	103
PID 3896 wrote to memory of 3352	3896	chrome.exe	103
PID 3896 wrote to memory of 3352	3896	chrome.exe	103

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Users\Admin\AppData\Local\Temp\2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-04-03_560d35368a33cbb05b703b93148718b1_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2e4,0x2e8,0x2f4,0x2f0,0x2f8,0x140462458,0x140462468,0x140462478
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8591c9758,0x7ff8591c9768,0x7ff8591c9778
    3⤵
    PID:2084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1916,i,483062885077648614,4939903384511802479,131072 /prefetch:2
    3⤵
    PID:1636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1916,i,483062885077648614,4939903384511802479,131072 /prefetch:8
    3⤵
    PID:1432
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1916,i,483062885077648614,4939903384511802479,131072 /prefetch:8
    3⤵
    PID:3352
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2912 --field-trial-handle=1916,i,483062885077648614,4939903384511802479,131072 /prefetch:1
    3⤵
    PID:384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2924 --field-trial-handle=1916,i,483062885077648614,4939903384511802479,131072 /prefetch:1
    3⤵
    PID:220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4124 --field-trial-handle=1916,i,483062885077648614,4939903384511802479,131072 /prefetch:1
    3⤵
    PID:4420
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4892 --field-trial-handle=1916,i,483062885077648614,4939903384511802479,131072 /prefetch:8
    3⤵
    PID:5212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1916,i,483062885077648614,4939903384511802479,131072 /prefetch:8
    3⤵
    PID:5388
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    PID:5536
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff6b86d7688,0x7ff6b86d7698,0x7ff6b86d76a8
      4⤵
      PID:5600
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      PID:5660
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff6b86d7688,0x7ff6b86d7698,0x7ff6b86d76a8
        5⤵
        
        PID:5692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4900 --field-trial-handle=1916,i,483062885077648614,4939903384511802479,131072 /prefetch:8
    3⤵
    PID:5844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 --field-trial-handle=1916,i,483062885077648614,4939903384511802479,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6044

