6485425d806c73daf3b092cff2306b47acfd51b7ef6d4d20f8707fc00995c4b0

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 16:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
Size 5.5MB
Sample240405-tzbn7agg9s
SHA256 6485425d806c73daf3b092cff2306b47acfd51b7ef6d4d20f8707fc00995c4b0
MD5 359508045e7284f14cf8dd3979050cee
SHA1 8dc563d50857064666be4df31c72794a6ee15d1b
SHA512 fe3325b5ae9b4bd65c93abc81104a01f180edd7c2ea25084e09f721ead6c99dd9c97697152340f21dd3c923de6ddb626c21add3429c34c3c96e53b09709e2d92
SSDEEP 49152:gEFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1Ln9tJEUxDG0BYYrLA50IHLGfp:uAI5pAdVJn9tbnR1VgBVm3qo4w
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4432	alg.exe
3688	DiagnosticsHub.StandardCollector.Service.exe
2484	fxssvc.exe
4456	elevation_service.exe
3356	elevation_service.exe
3228	maintenanceservice.exe
2324	msdtc.exe
1692	OSE.EXE
5064	PerceptionSimulationService.exe
3980	perfhost.exe
1764	locator.exe
4588	SensorDataService.exe
3764	snmptrap.exe
4488	spectrum.exe
5172	ssh-agent.exe
5336	TieringEngineService.exe
5496	AgentService.exe
5644	vds.exe
5764	vssvc.exe
5904	wbengine.exe
6032	WmiApSrv.exe
6132	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\822c304b12041754.bin	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_127765\java.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb70547d7687da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000416b2a7c7687da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000050dc44807687da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000385677d7687da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005d58f87b7687da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133568081723383395"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b85cf7e7687da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005115d67c7687da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001dce967f7687da01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
3248	chrome.exe
3248	chrome.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
392	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
3508	chrome.exe
3508	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2224	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
Token: SeAuditPrivilege	2484	fxssvc.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeRestorePrivilege	5336	TieringEngineService.exe
Token: SeManageVolumePrivilege	5336	TieringEngineService.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeAssignPrimaryTokenPrivilege	5496	AgentService.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeBackupPrivilege	5764	vssvc.exe
Token: SeRestorePrivilege	5764	vssvc.exe
Token: SeAuditPrivilege	5764	vssvc.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeBackupPrivilege	5904	wbengine.exe
Token: SeRestorePrivilege	5904	wbengine.exe
Token: SeSecurityPrivilege	5904	wbengine.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: 33	6132	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6132	SearchIndexer.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 392	2224	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe	86
PID 2224 wrote to memory of 392	2224	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe	86
PID 2224 wrote to memory of 3248	2224	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe	88
PID 2224 wrote to memory of 3248	2224	2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe	88
PID 3248 wrote to memory of 3404	3248	chrome.exe	89
PID 3248 wrote to memory of 3404	3248	chrome.exe	89
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 1840	3248	chrome.exe	97
PID 3248 wrote to memory of 3284	3248	chrome.exe	98
PID 3248 wrote to memory of 3284	3248	chrome.exe	98
PID 3248 wrote to memory of 1136	3248	chrome.exe	99
PID 3248 wrote to memory of 1136	3248	chrome.exe	99
PID 3248 wrote to memory of 1136	3248	chrome.exe	99
PID 3248 wrote to memory of 1136	3248	chrome.exe	99
PID 3248 wrote to memory of 1136	3248	chrome.exe	99
PID 3248 wrote to memory of 1136	3248	chrome.exe	99
PID 3248 wrote to memory of 1136	3248	chrome.exe	99
PID 3248 wrote to memory of 1136	3248	chrome.exe	99
PID 3248 wrote to memory of 1136	3248	chrome.exe	99
PID 3248 wrote to memory of 1136	3248	chrome.exe	99
PID 3248 wrote to memory of 1136	3248	chrome.exe	99
PID 3248 wrote to memory of 1136	3248	chrome.exe	99
PID 3248 wrote to memory of 1136	3248	chrome.exe	99
PID 3248 wrote to memory of 1136	3248	chrome.exe	99
PID 3248 wrote to memory of 1136	3248	chrome.exe	99
PID 3248 wrote to memory of 1136	3248	chrome.exe	99
PID 3248 wrote to memory of 1136	3248	chrome.exe	99
PID 3248 wrote to memory of 1136	3248	chrome.exe	99

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Local\Temp\2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-04-05_359508045e7284f14cf8dd3979050cee_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2d8,0x2dc,0x24c,0x2e4,0x2e8,0x140462458,0x140462468,0x140462478
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa45409758,0x7ffa45409768,0x7ffa45409778
    3⤵
    PID:3404
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1892,i,344111799831004892,13950174090987676595,131072 /prefetch:2
    3⤵
    PID:1840
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1892,i,344111799831004892,13950174090987676595,131072 /prefetch:8
    3⤵
    PID:3284
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1892,i,344111799831004892,13950174090987676595,131072 /prefetch:8
    3⤵
    PID:1136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3008 --field-trial-handle=1892,i,344111799831004892,13950174090987676595,131072 /prefetch:1
    3⤵
    PID:4080
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3020 --field-trial-handle=1892,i,344111799831004892,13950174090987676595,131072 /prefetch:1
    3⤵
    PID:2552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4624 --field-trial-handle=1892,i,344111799831004892,13950174090987676595,131072 /prefetch:1
    3⤵
    PID:180
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4772 --field-trial-handle=1892,i,344111799831004892,13950174090987676595,131072 /prefetch:8
    3⤵
    PID:4444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4604 --field-trial-handle=1892,i,344111799831004892,13950174090987676595,131072 /prefetch:8
    3⤵
    PID:4484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5064 --field-trial-handle=1892,i,344111799831004892,13950174090987676595,131072 /prefetch:8
    3⤵
    PID:4496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 --field-trial-handle=1892,i,344111799831004892,13950174090987676595,131072 /prefetch:8
    3⤵
    PID:5068
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    PID:4516
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff654867688,0x7ff654867698,0x7ff6548676a8
      4⤵
      PID:2252
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      PID:1956
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff654867688,0x7ff654867698,0x7ff6548676a8
        5⤵
        
