ab7c95bf8e772e2da67fc3c6ae5c5d2a8f81825f2d1021fe934f19a154bdf716

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 16:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
Size

5.5MB
MD5

570f113160f7fa4a98b8239c35fd0adf
SHA1

8d467f225cfa38cfaaaa88d8f6f3ac5161e7d4a6
SHA256

ab7c95bf8e772e2da67fc3c6ae5c5d2a8f81825f2d1021fe934f19a154bdf716
SHA512

c7b5c9cda08edab7103b039df1d996245d686bfc75c4f4d92ebc1beedeef9705cd71036bc3451f8b5f03540e81141f9678a3258fd9d38b4c867799e3f109e767
SSDEEP

49152:aEFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1Ln9tJEUxDG0BYYrLA50IHLGfm:QAI5pAdVJn9tbnR1VgBVmoPHn3

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 26 IoCs

Processes:

alg.exeDiagnosticsHub.StandardCollector.Service.exefxssvc.exeelevation_service.exeelevation_service.exemaintenanceservice.exemsdtc.exeOSE.EXEPerceptionSimulationService.exeperfhost.exelocator.exeSensorDataService.exesnmptrap.exespectrum.exessh-agent.exeTieringEngineService.exeAgentService.exevds.exevssvc.exewbengine.exeWmiApSrv.exeSearchIndexer.exechrmstp.exechrmstp.exechrmstp.exechrmstp.exe

pid	process
1756	alg.exe
940	DiagnosticsHub.StandardCollector.Service.exe
3300	fxssvc.exe
1436	elevation_service.exe
1084	elevation_service.exe
3136	maintenanceservice.exe
4940	msdtc.exe
3548	OSE.EXE
3644	PerceptionSimulationService.exe
3952	perfhost.exe
3556	locator.exe
4268	SensorDataService.exe
4324	snmptrap.exe
4632	spectrum.exe
2972	ssh-agent.exe
732	TieringEngineService.exe
3940	AgentService.exe
3236	vds.exe
1424	vssvc.exe
216	wbengine.exe
3788	WmiApSrv.exe
3668	SearchIndexer.exe
5288	chrmstp.exe
5808	chrmstp.exe
6240	chrmstp.exe
6340	chrmstp.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

Processes:

2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exealg.exe2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exemsdtc.exe

description	ioc	process
File opened for modification	C:\Windows\system32\wbengine.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\159adcb5c3a5208d.bin	alg.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe

Drops file in Program Files directory 64 IoCs

Processes:

2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe

Drops file in Windows directory 2 IoCs

Processes:

2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exemsdtc.exe

description	ioc	process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

SensorDataService.exespectrum.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

TieringEngineService.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

fxssvc.exeSearchFilterHost.exeSearchProtocolHost.exechrome.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005442a2ef6adda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ab67d2ef6adda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007f21c62df6adda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a841da24f6adda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f34d92df6adda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001bf4cb24f6adda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000926fd42df6adda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f68e124f6adda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002f55ed24f6adda01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7cbba27f6adda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000177ed524f6adda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000412fc724f6adda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000318b4525f6adda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe

Modifies registry class 1 IoCs

Processes:

chrmstp.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ chrmstp.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

4936 chrome.exe
4936 chrome.exe
6324 chrome.exe
6324 chrome.exe
Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

656
656
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

4936 chrome.exe
4936 chrome.exe
4936 chrome.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

pid	process
4936	chrome.exe
4936	chrome.exe
6324	chrome.exe
6324	chrome.exe

pid	process
656
656

pid	process
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exefxssvc.exeTieringEngineService.exeAgentService.exevssvc.exewbengine.exeSearchIndexer.exechrome.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	2316	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
Token: SeTakeOwnershipPrivilege	2488	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
Token: SeAuditPrivilege	3300	fxssvc.exe
Token: SeRestorePrivilege	732	TieringEngineService.exe
Token: SeManageVolumePrivilege	732	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3940	AgentService.exe
Token: SeBackupPrivilege	1424	vssvc.exe
Token: SeRestorePrivilege	1424	vssvc.exe
Token: SeAuditPrivilege	1424	vssvc.exe
Token: SeBackupPrivilege	216	wbengine.exe
Token: SeRestorePrivilege	216	wbengine.exe
Token: SeSecurityPrivilege	216	wbengine.exe
Token: 33	3668	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

chrome.exechrmstp.exe

pid process

4936 chrome.exe
4936 chrome.exe
4936 chrome.exe
6240 chrmstp.exe

pid	process
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
6240	chrmstp.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exechrome.exeSearchIndexer.exe

description	pid	process	target process
PID 2316 wrote to memory of 2488	2316	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
PID 2316 wrote to memory of 2488	2316	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
PID 2316 wrote to memory of 4936	2316	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe	chrome.exe
PID 2316 wrote to memory of 4936	2316	2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe	chrome.exe
PID 4936 wrote to memory of 2764	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 2764	4936	chrome.exe	chrome.exe
PID 3668 wrote to memory of 5836	3668	SearchIndexer.exe	SearchProtocolHost.exe
PID 3668 wrote to memory of 5836	3668	SearchIndexer.exe	SearchProtocolHost.exe
PID 3668 wrote to memory of 5860	3668	SearchIndexer.exe	SearchFilterHost.exe
PID 3668 wrote to memory of 5860	3668	SearchIndexer.exe	SearchFilterHost.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6036	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6060	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6060	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6124	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6124	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6124	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6124	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6124	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6124	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6124	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6124	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6124	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6124	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6124	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6124	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6124	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6124	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6124	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6124	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6124	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6124	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6124	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6124	4936	chrome.exe	chrome.exe
PID 4936 wrote to memory of 6124	4936	chrome.exe	chrome.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316