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:824

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2492

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:876

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2932

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1696

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4380

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:396

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2932

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3920

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5244

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5376

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5564

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5816

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:6024

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2956

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5300

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5776

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5932

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:6080

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4404

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5672

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:6056

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6048
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6344
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:6536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2256,i,18272763564106695635,11201593968620719822,262144 --variations-seed-version /prefetch:8
1⤵
PID:5848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
Size 2.2MB
SHA256 e8347b06c68bfaf21a6113e43238e282c3fc8391381cee667e7cd3a8782ddf9e
MD5 04012bb90d3f37a1984b45eb69fbd0ef
SHA1 9995c923a476605d8c31f083e2427a6d88a3b456
SHA512 7c132822e4fbc18a318ee01329ecf9123bb7f35f1f2f2d708c95d32041d212dfeb8061745755f82952f73a831bc956a119e69a35bd32e38dc372254a34bcba81
SSDEEP 49152:s7T3mwzb/iYlzGQMebksutsKSq5UbU62FAQ228QKl:s7Df/hKuzgqj2FAQL
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 a8c458bff166a835cc53d8fcc2b6ab70f16f890e339d6e7d80ada4b027b3233e
MD5 d1e04d12d96c1426134c5126b2ab4613
SHA1 37cce77823b0cd6fca554e77c847eca104a41043
SHA512 ca6fa2b20d3c7dcd036db50ba958ae8bd0cc063bf26d4d68c505d976cc1d16945e7fd83b9a4d5f5694a814257c65102dedbb65af8d8b5a34d51e3a9cd9078cee
SSDEEP 24576:6PsJcuiSSRQ5UOOU62FBnO+E222YJbNEUQKGOb:6wcuL5UbU62FAQ228QKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 ceb87119a753a28aff3f615a72033331d60f7af7e2123454aed3c0a3907377fe
MD5 f69fa7cac982c7ba757089bf93475b83
SHA1 049d980aeacc6269f5a1eaf57d3dfa9decb8d3a5
SHA512 ce4254afe16d9eafee55844e649529ae7e5525d2b887bee62d35c92694336cd6a6fa6c480f4f1a79267ca2fafa7271a3c52266a0fca9039552dc9cf3bf47dbac
SSDEEP 24576:u+gkEjfh4CoeSRQ5UOOU62FBnO+E222YJbNEUQKGOb:jgkEzSG5UbU62FAQ228QKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 534aa66636b3bef400aaa2ca33082797e2f72d3121fce9249fd5511bc556bae1
MD5 a338ba71967f635dab805658121aa6dd
SHA1 6e2c35c802061f12cc62622aa3dcb285d574c9ab
SHA512 62b6d9ac6e6c8aca7fcceb6aae2524bbcb41da402c39d02f6d77d5c01a945b4aa9c8170c2fa2f81506162060a6e0d6334c38b87248fce6e21e9a8fa116ba2086
SSDEEP 24576:CBpDRmi78gkPXlyo0Gxjr5SRQ5UOOU62FBnO+E222YJbNEUQKGOb:2NRmi78gkPX4o0Gxjf5UbU62FAQ228QM
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8cf305632f76db6d2db043f61ae937acb2c06f93602104c4e4c4fbd519e5e656
MD5 9384d41cf991398ace0028c28bdd23c8
SHA1 badf6d466aa757c93ea31a20d171b1b19f49ca57
SHA512 f0ce79462295a52aedb2847a4a26ef46f2232c929fc47d16582e08c31594c8e7e1530c5e2bc9cd5a07bebf6cd191e86019e87511df21839bd840869744f16044
SSDEEP 24576:lLOS2oyPIXVeSRQ5UOOU62FBnO+E222YJbNEUQKGOb:P/yX5UbU62FAQ228QKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 71aabb1be55059d73106854e8df87ca6ca73745d5f4f647b4363384a105e6ae9
MD5 064f4c2c0205fcae16d358584f52387d
SHA1 2ed0f760d80974916e4afdf02d1e1f3453c3e6bc
SHA512 022c794d0a20766a876bc540e950b8912b786085dfa476d3c3b2d282b6d8b0d2c80b5eaa66f032537a68b270f028406b59eba3e5c6afd6c34baa9ca80811a3e9
SSDEEP 24576:axESRQ5UOOU62FBnO+E222YJbNEUQKGOb:L5UbU62FAQ228QKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 dbdb08f6a27425109fa693cd78beadc9880dee9a0666030b64c4a643d49df1a4
MD5 a00b7aef8533d279e7b527f39c3faf59
SHA1 69e18811520e078624bbb7dc7f97e020d7c7ff31
SHA512 3abf6a7e118a8d7c19e96c7eeb1242cc9ce338b9ddd4b95bfb026602aa2a12d0fb269555fd237bfde7c0cdfc9da58b4212d8b52447c8bca1469dc07a0ff4677d
SSDEEP 24576:/JIUfSRQ5UOOU62FBnO+E222YJbNEUQKGOb:/JIUV5UbU62FAQ228QKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 55d8ac2842f62019448a97a40cd52a6b9533857bff73916d882865c2907258b3