        PID:3772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 --field-trial-handle=1892,i,344111799831004892,13950174090987676595,131072 /prefetch:8
    3⤵
    PID:1548
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2304 --field-trial-handle=1892,i,344111799831004892,13950174090987676595,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3508

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4432

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2128

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2484

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4456

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3356

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3228

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2324

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1692

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5064

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3980

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1764

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4588

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3764

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4488

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5200

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5336

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5496

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5644

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5764

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5904

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:6032

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6132
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5812
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:6124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 5d2932ddd2d37c91168721384d0014c1d4c222e45f50caafc2f36bb255e93aca
MD5 d417c73dd11ddb965ceeba3ae0366063
SHA1 9333062ada6d1b0a5d13cb8cd37409c568143b79
SHA512 cd92cee5ae3860677dcfbd6c4fef93a30fb7f78bbd705200444c68c9d291176d39e29f4551c90426be842da48bf0f6805a6a68aa631a6aa3cf7356e575aa3a97
SSDEEP 49152:XuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z53kQ/qoLEw:XPfTqi90bPqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 0b88556af4742149777715951bed58ade2ed8443ea4a95e40f0f52825cf43bf8
MD5 57903520d9232808f3a908702e17d6d9
SHA1 47da7c521d772eceec78d76e411389e381065e52
SHA512 0d48857e83d1d9cd8f6283032f00fd06ff43517ca51f7e2f1c2db5721f4b9d9c35cbc231f6b19494c555298242733b3cd1ef6829b22220f3cd569e8518915748
SSDEEP 12288:cC0P9Q/Jcui6MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:wPsJcuivSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 2c1de4afe842081ea6ffafadb80c066894f451222b985280fba789ec2bd2bf57
MD5 9e9dcb45104f50c910bbfcc58201898b
SHA1 c0d359b4c4fa400c4d7db7a3bcffbd0a4b58ad62
SHA512 dddbbc689a4743af25b200cefd1b5dc88170376ea430c3f472c25071744fc410bc3a4293d56800cad31afcec68323f3caccddd87e4d092b9651cd7f31d50ec33
SSDEEP 12288:47a3iwbihym2g7XO3LWUHfh4CoGMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:1+gkEVfh4CozSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ddb242f99616fe38221d52b817f327cce93fcfef1c910935930f5d8646928211
MD5 65cdc0eada9ec04d7f107fd62e2915ac
SHA1 f172ee08e58fe9c7ec0081dadc829e8f77cf430a
SHA512 6fcb907960d5f48b973de8ab759be12e00ae04fd83c81230fd26b2be0a32465085af9dfb3f56d2eb70221dfb54dce3bedbd856c47dd6b5b802132089078f0237
SSDEEP 24576:OBpDRmi78gkPXlyo0GxjrySkQ/7Gb8NLEbeZ:6NRmi78gkPX4o0GxjXkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3453484e9f2fc939a7554236c911a5bba731fd856fac247b52fca4fb75fd8c37
MD5 32ccdcaba8e7666b016477d1b6e87e32
SHA1 d93261578217e7c0a721999af85171ca9c2c94b7
SHA512 edbd4e12b669fdec61053fcde3ad61e1b9f3ff13928b08a0e8f88ae780ad0e107e9c6dcea4368e03b9574bea87a1999a66c0bdbc155c0ad67d5430f8afd569d5
SSDEEP 12288:mfC6Aj+TN5uixZN+8rKhUdTC/wE1MD0Ca5ZIXVGMTmkJR4Do07Y86gw5CtCjX+NR:6LOS2oyPIXVzSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 4fc43ec3f8a276aefde0bc84e2521b2ef55d4a3cf38e2e4a932099b795c9eeef
MD5 d98974a89f280fe8d759f151223c3afe
SHA1 75d2c37cf8e8558067bc21febecce1333bf2a0d1
SHA512 1fcef6117818124e735b2843a2c09460ff7bf4aa258d61415af6b1c8b435726d566696c770ae0cee75290c91c042c946199336de55552eec84b86618df908db2
SSDEEP 12288:KfQMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:Kf5SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 a90d99e9f03578b0dbb156d726a19e61534bdf5cb54bc6ebd2a08e61c1ff2927
MD5 dc1f93726adcfd77203b096b347a453b
SHA1 7d248fbdea6481fe491596f04a3ed8237d68f546
SHA512 9ba8d48ed696bfe65d56e5d27afd75118a82e11b54cfe8440590b054541c8d7d7ee56fee1342a29dcab423f57753de46315c4a1b74891fef6be024aad5019f81
SSDEEP 12288:7eBNUbTVO86UrMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:7JIU4SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fee514f23df0600d163e4957c0fe1efab3e4048bcfa4b4b79a3393806c1fd0cd
MD5 a8e8f23dbef4e1b3f169dd682d84f802
SHA1 ddc6bcbaaa7a27a2ed95ab2b19e9a8c9bc7f485e
SHA512 2215d5fe6b5d2043f6d57c5d3c38e8270276ac860b0bd5d3cf0d90946d1312dda382cf0799c364f01230dbc9c12cd7aa97963e9e7bc6582d43342861eb7a2b00
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THh:mQvGAdlCEL8c/yRNw5Cmqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 b75925c8aaf5c16efec82ca7a6c7ecae53d6a3b8c0754548d908466545ecbbb8
MD5 3ff842a9f62e486a887f87fe86f7d797
SHA1 221a1cfebaafa8dd8c72bb920fed7c101dfdd856
SHA512 3e2c67a618513783dfb4ee076ee54333e5915c8ec0a804c39197a2643d22f526319ec2cad2c4ba68e50b088352806f6aa3bbd36d0e1c6a389ebafeb817d0c039
SSDEEP 12288:QAwSfxL/2Dc34DLLmt0LDQewsAjxMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:ldewsAjKSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 56e4f11dd1cfd4fd0dfb156d4903d1123387275cbf20cdc145d2342230fa6aa7
MD5 402aead2605141c8f9f9e3abc7e9f248
SHA1 df34c705ffadec07adcfe8bf72985c75997d855b
SHA512 ea599bbd63f57ef1d6b376d8bc5837b19f05276ee358b4c9495cdfe3c549e2bc7bb0d6e13606143dda73d39c888556a30ccfe2cf18caf17e17f8087416227eb1
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHn:6UEtQevvqc2W1cpV2EI32n
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 291c8bea60904a0306dac5530dcae2d05f68bb7d20ee0abfa73ce90698fb6352
MD5 667c454812aa63094bbf64747a5fea3d
SHA1 952490c3adf67091d78493fb3c357a23e1b11541
SHA512 e7f5eb685bdd24581625c801c00cb22c7a85c8b1b3a03a12603c2db0eb8631d0871a219eb6f09b81161b3f71bccabf06e476ea799f600cf970058f101890cece
SSDEEP 49152:8CbRquA/m2yL5zifFiV+XenmE3/zjkQ/qoLEw:1oqHVjnmSqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 859d68a92e596d5c2d4be97d952ed5564abeef3ca59d2c41ef9fe7464b7274ae
MD5 ff81da38df7daf15669502237f2731a6
SHA1 accf0e319c2c8020ac5e4e8aff8e9f858570a122
SHA512 59fd182096f90f1a807b741c3e0bba98fdc2aa2ead2e6e804fc46aa2bc227f173196d46601a01605ef4c690a2b7f0d30ceff93f43dcc3a393b4bccacd314e02c
SSDEEP 24576:UAhGLJIFoiwtA5l7S53jSkQ/7Gb8NLEbeZ:UAMyFoiq5OkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 102467b6c7eb85595dd744a2c039f790e6a956f6abc4fbbab2eedd02b7978406
MD5 e9c8f5cd513dfd9945d947a930df981b
SHA1 09c57474834aed50f9091b0105c099a1b9a89472
SHA512 617cfad77974a3776d04ca33d82549f5e0d6e85c6e6be2f5ef195b235e779cca78d44adcf4301ee17e2351bd0ad823ed6fc20ab8142b97ea98c507a07db3aca7
SSDEEP 12288:bmw5HEjsChNVBFgl0WDm+CCMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:6wuoOWGSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 f61eb52feb6fd43f635a021e0628f61815f6a0f53f3de53b38a9adb5a1c59914
MD5 cf2593a5f5f12f6ee62b91fef26da5d4
SHA1 81c8b9ebf737ac091b543b3b82882b5ca6ccc0a4
SHA512 c7f588860fd54519a08c4956aa60732b73e530a0794d767d61e39368ef643a7a60739d094a4e0ab5809a5413d0e49c59a93fefc735bbbb081094ed3be6f0e7b8
SSDEEP 12288:vBZ1IyBMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:5ZuNSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 4a859f96f0da57ca067c76d38bd51ab7e3f192f340bd90e5af10c19edbab567b
MD5 561acd0b6c18c42fa53319968c338165
SHA1 cbcbc8fe6dad5444dcc713d9c9c2e0e56fa28661
SHA512 9a5f0eb02e89f06ba2aebf4ba55394ba2d55a857235e8509154f6a677d638dde91ec1d91718304bcd58a05322c3f99aea2138422b53ccd33ab98ba34b4ef7801
SSDEEP 49152:zfzabJ8llj+SWWi2mkx+X+di+kQ/qoLEw:4ui2Nqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 903737102fa5bd70cb0dda0ec7eddf6d533bbd35ef60f97ef0e07322c4edae4f
MD5 8e9c51aefe02a33b9b3aa38cda89c6ad
SHA1 953ddf288d3e9dd7c7835d3bbbf202a5dde90a73
SHA512 f1f9c0cd730ca6088469131882c5a2f1c244b87083a6463cbd41177c7e7ae95c29c87cbef8618d181e2ec1768ce55255c5a8db98495f125f7e868e9a350d6a70
SSDEEP 49152:Ua/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4TZkQ/qoLEw:WZ4K5MJabfsYNuqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