MD5 35ad221854f084df9aeb71da515231fd
SHA1 f6ce892cf60e008a4d0f09a280f499d43ef10cf4
SHA512 d2b2e4376c9dfd7b6b1cc8472e9aafbce5b26b192ed54734ba813f6d343c32dfc8df68b56bfc7fafbe37ce96c46221299d420c5f7a450a97aefe2474014e820c
SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THs:HQvGAdlCEL8c/yRNw5CWqj2FAQL
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 ca8b76d1111c2219719f6cc25df24103251b6f81d2dd38d31e7c73c90c4aae31
MD5 4f95e98a7099ea3b0683c29714d3cc29
SHA1 505d31247ba2838b2443fb7aaf2b1dcb5a547a55
SHA512 e55fc7ed87c9a0f24d3aa287a3751cfce49de658a8bb4dae68845e197dac8065c701af4c83ff83b4fcbfd50c04edd320593c14b80dfd439caa383b35b3843c20
SSDEEP 24576:pHewsAjhSRQ5UOOU62FBnO+E222YJbNEUQKGOb:tljL5UbU62FAQ228QKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 03d1cc98c7897f430f1c623e07c0c95c05eacbfc8bd0d5d3e1a4e11a570b7abb
MD5 352c32ee5aea9c57d458d9cf42e65626
SHA1 c33b2c920e57903227495045884f5224b6345ecd
SHA512 ffe4384e49663d472735e26e3aec7f04509b18173c19b499779b69ab81120850c2188a544c36475f3db63b79e6ea9a1e10e908558563e1fae91542871d80acbd
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHl17:sUEtQevvqc2W1cpV2EI32l
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9307173a2a0dbce78bfcd9a771000cde71ab47369c869fa13add15fe65e74095
MD5 bc0b830216c53e5c041076226c363ab9
SHA1 865a5a7795c22bbe047f862e1596023009665e1d
SHA512 06f25f44794464b1c9bb9c0af73da25c5c028a1a511a8af08c6f146f84e00d988a6013f64808f9d65e080d627d5a2505105937148f15041d564d192d836edefb
SSDEEP 49152:TCbRquA/m2yL5zTfFiV+XenmE3/zr5UbU62FAQ228QKl:soquVjnmSqj2FAQL
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8cc4109fde61da282c322a1973507f921944e0c16c24688c9cfb2c0cf95420d8
MD5 3fac3eb1478d17907632bb1001f18700
SHA1 0629e26b0f16be20d4a65baae0e29474f4ab3439
SHA512 f2a68ee134843dd8cb68e96943956011b92a5ecc01de29b281e1bcc5777e42ad7c2119547d21330c6575b0e05fe12d483921e9ab4cdf45c53b6774372a9e152f
SSDEEP 24576:QAhGLJIFoiwtA5l7S53uSRQ5UOOU62FBnO+E222YJbNEUQKGOb:QAMyFoiq5k5UbU62FAQ228QKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 09f4b9b0ca90c9ab2f87723a66433512002e958d803fef129b1c50631ff4e25a
MD5 bf17210b116e0cef11f20bbb041fd555
SHA1 bad27084e8039bb89ad46e0036b8b98ceab109a5
SHA512 0905c09f0fcf37984a0519c1a07520493715364920941ef3bc898d22c8b0ed86a57ca3bf0ef423ce18ef0fea1d80c70b0c9f1214cdb66b5181ccbe52eb9ba380
SSDEEP 24576:Rwu+OW1SRQ5UOOU62FBnO+E222YJbNEUQKGOb:Rw5Og5UbU62FAQ228QKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 dab8f3a8071bb8ffd5041659fa7f82b49d8f1fdb77d2a49a03854ca4718c89ad
MD5 6f2d39227e7bae45cbbe2814d5d79a34
SHA1 b48a3fa5ce6f5b4750e306aae38d274924910d77
SHA512 f45cf57617b9a455461b1e1b979b0686d1925cef010d2d3ae9b9e2bfb8ed1c6b13171b9142042596bc2e872d4e31dc0c29e8aeb3f80eacb8426bca42c1db5d6d
SSDEEP 24576:JZuwSRQ5UOOU62FBnO+E222YJbNEUQKGOb:N5UbU62FAQ228QKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Size 4.8MB
SHA256 f02efaf7258b7b4d21608e1fbd215baa33431fc7547e6b7ee3fced1ad302d7a1
MD5 0c53f6882da3889b13c89b9981310403
SHA1 5bb91221b0704542ad2d73b1ac92709af9fa59ad
SHA512 d691c290176766d3477a3c13f41f6eb0c461f3c3d43c70e15af9a39d1eafa403deb8a2a20b2b42b398a8839b0ed21c10d8188365367c551d290d5eca96504ae4
SSDEEP 49152:tj8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbDfiIerM1R6ZPj:WrZ4K5M+XDfiIewG+x6xZ14Hqj2FAQL
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 a424c0af9783bde9a0040226da9a842fd294f9b0f541fdd9be9b7807536ed6c3
MD5 77110800dee9f2f7a66f50eb008ab98b
SHA1 20e4bb333b438510df1c3792a7fcac0728c7da26
SHA512 e311d6a11451d7ecf25facdec7b17b4783dc0207504b42df76c48b001f7cd06ecbc288da80d8d197360bb54873474b2224bf9f1905badecddcf0c67df3c6076b
SSDEEP 49152:JfzabJ8llj+SWWi2mkx+X+diU5UbU62FAQ228QKl:Cui2rqj2FAQL
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 25b99bd2b90918c52461c719c41ea78b06cf734349aea58ef32c6bceb47c0d1c
MD5 e91cb6e2290c30402402211cc9d2ee97
SHA1 9fbe78ada01d37a8d02851df7d6e3f90794eb84d
SHA512 d5f81b1a424dbc62283be20d1d080d0b3c1ecbd5a6df610356be167a03138f236c6550f646534605bc2a90127df01c4cb0e1b8bea309a159ef685995480980da
SSDEEP 49152:ma/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4TN5UbU62FAQ228QKl:IZ4K5MJabfsYNeqj2FAQL
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Size 1.8MB
SHA256 1ec58aa85ac8f7635fd7edd1bf2259f5116879990b5644293b0180e3962089a6
MD5 b7069c23722e0a8ce94cc5d5aa5004fd
SHA1 c502f6dc41d9a60f1106f8a82f5dcd7426780e12
SHA512 71e8e284e31f49a5c3abb28056e05f1cd450e6d9716601145f35a22b1b77cd924e02515060b4668a11c12547c47a3bc3c3d20db0132b3ccc56f6532d91bf491c
SSDEEP 49152:ugNJtUzDu/9gKPxHC4n5UbU62FAQ228QKl:vPxPqj2FAQL
MD5 SHA1 SHA512 SSDEEP

Submit Download

678f0e28-4082-485a-b623-7121e9e2078a.tmp

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\678f0e28-4082-485a-b623-7121e9e2078a.tmp
Size 488B
SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
MD5 6d971ce11af4a6a93a4311841da1a178
SHA1 cbfdbc9b184f340cbad764abc4d8a31b9c250176
SHA512 c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f
MD5 SHA1 SHA512

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 b9b1798b95c0e1e201b163046319de726d7b7d237cce5e6ab4b5cafa906ad3ab
MD5 e8df68c96d65aadc55c12cb64669a159
SHA1 22bb265f4f462850fa2b485b5a4b4979d9c9e542
SHA512 1e66e98819949d9006e9144e6a1783bb1983a278dd047832a24f015bcb0dad750584a75dad373944e959586d0903de1b84de9ec617cbd52124bdccc9f93add49
SSDEEP 24576:9cP4mcvIjkGOxhKP2l71SNKbrh/8KBISRQ5UOOU62FBnO+E222YJbNEUQKGOb:CP4m4IpOO67N8KI5UbU62FAQ228QKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 6148eb76eb56583c3eb69852c9c59ef46ad7e34d6752b93876e52ee417ea084b
MD5 74fdaca7cb71ba8d466d2620ec04e693
SHA1 635012424cec1b39771a349976a3813ea2923a64
SHA512 ded38245fbc1944dd8c758c6eb44cac3ef87d722d880dff3ef9006c500ca938526dcaf80a3c82f9da3b9d1df888f58214cef3cc9c782eeca3072e051c19da1dc
SSDEEP 24576:aaSJSRQ5UOOU62FBnO+E222YJbNEUQKGOb:aau5UbU62FAQ228QKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 e1a9dc7f8e1fff71c8ebc2da931c3c254b5a62908a6d22efbe27085db8a9b36a
MD5 a6af806de53cade9b0e7a6f2446f1ba6
SHA1 d5078ec988045014437eef70437e1243d3c4fdac
SHA512 2ff96045a3b5e1adbaba43ba3267c6d03f113bb545af563a3711a998dd5c4426ce4f56f6cb501d2fb670b8b8f5fa71a696797648b428c86ddda7de4c82d227f6
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 193KB
SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
MD5 ef36a84ad2bc23f79d171c604b56de29
SHA1 38d6569cd30d096140e752db5d98d53cf304a8fc
SHA512 dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be
SSDEEP 3072:HXm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4g2rJBXCy9enoN:HXUMCm4U6q62MEBi99g6JVCvoZhhl+No
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 944B
SHA256 a7fc18ad5ac50065a998c64e4d83fe6edfddb5a03075eea3b11de8dbb4363185
MD5 c17bc9f3ba85650773bc4a4367f5e67f
SHA1 6ba4753af403b2c735537d7b49fd8f1805bdbcc4
SHA512 95d06e8775229cefa23b88121244a804203005025fa6e8fdb2c495a289b7d9e170f8c0098c3da5052f01b922885fa2ac866fe0b34c6acfd9b214362a1b7031e5
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 369B
SHA256 b7e9fe657cb7ce9238bf48d85e489e3394ac1b176141a4926041c7c28e493de8
MD5 0d92b5294ec0c8ff43f2b09e5f18fa30
SHA1 43c3f9f3d84b037b888a914f643743ea6dd7e023
SHA512 01c224136fafc33e8497b15dd52343f75f923592a7eb07d0fb0aaf40dac09dd03d5994b9b156011e16ddb9c7de4e452600c1c03a52b0efd5c0dc7d6cd5055ce7
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 d6737581a24232b101b0c2746512d19a4966c4f89f9d5c9ec58e151dbc05b826
MD5 02421ff6d7471023eb62203692b1285d
SHA1 121a308e980c8ca2d0766acb6ac165dbb47bba23
SHA512 a54e0634d92ce06ef37d9a10d14d82540ae973b53bd0ca400ac7dda74ff517c3bb95a64b83eb7a991b0f6f1f214d36a74b22c586ac58220a70a6c7d22b08b29f
SSDEEP 96:wKDrIXl/PuZ8iZRy7Di+6MsmdeIOIojVlVup:L3IgZ8syy+F4jS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 4KB
SHA256 9cc990b86b1ac208e921589877dcd6fe0d2dca7c71d2638ca920681faa0522fc
MD5 7fd67baacfcc2bab4b7f3f7774ccc45f
SHA1 8e730e14a14824484f47aa03fb4ee49fa904518d
SHA512 4d11997c4521c89a275a6d918a2ab48ea7dac17617213c057358b4df3a1024e084c19005ac9449549b4ec1b2a78b5f8d28a35766006d66c3ea4d229c068f51b5
SSDEEP 96:wKDrIXl/PuZ8iZRy7Di+6Msmde0BOIojVlVup:L3IgZ8syy+FF2jS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 4KB
SHA256 597464d46bdb78d6270be8ad3582249674d8a728c3f2a173c07adfd3bcdabe68
MD5 1e9ffead4c893488d6c20df8ff07a3c3
SHA1 be5cbdc7fbe39b9fddf6454234bdc348102fa945
SHA512 cbfc53867dc312aedf5c08252f835ca7a5ae11b20d8950c4584b3a16754ae8dc388aa0fe33404bb62b4319c9f57a123378a9182697e0634cff1cf0440f5f15aa
SSDEEP 96:wKDrIXl/PuZ8iZRy7Di+6MsmdebOIojVlVup:L3IgZ8syy+FZjS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe57af99.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe57af99.TMP
Size 2KB
SHA256 697eae9f64542c73ab26efd93f8fc32a77e9c15cc99fb60dd3f3866ca8df21cd
MD5 3c284274fcfaed236362cd810b542cc2
SHA1 578a3c86ae7cafac8ea2fd1aa785913f2dce853b
SHA512 fc6099cf5604e931f5da5376effd1c720eead4f9398298c70c7746bb25ea66692a2acbc4020cf75754aa62d90183cf032463aea80a90afc688f5687d2aac2042
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 cc8e66323098b5453ba544f1c86dd553f9c275789b5f3d354de49228a031fa62
MD5 cfca3de8e8b5dc9bcc688cffd91943cd
SHA1 1a64e30ae68a620b99b631896a2086f4eb35a90c
SHA512 2dd73aad6b7a706cc43e3f0da6e81d1743ad34c6f4b0ebbec13a23f0f1a897b78ca738581919c3aba8e60fbaf3c6409c9f36b6ec79b3dd6c4c11b123cab718d7
SSDEEP 384:z/LPLeaXr1kXqKf/pUZNCgVLH2HfkmrUxHGu6bngOAvm:zLPLXr1kXqKf/pUZNCgVLH2HflrUlGu2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 260KB
SHA256 89bace7dfacef41eb64d06c351d63d45e92b22a0eaf1714665a1758b18fc7aea
MD5 818eb4d8025496fb500c87878d02022d
SHA1 7a6e5f58ccf164976552f78e39da0672d56b214a
SHA512 1c6bb47db8cc34d21a09ed4e5731aa40f330743d6f49a02a12673c85782ad69f3eb85cd489803c01e300dc1581b838e58dfe4990310db60bc1f00a47a68233d7
SSDEEP 6144:4gmk8BePlHpgfw4iyhfSXnMUjUher1OTr7i05WXlpHET:F8BklSCtnPjUhw1urGtXPY
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 7KB
SHA256 7175c2f41d94ac69ccd78e76dab17df8050377cce0b1419a5d44d45cf47500ca
MD5 dd6663ac1a427479aa661649a102babd
SHA1 7c9bd616f611c73f38b04768e9b1c98bdd825d4a
SHA512 e54542415c8b6874e8a54cc07a15d26e66be713784f9d253d3bccd6a0710a551adaa7461d5ea437778a960875069fab17098c1a190fc9cf2040df7f40e4ef5eb
SSDEEP 96:D6Pn1hufNAkvkvPA7xK3gTK3yCWD7DIenctxK2cK2+hmrLExLgZMQg:AGsqHz5nSmtIxcZMl
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 8KB
SHA256 7f67e0a122ee000536d7a7ad8071bef9c93f04f16dd5935cc8523da8887a8168
MD5 6ba6a1aa70497d70ded8b3a03aa36288
SHA1 8fa92f1413a3f38e3537167dfb1c528c1c3eeadf
SHA512 f1909f2486e3b7c2683cc4fdfde5da05d041c068759a12944da632bb890527557a4f5e6f14c40e4868d1ea6efef49a5f1c0818432c7a17bc5bc611b2313be528
SSDEEP 96:D6Pn1hufNAkvkvPA7xK3gTK3yCWD7DIenctxK2cK2+hmrLExLgZMQKfSJwxK3pK/:AGsqHz5nSmtIxcZMvSC8/U
MD5 SHA1 SHA512 SSDEEP