1436f7b9-1641-4f6d-9ee0-e6d8e70ca249.tmp

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\1436f7b9-1641-4f6d-9ee0-e6d8e70ca249.tmp
Size 488B
SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
MD5 6d971ce11af4a6a93a4311841da1a178
SHA1 cbfdbc9b184f340cbad764abc4d8a31b9c250176
SHA512 c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f
MD5 SHA1 SHA512

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 8191c9f68e5b182c98e34b978c0aee80b5a3ab046eabb94ee17f63c82fe75bfb
MD5 31702bc80b82aa44a73ea5ce54f6ce05
SHA1 fe157f1211f0744e69162640121d9b8ae45ffea3
SHA512 f839b692628bd0a31eaab9be15b7010ab472b9898f9668b42720feb3578f090029ed88236ce143f436e4fe77704234b4cc282d7f0bad8b22ca1ca6d53143f0ef
SSDEEP 24576:8cP4mcvIjkGOxhKP2l71SNKbrh/8KB1SkQ/7Gb8NLEbeZ:3P4m4IpOO67N8KCkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 b707b6c36a8bceceb091e4387855dbb5e0819af836f3ca387f3241eb0e7d6c30
MD5 5bb17254ea7f3ef13274ff3ff26ed3fa
SHA1 36b310e4739184a0c0efb48e756dfa5be0f021c5
SHA512 5ac009ff72768a217f21cb2cc74347492e34815fce3e800f07aed8738cadba542156f52374d5445043a432e38203c0a8748881415768bf091d3c27fb638cab33
SSDEEP 12288:RFYq0S5MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:RgSiSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 434d18419619d5639861cefc0b32ccbc98a94f9c3764b1eeac46b5d7e9059809
MD5 b9a9e7e601cd640d5ba482f36ac074b2
SHA1 e9045a5a67d1f0bd685f2469c9ec2ed39fa9fc16
SHA512 e6970fe2991b483e51da3a61f92fd95fcf45fd28c1128d8904119e6ef61ac817e3371d22c25c44bc2694a4ebef9be3a6fc93508a3912e21791950ba6ff875115
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 193KB
SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
MD5 ef36a84ad2bc23f79d171c604b56de29
SHA1 38d6569cd30d096140e752db5d98d53cf304a8fc
SHA512 dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be
SSDEEP 3072:HXm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4g2rJBXCy9enoN:HXUMCm4U6q62MEBi99g6JVCvoZhhl+No
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e72be1ba58e36792fcd170290faa27f5ff55b179a0df580254bd134202ed1575
MD5 310bd5ea4b096c9e03e07a29f7c54cf8
SHA1 de1c756b3964ac2f7511c165f68224a0ec8a9d37
SHA512 830bbd16b0df897a01b80a8909b9f5e09c9ff64992cdbd72c2ce691cd4a5bba560cb5c181cb0fbf40a9abc77131dcf91051e9d6d4e1ad5bc9a81d671829bf9a4
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 371B
SHA256 0d30bc9de9c1a27f6765a2a567a7e0e3e1b05cac79082716a81ca5ac8a023fb0
MD5 f4bf59ead4aede8f5c4dbab5c457a9f0
SHA1 feb3f6c239a73a649fe5535ad02432c208341367
SHA512 6470346b3357a16dd4297337e29b984dab43c50dcfe17720e39e2f5f3314210dbc0366c90e8dfc57870b443227905986ae7e072b80ff00129a0382bd09bdcb35
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 ebd2da748a976e7ad520b5729cfdb37079c61bdea15b1aed5b889aa469aaf0bf
MD5 a32bf56856271539ba07d557798cd9b1
SHA1 a583faca4512be562ec6aa36241917051a7196b0
SHA512 49553874e304a058a48789b69887c489a96cbc4a465434c907ed91f5866efafaa133ba342a440734ebb0652954a496e6d3a40fdb2945feee8f446fb14ee47b05
SSDEEP 96:knO4SXOnL+apCbIJI8iZRy7Di+6MsmdehOIf+jVlVup:kJSOp8Ii8syy+Fk+jS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 4KB
SHA256 23a441072dedaab35c80dc4ac129fa672f9a18f68b86cbff4dee047a3f216026
MD5 9a33701db6ada2ce2a83dd51bb5bdf47
SHA1 cf9158dab00f65a56a7ae44e3bfd559e953080ad
SHA512 20c55ebb747268bbe7200aaa8f66fce77ee8d16b28ca0d74fd27f6327b1d2ffdb988eb4bf5fde85a5d3406980f97e6416f649bf795852eb762d88bd6f148db60
SSDEEP 96:knO4SXOnL+apCbIJI8iZRy7Di+6MsmdecOIf+jVlVup:kJSOp8Ii8syy+FB+jS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 4KB
SHA256 0ad1d44304985e11ead01f950534b213aca7edc12e4b9dffa5cf7d651a9e70b2
MD5 a32723c26ea41a6ceff775c0933a76ca
SHA1 5353b9365085beac363c3e42f128b78a2815b663
SHA512 39b8ff800f7702e4e65be8b56bd2a8689ae5f256bf40a59a84e8eaec765df432cced180945251ed1c17046f9dc6e7a2cf60f8f99a8186916a3df71b9678da63b
SSDEEP 96:knO4SXOnL+apCbIJI8iZRy7Di+6Msmde2BOIf+jVlVup:kJSOp8Ii8syy+Fjx+jS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe578d6b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe578d6b.TMP
Size 2KB
SHA256 d42620a7fdbae714911a31c8722b263d71b711057f712de986f2d06ad8839be1
MD5 5e5978ea6697f2fa98c178e1de9adb31
SHA1 684c80971107bca29162174963b983b678569783
SHA512 2d136fd200b08a80134000fee154bb33bfeb21ff8fd345fa1f2c6a78b9560c77d3c8dd71fd6fd2ba33b441850108e599942a818946b06b3d9740712c5954025b
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 3563ee0633c07cc7b6801aa53714290e4602dbdb2287ca2d745f58f31de4d81d
MD5 7158b6916fabcaec3d80870d49a21619
SHA1 0eb18b86488b3e3851278d69da046386f911bfcb
SHA512 19e4520cb31785ff9940649f73d1db13cad34480d3b542a4849680f7569b016859f1b0d68c6387a01cc372433c7fff290b27e91c0e4f94cc4728a458b23b4930
SSDEEP 384:UDLPLelXm1kXqKf/pUZNCgVLH2HfkRrUmHGp1tpvhA:kLPLim1kXqKf/pUZNCgVLH2HferUGGp8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 260KB
SHA256 5d101082afb84af2e8ac45b398a2b7e958f9e334f523a16c9f9d016f60d5f549
MD5 08838edaedebfb2cf144d362d922dea6
SHA1 010d927b3706b9cd42e84c3462e883bbd4e12e89
SHA512 89e706fc3fc6a73ebd575ae2e81627203142432d5f418158d015847916c847b0fdbf3e9878a27f628cd7d0c1ba544bff9604a46a86d48fc44a6ba1e6ba726722
SSDEEP 6144:zKWKJ8bpkkfPi2mYimA1CZYr9C1ASNdvXCNpbMHtCMpS/:SJ2BmwA1aKI1ASNdpHtX+
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 7KB
SHA256 ff5edbf7d464a1c8c863604f7360f0e1edf040acbaa02556d68dadac787645a2
MD5 d2ddbbded542c01255b2a243f7ae21a8
SHA1 c7d600d82574e2f90bd2c72c832c45ef627a2dfd
SHA512 0c913e82a4cbb061c0447f77a2d47e20f2c608233022272092f4c40ddc4134838cf4f22ccf992db8a585408583068cc346250b90a93c4bf9531a762119aaad19
SSDEEP 96:Ls6szPlEavqhAxK3hK3kC0DBFE6vkZxK2fK2YAak/U:0vq2oRBLvKNh/U
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 8KB
SHA256 406100ab3c7afef05f8467e622648a61fee86ad98d57e8f5b949ad6d197706e3
MD5 06a9ca6d16e04e3be2315697d5054543
SHA1 667e4278b12e3871b0d502d60482fa237a420605
SHA512 fb29b0c93418dd28f38f57828fd75650d9791f14d3f333a74d217ab246b21b6ed804c8d60ae94ff04910739f7a84197af7a5fbe407f8adc487f9a4b64d76efc9
SSDEEP 96:Ls6szPlEavqhAxK3hK3kC0DBFE6vkZxK2fK2YAak/QUu3s9xK3BK3X:0vq2oRBLvKNh/c3e4A
MD5 SHA1 SHA512 SSDEEP