Submit Download

8b7d94ab8642d83.bin

Path C:\Users\Admin\AppData\Roaming\8b7d94ab8642d83.bin
Size 12KB
SHA256 f7c0cc02b43b097631e5d2d0748e1cafc0b4525f31fbb314010c0f4b49f5cea6
MD5 b5385cbe920c98566f0b229c6656062d
SHA1 358915914f74833cb48cf98d6ce8e70475929abe
SHA512 4c1701825893afda07e48b153d92d6949e3a3e4e2cc7f2127120cf80508fde76084dac36ed41ad503cb6cc09d9e672431954c356cd68f16582fa31845f57307d
SSDEEP 192:x7y7isn0uZ0h8ghDvEVIXpWQmI2hs2ze42wFI9pjhdsyIvw3Fg6IkL:Fot0ug5cWXpua2z4wSpjLb1T5L
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a0ce05c7be775c1c762ce35490d1a8356608c77f0d48d7ce22fa2310129e9c24
MD5 482c5e010efd454854307bd5fd6e2228
SHA1 288cf952ef43d9f2972e2439c7b52009e0c1525f
SHA512 a90085fc3bdc20808a3633ec51b84cc845a154ff07092075226a701aba1557ce784969be937e9ca65664eb274db70c2e20151552b4573fd326e7190baa8d6c91
SSDEEP 24576:5QSRQ5UOOU62FBnO+E222YJbNEUQKGOb:5q5UbU62FAQ228QKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 256c23ce5e3249bb18d79ed7811641994f254e0f092b19479abeb95e67cbf3d0
MD5 879da63cda0505147287ff2cea3e0f26
SHA1 edf62fb94941f9d4e58c04665c5256955549f205
SHA512 5ff46c269b3786e5c5a92f8e899cb5a4251483dbf54f78fa027d9b1140c91df672946504b9ccb99c42553805223ef6a6c1658da280225ec10ff516d35e998262
SSDEEP 49152:3a0h2GEkuAe73q3pp46zwwQs5UbU62FAQ228QKl:3a0hNYG4Jwlqj2FAQL
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 bcc59dc927b6fc68241e60753c6f7de3f98b9d581bc230dc4b84c8f47b5e1845
MD5 ab46101721a25720a9e5656eb5846d8d
SHA1 0799db238d3ca8973451e1473299407eb3dd6bbd
SHA512 f41d5fe2ab7f3bd9e134c8def22c3df13e7fd8d013e2f45019e4cc305dadd489cfd44064d289efdf5b5d4d3542fdcb4cdd446c6555f7d4caac2923b5191c75b2
SSDEEP 24576:RhbHjPNSRQ5UOOU62FBnO+E222YJbNEUQKGOb:RhbHjn5UbU62FAQ228QKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 a9c0fe39e8b37d16c1ec6ff517aa77d58be99495983d219c2d0480cfecdad755
MD5 2ce434bdc39dee4b9387c3bec918fee8
SHA1 30f40ff664e6caf02e70a0f7b862045eabd8e268
SHA512 fad6cac6054d3050a5c9076b6b3fc9c849c972372a7a0cbfbe6b76c3f2b4400af989bc5e6269206b74c920ff6702ffe75095dc5f15309b7e4b151ebeedaba6a9
SSDEEP 24576:j3YgnJcRTk4yti+R5dpR/1SRQ5UOOU62FBnO+E222YJbNEUQKGOb:jIgnaTk46ppR/X5UbU62FAQ228QKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 b03c7c2239832fa3e46a8f9087aa5ef052898495a8e8ea98e5a8afa94bb5dfb3
MD5 21e04353aefbbc4bf78bb31462484766
SHA1 287fe01bebde4f22dd79c20f788215528e8249e6
SHA512 655f40e69db8803392cc3c1a670e0a82a4c333f46312ba04cebd3d1ec7565705ee3135c85df30b007559bfb8312f1271284ea642aa2a66cd5f936894e0f81a90
SSDEEP 24576:+kSRQ5UOOU62FBnO+E222YJbNEUQKGOb:+G5UbU62FAQ228QKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 dd0e928befb3186ce21dc7d5619ce8e385bd2b6616ad08909d07d52ec033fcdd
MD5 7c1017fed01455ebd08e248e5612f6ea
SHA1 29c7f4ed6202f1b8e36a210ec514625013034a95
SHA512 2bea94952a8c912d48e234a3941cf18a40f723719144b832bc00bbb1ab54f7932dd18560c3e4db6175da000de791a8f4937ac50d31e718a062441eab1541a9db
SSDEEP 24576:QzL3UTrSRQ5UOOU62FBnO+E222YJbNEUQKGOb:QzL3UV5UbU62FAQ228QKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 a82c33deef1ab1918090f2604af225bdabc96fee643cfa4247650ad9c8340adc
MD5 67a7ed196eac20da35128b7b3798ea69
SHA1 bb1dac57ea638b185eaaa98ddeeb34a5d3c5a55f
SHA512 5eda26cf8bcee3b60357a457e67f663a2a865fc2a7a1e826eda274bab216507e3dd6b7ace187d09ca8b3db34f772199eeadb141e9f9f51246bc88f0d8b647f83
SSDEEP 24576:2O/SRQ5UOOU62FBnO+E222YJbNEUQKGOb:2O15UbU62FAQ228QKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 44cd64be4dfe048b176011dc37e955c1b17def1790e1cf52832411bf91e870d3
MD5 47b89750a7cd92fe5f101031ee3cf940
SHA1 54b7b2c47986dee2fa7a519c1e30fb068dfeb497
SHA512 7cca249df3baf927947ed0e4cf6becbab098b0e4c0320f84c7909a15c31c4cebbccf80aab6053d267f41671c7c23396a991d4ddcd6ed54c01d8ba33d348f8677
SSDEEP 24576:47NM9YmZqmWMUkPjZM48Mv6bEhsgSRQ5UOOU62FBnO+E222YJbNEUQKGOb:47cBWMpPjN8DbEhf5UbU62FAQ228QKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 1f9acad74894824fbe07a217846c0599f945026da0c5800f51b6cdfd93ae95a5
MD5 60b07aca0db6eba76e5c70227f3ee4e9
SHA1 65c2f65cfe5486d396d0c36fc1b7a6ab9abd0f8f
SHA512 1523d3c08199f8a286cf88782daa0ac2a05806fb6c1b1b8c1bbd2eebf623ddd08a63ee938bddff8a46c632c8b84d5827dedf818d75f6a45a43e379b9bb7efbd7