Submit Download

822c304b12041754.bin

Path C:\Users\Admin\AppData\Roaming\822c304b12041754.bin
Size 12KB
SHA256 7ea47828117f56a0c9c08865cc19a5fab778f21ac0839e6a804912e64e94de8e
MD5 12a75a9af938eabbecdd0eca10af5707
SHA1 fd1053d4c8067881e0c50d910da7c35faca5a317
SHA512 c9d5d62931d50a9902c8cffb2203b6b0d432630cf22e4eb8fb2ac082e3eaac97de36775deeae5899ecfe03b1f34fd602e11e7acb06f17fb899846e49cffb7c5c
SSDEEP 192:9CBVyMYrzCLMq98DgKmu1iBrhKrvMNbOBMxOUAbVJe2k4g2DaTyG:9CBa7myIhKrvObOB4OtB9g2+
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 7034cab3f665ea5c6a1ae5d8981677277d9611159b96b625e7b09fdefb8c8a98
MD5 d93ab0fe9334827c15bf36222ce548e7
SHA1 1ec426e9f6151592e53971e2d0fb2b67fd38f625
SHA512 7edb6d6edca22dba7a2a6856057f26f252070bfee56f4a74a1ad6873605069b6528153dba3febb14c10dc1b4eb1e3308ceb5ca93fe9cb7e72c716b8fd066b90d
SSDEEP 12288:xcMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:xtSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 624b114e0b9649bcc58e94f1453677600c81b92b6d66db34d1a7e44f3290f543
MD5 d316c3eb8c41399fcfaee642d988977c
SHA1 e5ce20b03c1a2ceba731c886ea0a14bb9fb42a4e
SHA512 247bb2914a2dfe74bdf0b772c267290d2c9d52e22a393e4abafa0f09e3a462c00d49dd8a6e9d2e9a653a27c3d5860c75c6508933b9d349280be65cc9c6c8acd0
SSDEEP 49152:Ya0h2GEkuAe73q3pp46zwwQGkQ/qoLEw:Ya0hNYG4Jwnqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.6MB
SHA256 6bececa9077b4b63aba10c724db5ca627ccd5977ff1ad3e53dc45a9c8f7b8c4b
MD5 f8d11ac94b03220578b2c09b716ec182
SHA1 a167d5cef572b55778f3bb0733315b1ac5073a00
SHA512 dfddba56ac189b03c29fe19bb1d25ddb62bcaad5cbd36abb6ccfad0f0c989ac96dedfb4c52b6a538d6ec38c7f6868b77619836cdb02c25d929835a4e19770761
SSDEEP 12288:GhbHjfXtMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:GhbHjPOSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 5d3a966fec7e2fbd64bbf54815d6da9f452f7591fc3a9dffdaa811732e1cf9c7
MD5 b1e8d79fac0e273d530a24eb6e8947d7
SHA1 a51cbddbaeac607c6f2a848c8794d8e41ba20802
SHA512 dd88f0571e26589955062720ceb12640bdf2f5198b16c2c264bc6df17bb07c24625dc4496341f364e3fa895bb302451330f3b0c87f447d573f16356bac3167a1
SSDEEP 24576:l3YgnJcRTk4yti+R5dpR/GSkQ/7Gb8NLEbeZ:lIgnaTk46ppR/fkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 038f350f7dc59bb301d6b2e911c21413cc63d42159eafeef959c9070576a3357
MD5 37eba2adc93fb74ac4e8deb5b708854c
SHA1 50edbeb5dab98fc2b1e74a387efcb7fb3fc9f88c
SHA512 10fcf7b029453f729a1b9f03aaac52fc9bcbaf8004fb92ed333d1ab5170e4d7db0c69c173a0a93b67621df79ecff797a3a0685a50276c5d20a6c0337ed2427b8
SSDEEP 12288:nwMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:nZSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 cac479ee51979cf05ddab82c955faa2e5a61034645440e392c1bca85cac71c79
MD5 5f5060c5bd09f22d8b461fa3333614e1
SHA1 22db1557a3661df73499a8ad69c0508b808ac02b
SHA512 76336c3ebad9b562c974adabf9cb87340166c0a193ba6c2dd4a9b2d19ff9eb948886b078e71171f8fe854df55ebbd8c18611e9171b09e71017311e7dd462f7d5
SSDEEP 12288:sOb9A4LWOsvAYFTXMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:RpL3UT8SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 e5744582c0baa6a1f73e07fa3b3aa7f52cbc0da422dbca899f1b3f9af6280622
MD5 4769f106a1536c77c9649af94e433dc7
SHA1 794c4bc25210e846a67c0856b34d3d66f34b75c3
SHA512 57bdbc8b1a93fff4b8853fa78ca7dcd103f312c6b116241fea5f6c625a7ebaaf863babbe6f0a6033c1191276c850e5203a394f4ecba259e347db199a299a71c8
SSDEEP 12288:epFtpOLMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:0OYSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 641b68c08fb7827fdfdf94411a5b7fd28e6a6184cc379328920f7993a1815cd6
MD5 c45bf841a01aaa6be01a1ff5c0233504
SHA1 66604a622461c6d30d39e3fde512356508063593
SHA512 d37a3450bcfdec7bb6d24d379da206762b8345e29f2f8bb343ab7559cf2afd1f383a82f39ac639bf243f7f4600de9e25d480b71740304e2ab5d5f83411186b1a
SSDEEP 24576:X7NM9YmZqmWMUkPjZM48Mv6bEhsdSkQ/7Gb8NLEbeZ:X7cBWMpPjN8DbEhXkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 79f88183e0bdebdae3c696496df94aeba46e0e7561a5198c1c695cc19b95b6e4
MD5 5b1fe5dadba3c54a37c2c891dc7a6a8f
SHA1 b00dfa84954689d6580236976dde9bd213d31f8c
SHA512 91c858cc1978a436fc15c2f3e7cc834197851c1f5e8138b2e826c707a406e65ed9380495cbcf5b908cfb2745e15444121c22d84ac562d01ad259acece4a40829