SSDEEP 49152:VF2YuHNETovcvNYf8kma5UbU62FAQ228QKl:w6tCf8kPqj2FAQL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 389e81a06302b8c14ff4d28c20976a55d8156a9e2580f97a9c10987afcd3cb86
MD5 ca08e2fa3999a765d9aa618ff9e9621e
SHA1 2b0b02858ac5e1b02f81fcda6ba820bac33480ea
SHA512 c9c071860f6f22277cfbbb835321366903442814b8f29a136e6266da9432bd661047b22da2bb553d9892eace788ae9dd485930de418e67932626741a2d6a14d7
SSDEEP 24576:3AFs06+Omlf3NXEbTojSRQ5UOOU62FBnO+E222YJbNEUQKGOb:QFs060lVXuM5UbU62FAQ228QKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 37ccb701e5963b36da79b0ba6e5e36d21e88468a73cd61ef4458b0d1bc7245f1
MD5 1525cd28dfc91b0b67582db03e29f97c
SHA1 67ad09ee2a1a8676164817b2e78351757677ac2c
SHA512 160055fb1117eb34455dc6f6d31fcdeb96d8eaebace23a83db1e6759581b072fbd606af487df22c3a6dbe3059d50e8d141a14c2a6a1a1e85ab7772b79f8d24c1
SSDEEP 24576:cJnJ5D3W32SRQ5UOOU62FBnO+E222YJbNEUQKGOb:cJnJ5DG3M5UbU62FAQ228QKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 0f6a1986f31fd9d1ed0db4729d088e45f03eee5219b5e7f5ac5b76cc43c48145
MD5 c668da0ae6dbb8eb05f44c03ff03cc36
SHA1 fc8332fcbec512f22f969a6dcfd26b35fed6dc6c
SHA512 ed7ebbbc481e262cfd11453f62d19c6db29fce8329fa80654accb7868126afe193ce1652235335af901a48125045f956823b88c5d0483135a3e12a09289fd4db
SSDEEP 49152:Eo06DIKdwc+eQnSt65aVu5UbU62FAQ228QKl:Zeqj2FAQL
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 f5645766790ee3f627a2c95c8688456668798bf77cf23921c441dd19b0394d51
MD5 fc9ad26f2c5d51f84c0ee6848fac93bb
SHA1 d920e32f55dc83096a40ba86a88c13e8d12c31d7
SHA512 7f915c0ee15b96239a0c416551261a298146517ce3b43e2ef1a0365fa1766a108d6ab8799e742a31072687a465e2fe52966f9f5661f165f742f244bf6ccc2ffa
SSDEEP 24576:gFMSRQ5UOOU62FBnO+E222YJbNEUQKGOb:gF+5UbU62FAQ228QKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 0c0a5cda199b2d5e987fd46863f385ecd661b34ee5e8a25416147e8935fc4971
MD5 7c319aa991e0565b47a5886c77a0a0fe
SHA1 1dd936ab5741879a53a84ee1ff7cbcfe9e360639
SHA512 37907387968097a4807772142b88affab7e2fa014fb2a3016a22f28480c3c766df7653e5b730097cc57c1a019a407de03e2d35a00fce3218ca232278d8736781
SSDEEP 24576:1Iy9SRQ5UOOU62FBnO+E222YJbNEUQKGOb:1Ic5UbU62FAQ228QKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 fd981b6ba887f125aeff01c799b2babf02053c3216b0f3f749f80fe13f894c6e
MD5 ebc93fc1eede6f8deb1d552cc058378d
SHA1 b8fd2d4f48be318687c749437f42c694c5bfbb73
SHA512 a28fb2773ceca9a18b8b0253e8d29559254003308f07955bd8eecbc507180e0ac003c6a0324ea789c2a8adbcafeea9e8ebead29ab4d6934edfc56a23a3961113
SSDEEP 24576:VvSRQ5UOOU62FBnO+E222YJbNEUQKGOb:Vl5UbU62FAQ228QKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 0a5bd26530534cae7cc07c0ab5d8b3d4ef921a9fcd0ea01039c44bcdb34abf25
MD5 38ae602f05ab0798adbe163667e85894
SHA1 b16fd7cfeea3e40a0a174ef1ba26604300edc940
SHA512 a385dab72407457361d1978541314a5be9d45acf17b7f92c6a968035da7c3b6ffd7ece2ad032fd9520c60b71a5e47460efd566f615ba6efdb0a18ae272e89970
SSDEEP 24576:7Q9MxZKdcz97w3YSRQ5UOOU62FBnO+E222YJbNEUQKGOb:7VKXi5UbU62FAQ228QKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 9e3e184ae07ac992941e0ed16a9d759602fe6659d5d7a45b075cbc1143690f72
MD5 05a577dda9f9c783ea74448c2ef9799e
SHA1 91968570d0050ab39645025c176175045d487534
SHA512 7380f1a5d9acd63f8db78311264e5c190f844ab4758c14d3fba830e14a2bbacc09adabed0def79185ee25a4de29bb997d0c05c3a4e0ebc9faf0dbaf230c36050
SSDEEP 24576:Lyoc/AphSRQ5UOOU62FBnO+E222YJbNEUQKGOb:+oc/ApL5UbU62FAQ228QKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 316b690b0ece37a1ffd9cc195bf8b20ec767b77d4f824587e36d56c85662e53b
MD5 7ff9cce72c058f1b0375e2ba220c41be
SHA1 7b8fe02f976747a61671c3aacbf7926b98af01cb
SHA512 a5f4c8ca8ea9d75ed51bfe3179c3ea9903f5e2f5f039f742a341381e6505bdc2575e53685abfae88fa190553d7457318226f6ed49c1636a345ec143d14e924c1
SSDEEP 49152:VWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKL5UbU62FAQ228QKl:F0zuNIZqj2FAQL
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Windows\TEMP\Crashpad\settings.dat
Size 40B
SHA256 f11a15dff21527e4dbaf80b3d6a496aab2c8cb48190112215a14bfa486b549ac
MD5 65977525032194782302fb74372e0bce
SHA1 be4d33e1020f51613dd58dde0564aa088ba09a22
SHA512 6d408f43879dc8e16be87198beab6ace35f124f8bf875d4c89448aa418e64a283e333dcb739b209a4d0444cd027be39b7efae618a306cf8020711b13103e960a
MD5 SHA1 SHA512

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3b8618a793391b163a07fda5078cf2d3cfaf31fb92090ed91a148ec7a16b0bc4
MD5 6c3d693b2be7623b9c3fdfd2ac187349
SHA1 392b2a494e67c5c02aa4f3dc77e2dbc3ccea3e50
SHA512 26d266da41e838c8c52389dabefe2c8e8b0b5767ec4bb743d808a57d12ed585348470ade2ab0b732a72a1da5e7847d920820714eae6e12633b69d564caf94b6d
SSDEEP 24576:C1QT7EcpfxR+N5AWAz3ooiYtjMqbaSRQ5UOOU62FBnO+E222YJbNEUQKGOb:fTDxR+N5YzTfjMV5UbU62FAQ228QKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 8f3d4b1b77813c5b641d5bd2eee372590a5343858807a728bfa681e6576a921c
MD5 05069b17c702256fd6bf528a8f0b4530
SHA1 68bf0891ac8d3bca7d3ca5396b3c7dfc2a8b2682
SHA512 c13b6421561c402d9528bc4c0a5fa4aec707660dc850e33db78fb9dbdf9e5b063c885894cdd3ef1b1508be2d189ef3fb63ba6701bc5f969a81ef8b9162b2e635
SSDEEP 24576:2TMdOz0FFS+4mSLOSRQ5UOOU62FBnO+E222YJbNEUQKGOb:S0K+4mSL05UbU62FAQ228QKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 c91ab5628e319f17955a1c21d42176dfa5a6159debdfc32b917f0ba6ea5c293f
MD5 0516c93f32f7f817d0bf20af9edc347e
SHA1 5e6d888f481ee17399a1e823c5501445c496006e
SHA512 b5ddaf4b7d33b5921e071c3b0a8af2bda405d48d263ee4c469a4a219fbb7fa471b6d38786df3a3e78512dfb7aec85a96cb8d8cb6cdf7f12dc889acbf31e767e7
SSDEEP 24576:mrSRQ5UOOU62FBnO+E222YJbNEUQKGOb:mZ5UbU62FAQ228QKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 05384c2f485f1fe3344f4a1739d782fb20301ceac9e5304543216af5e711ce70
MD5 088056252de0cfc4ea2df92ae79045e2
SHA1 7325523f30fe10d0ecc68f78358425885cd524e2
SHA512 39e6c8e8a92abbc1a8900e2044776f0831c86e8bee6bb291cadc41916c88574e1624ce791ae5e6cedb3ce1138bd1b821ebbdfc25f2877a42f06a25f53b505237
SSDEEP 98304:a7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGL/QmvD/cTwY2h3Fpqj2FAQL:kM7pTXexZPGzURnBh6gGLF+W3/17
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/396-131-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/396-130-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/396-116-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/396-117-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/396-123-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/824-20-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/824-37-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/824-21-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/824-103-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/1696-80-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/1696-91-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1696-107-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1696-92-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1696-78-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1696-111-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/2492-53-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2492-44-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2492-45-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2492-133-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2808-36-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/2808-2-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/2808-8-0x00000000020F0000-0x0000000002150000-memory.dmp