SSDEEP 24576:5W6BApg2YuyuNDYTabvcRvNYf8km1fSkQ/7Gb8NLEbeZ:5F2YuHNETovcvNYf8kmQkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 8bca56ad2f7956480942adea0ed83adb676418f2359d55f3b92d7ad0c7f95827
MD5 1d1ffdf1abc5eec597503b7f37b93948
SHA1 8b0a957f6484c9d4ed0562431ba8dd28ad7f0d6d
SHA512 c323107b48264a1f52c8afd3259e4ec4bd2ae8452b555c4ac20f406108fb7214daf723d2285b14c98752d73b5adb430c98558d44df8d12a1c5420cbd48688622
SSDEEP 24576:zAFs06+Omlf3NXEbToESkQ/7Gb8NLEbeZ:8Fs060lVXumkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 748a5dedaea124954b68f242947bd02eec6f6d7597f68da81cda6447e7da4c09
MD5 ed32119ec13309e45c94bcecd63c25ad
SHA1 1fdd7e47d94d9b8d6d2feb35f5021ff5b446c560
SHA512 7e7da8d30de393fa46c88b429603a832ada301f7f3786dcd10b87a31636f0b64d2eec710596a35bf6f448b00004e31d412fb17ea3764bc243535b3cacf200e18
SSDEEP 12288:kCJnJ5D3VkrlzxsMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:JJnJ5D3WtbSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 15723b0caf334d96f5a903b51678b4ba954697b6dc98d85d74caf574b68f0dc3
MD5 be0cb92c0dc60da10e3dccd152560071
SHA1 185fecca8cddb033e41943d4bb51983d2b410160
SHA512 9a92336d510462dea0dcd02874604867a3dc35f17632c7eb960c3e1a848ebf741021f184e1058eb03824204ca0a39ed4e93f6e5af58f5f26214aab5fc6dacba5
SSDEEP 24576:fEPohm6/7IIXdwcXrif7qQncjlP65i3VuGSkQ/7Gb8NLEbeZ:Yo06DIKdwc+eQnSt65aV0kQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.6MB
SHA256 3c12d04a2f4ec27bd4c0ff46088daa72d0a39195886dcc88db331c9dc33380b1
MD5 65c6847fd6d00e87b58003ac2de36e02
SHA1 ce0f862c65bace4995885a0e4fac4d151359dd79
SHA512 404e1e228a72988cf3d3c15fab61476d34828b42c8bb7d9f76497dd8e4e829b2eccfefa1d50b71d7795962734ad32ae7b74d2efa7cee204eabc5802412e6832f
SSDEEP 12288:yEP3RrfMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:xr0SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 b2abd5dc3ca6368a6f32fc453b7324f4d8529ccda1b344858ea8d0603c573a6b
MD5 2d4de6c95fd5a74dbaea82f8074ea5a9
SHA1 6fa23ec2fef0f78b13ba973f8ef9d76c3c4e8ac9
SHA512 cd5e2f56055829e2ecb73c36a044318028001a124e22a6cde2610549f7c481fa57506f2a8cbc358cd8a56a7e077cb4baba63f213c17598675b05f133a8490e3b
SSDEEP 12288:pjky9MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:pIyeSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 0462d2c7ed7b4a659f5cf7565b3a0d7d9bf7f7819cb45c1e92431286fd2df158
MD5 cfc248cc2e2aa42d93505c7f4db3ebf1
SHA1 d13a9d9950df13cbc48744e269640f1ea5002af0
SHA512 bd5c8c0da66df2a810448d7b9aaf4929fea18f06b15da30b757d328e8037540e1aa2a8f161a3a92dfafb5768390b358a43bfae411cdb22f5ea0b9c01965ba4c6
SSDEEP 12288:wFbMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:eoSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 0811bd3d21b287a7321929da6a68c26bace5d9880605a78561a21e65ef166740
MD5 62e6d4d9119731c7f356209a06e3cbe7
SHA1 ee95c5cabe0e83b9a030790c657b69ffc5a1f8f0
SHA512 ad622a88043415ba3dcfc87c1807a3b21d70083ef3e4cece7efbfd175fa9568c2464a8172999dbea3a4e6d5fbab336d54eef76f721b2996b8e00ae28952192df
SSDEEP 12288:zLQZb3C97GYnZMv5zBcKY97MD3EMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:vQ9MxZKdcz97w3lSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 38db80ae1a1eadc7a42027fdd030d709d9944db3dc06d2e9f21089f17e38688d
MD5 c7a3de6f7bfffbf736667c22391b3b04
SHA1 a705792a675c270945fbaed512561a8169096222
SHA512 7dc16dab574362cf3bc82f854bfaa57a3c41b693d30cf8c1b4799a8de8e571ff0877eabb6b86594e35abb2596a3d995930354902e7daf03712be24caa4be60d3
SSDEEP 12288:2yoKo2HRple9pxMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:2yocxApKSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 5a8f5b45662d9c6a6ca9b711da9d1f20df6a154d3c047b24308050ce0688a171
MD5 6edf2123fd3daf57c5a5556da001b38a
SHA1 128d3253a921de8135eae90f779eef8f71fe1cf6
SHA512 2461cb0569bfe5b3dc953e50708cef5541f3f9c8b7766b2a2e36859a7fb561db0a234fc8f8938d9ca7345dffb36cd84c00cbaba443fb6401eeb4eefb0d1078f9
SSDEEP 49152:SWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKDkQ/qoLEw:E0zuNIrqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Windows\TEMP\Crashpad\settings.dat
Size 40B
SHA256 144f23fa6e3092e9e119ff7a7b4b6c8a8f1f9c7b0e2a44c5bdbfe51f7d21cd7e
MD5 304b2380e5272f6b0b2cbb196822f1c4
SHA1 7d9ecc1e26990b05260a6d9da8f7bec621f87271
SHA512 9956ab27a441d3c1167480d004e0eedfa3c6733b7d8ff7ef9281ae1ad5f41576dcf816587481bfab3d3cd2465210e8965febd0115b50e85902894dcc48419421
MD5 SHA1 SHA512