Download

memory/2808-26-0x00000000020F0000-0x0000000002150000-memory.dmp

Download

memory/2808-0-0x00000000020F0000-0x0000000002150000-memory.dmp

Download

memory/2932-225-0x0000000140000000-0x0000000140159000-memory.dmp

Download

memory/2932-59-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2932-58-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/2932-66-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/2932-94-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/2932-97-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2932-135-0x0000000140000000-0x0000000140159000-memory.dmp

Download

memory/2932-142-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/2932-232-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/2956-317-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2956-246-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2956-256-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3920-157-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/3920-241-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/3920-147-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/4380-100-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4380-105-0x0000000140000000-0x0000000140245000-memory.dmp

Download

memory/4380-112-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4380-182-0x0000000140000000-0x0000000140245000-memory.dmp

Download

memory/4404-318-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4404-326-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4604-12-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4604-14-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/4604-22-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4604-101-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/5244-254-0x0000000140000000-0x000000014014B000-memory.dmp

Download

memory/5244-163-0x0000000140000000-0x000000014014B000-memory.dmp

Download

memory/5244-171-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/5376-183-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/5376-269-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/5496-260-0x0000000140000000-0x00000001401A3000-memory.dmp

Download

memory/5496-270-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5496-330-0x0000000140000000-0x00000001401A3000-memory.dmp

Download

memory/5564-195-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5564-273-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5564-282-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5564-186-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5672-331-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5672-339-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5776-275-0x0000000140000000-0x0000000140182000-memory.dmp

Download

memory/5776-285-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/5776-345-0x0000000140000000-0x0000000140182000-memory.dmp

Download

memory/5816-287-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5816-208-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5816-228-0x00000000005E0000-0x0000000000640000-memory.dmp

Download

memory/5932-304-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5932-288-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5932-297-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5932-301-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/6024-235-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/6024-303-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/6024-243-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/6056-347-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/6080-307-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/6080-313-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download