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 cc68b45ef8909a4a23d47141b9a7906ff9e5faf3db6360207b68de04f2dbdad5
MD5 0b8d129af3ff480ca6e20768ef14b8b8
SHA1 0212312d4c301ce8e80d28a1cf58859e9a60a217
SHA512 4b1ae83e95c8558bb592c245bc56fb029ebbb29d4c04727510ea01c1f2d1cac925d68b16433eccf67d0a616aeb6364833f6122bd377361958c7521c964f13e07
SSDEEP 24576:e1QT7EcpfxR+N5AWAz3ooiYtjMqbHSkQ/7Gb8NLEbeZ:zTDxR+N5YzTfjMxkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.8MB
SHA256 783d147ce96968abb160040f433db7beb39cc78672b6afff473d824db201ed51
MD5 68c34bc116964970a65dd2271dba1818
SHA1 20da746f6322b9f721d53d02164643a6698c935b
SHA512 07a098c251688a6b6397308602eb1f10b511ca61388803b80144d6ae6f04aaa98512805c1ba1dac86967471738af30c0ae8ddc5d979b518e195672a3322d90fb
SSDEEP 12288:+/5T+RdOzMbFFTG+eEYNmSL+9MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:STMdOz0FFS+imSLDSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 d18ef2b980fe38fc7b3b65bfefdd583e26276a2f81a1e69daf7ae620081d43e6
MD5 4fd06c99b4c433b5bc924013dabb7e38
SHA1 b61be8c267fd0f55d98d52bc4f3fed640ece8cff
SHA512 21e161b2c7c4e3a4500e374bc721ed646cfd057c388e289cf77f751df3d3c8d4ad6227799fe2405f29dfb0e5e365a554d07640bbb8aa783d5aab336fdeb914ca
SSDEEP 12288:547XMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:M8SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 f3d2d4c4f099b5b127cdcf9cfaa9d8d470564fc2ed6af3e9012ead34ed8fd3b8
MD5 adcd35d6f8b8ed5cded753d02d014934
SHA1 4daacd0cb3bcf025224cb67b5ed6b791df86ffe7
SHA512 f35530b37de9ed15552c2be5f6d30a659af6442561184291fbd97a659574c4b454f0275592897b2e0dbde4b8b3bb5b26ea38798139c5a88de8a72f350c5badf3
SSDEEP 98304:A7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGL/QmvD/cTwY2h3Fbqo4w:aM7pTXexZPGzURnBh6gGLF+W3h
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/392-22-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/392-15-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/392-93-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/392-12-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/1692-158-0x0000000140000000-0x00000001402A0000-memory.dmp

Download

memory/1692-169-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1692-260-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1692-253-0x0000000140000000-0x00000001402A0000-memory.dmp

Download

memory/1764-316-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1764-230-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1764-299-0x0000000140000000-0x0000000140266000-memory.dmp

Download

memory/1764-213-0x0000000140000000-0x0000000140266000-memory.dmp

Download

memory/2224-36-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/2224-0-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/2224-1-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/2224-8-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/2224-30-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/2324-141-0x0000000140000000-0x000000014028A000-memory.dmp

Download

memory/2324-147-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2324-239-0x0000000140000000-0x000000014028A000-memory.dmp

Download

memory/2484-77-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/2484-56-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/2484-57-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2484-65-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/2484-64-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/2484-82-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3228-136-0x0000000140000000-0x000000014029B000-memory.dmp

Download

memory/3228-117-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3228-118-0x0000000140000000-0x000000014029B000-memory.dmp

Download

memory/3228-127-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3228-140-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3356-96-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3356-191-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3356-113-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3356-97-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3688-46-0x0000000140000000-0x000000014027A000-memory.dmp

Download

memory/3688-45-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3688-52-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3688-135-0x0000000140000000-0x000000014027A000-memory.dmp

Download

memory/3764-262-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/3764-339-0x0000000140000000-0x0000000140267000-memory.dmp

Download

memory/3764-255-0x0000000140000000-0x0000000140267000-memory.dmp

Download

memory/3980-288-0x0000000000920000-0x0000000000986000-memory.dmp

Download

memory/3980-194-0x0000000000400000-0x0000000000668000-memory.dmp

Download

memory/3980-203-0x0000000000920000-0x0000000000986000-memory.dmp

Download

memory/3980-279-0x0000000000400000-0x0000000000668000-memory.dmp

Download

memory/4432-34-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4432-95-0x0000000140000000-0x000000014027B000-memory.dmp

Download

memory/4432-21-0x0000000140000000-0x000000014027B000-memory.dmp

Download

memory/4432-20-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4456-111-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/4456-70-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4456-69-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/4456-80-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4456-108-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4488-351-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4488-268-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4488-274-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4588-241-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4588-246-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4588-322-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5064-186-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/5064-175-0x0000000140000000-0x000000014027C000-memory.dmp

Download

memory/5064-266-0x0000000140000000-0x000000014027C000-memory.dmp

Download

memory/5172-282-0x0000000140000000-0x00000001402D3000-memory.dmp

Download

memory/5172-364-0x0000000140000000-0x00000001402D3000-memory.dmp

Download

memory/5172-290-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5336-300-0x0000000140000000-0x00000001402B3000-memory.dmp

Download

memory/5336-318-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5496-324-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5496-335-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5496-331-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/5496-336-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/5644-341-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5644-348-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/5764-360-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5764-353-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5904-366-0x0000000140000000-0x0000000140216000-memory.dmp

Download