C:\Users\Admin\AppData\Local\Temp\2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe
C:\Users\Admin\AppData\Local\Temp\2024-05-24_570f113160f7fa4a98b8239c35fd0adf_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2c8,0x2cc,0x2d0,0x29c,0x2d4,0x140462458,0x140462468,0x140462478
2⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8be60ab58,0x7ff8be60ab68,0x7ff8be60ab78
3⤵
PID:2764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 --field-trial-handle=1888,i,16170347053932038233,12297710287355021796,131072 /prefetch:2
3⤵
PID:6036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1888,i,16170347053932038233,12297710287355021796,131072 /prefetch:8
3⤵
PID:6060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2192 --field-trial-handle=1888,i,16170347053932038233,12297710287355021796,131072 /prefetch:8
3⤵
PID:6124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1888,i,16170347053932038233,12297710287355021796,131072 /prefetch:1
3⤵
PID:664

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3200 --field-trial-handle=1888,i,16170347053932038233,12297710287355021796,131072 /prefetch:1
3⤵
PID:5132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4280 --field-trial-handle=1888,i,16170347053932038233,12297710287355021796,131072 /prefetch:1
3⤵
PID:5612

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4296 --field-trial-handle=1888,i,16170347053932038233,12297710287355021796,131072 /prefetch:8
3⤵
PID:1148

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4568 --field-trial-handle=1888,i,16170347053932038233,12297710287355021796,131072 /prefetch:8
3⤵
PID:5784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4488 --field-trial-handle=1888,i,16170347053932038233,12297710287355021796,131072 /prefetch:8
3⤵
PID:5684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4788 --field-trial-handle=1888,i,16170347053932038233,12297710287355021796,131072 /prefetch:8
3⤵
PID:5752

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
3⤵
- Executes dropped EXE
PID:5288

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
4⤵
- Executes dropped EXE
PID:5808

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:6240

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x294,0x298,0x29c,0x290,0x2a0,0x14044ae48,0x14044ae58,0x14044ae68
5⤵
- Executes dropped EXE
PID:6340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 --field-trial-handle=1888,i,16170347053932038233,12297710287355021796,131072 /prefetch:8
3⤵
PID:6532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1588 --field-trial-handle=1888,i,16170347053932038233,12297710287355021796,131072 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:6324

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1756

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:940

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3584

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3300

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1436

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1084

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3136

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4940

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3548

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3644

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3952

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3556

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4268

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4324

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4632

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1240

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:732

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3940

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3236

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1424

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:216

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3788

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3668

C:\Windows\system32\SearchProtocolHost.exe
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
2⤵
- Modifies data under HKEY_USERS
PID:5836

C:\Windows\system32\SearchFilterHost.exe
"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
2⤵
- Modifies data under HKEY_USERS
PID:5860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4460,i,6593821857742176458,13646536021844995125,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:8
1⤵
PID:5940

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe
Filesize
2.3MB

MD5
01dfdb30d02b3b9b35e572e13bc3df36

SHA1
bedae3c815fb30d6fede5581111d90ce40434baf

SHA256
16af37426feb7250ae1deaf8eae94925b59965aa9e9305b52f01a96e750aae2d

SHA512
a9dbc3671a562bc2da9921e1acdfcbdfaddaca440bf7af1b97d92f7a84c47bc07ac7812a9a5e90ee014445b37337c0c3e3a6555bfdd30b108ecf4ba70e293d6b

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Filesize
1.5MB

MD5
87d20fac49b25fff3ba775283d34b9f8

SHA1
659900cf7d7eec339ca946ed5ce2511b131f662f

SHA256
58923909aec310813b8114cccf28c489d9752deaf523b9f819240a3ff79b006c

SHA512
1dc3b5e83decef87071aef57681324b15ea9907cb11ad49e0a353a9e50049a8489e60441cc28f5bc906c953fc918340351ddd67cbd2651331d9cc689f8eab0ea

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Filesize
1.6MB

MD5
81ccbb4053093927ac15af5316d994a8

SHA1
c0a8eb985b1afafa5aba424556996877d41a53d5

SHA256
312e5cb3a6e82610702c0093c76075410d01863fac3a6c4b5d281e8573bff40e

SHA512
c17dbdc85f7797f596a7d86c212cc3db8909362da275c27c685a63b8f79ced3be367fc273172ce72da07377e05acc072b9f5befb5c8efe1a3e19dc415d0cdc58

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Filesize
5.4MB

MD5
451bdb3ae18532b7645b94b1601f44a0

SHA1
e5834c0c73c42325d7bfad91a46d5ca9f2d51949

SHA256
0c2b7f07bec18743124ac4c053e6bb58f0935845a69fbb140813d28c61e79c07

SHA512
4d40c320ce38cb17c9f8868351b158b254e4dc57cf24dc30e5d38f9e720c2001db2d1db0156bd57ca817452a03b1c392a6a53cca4da1809391af3f62e963968b

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Filesize
2.2MB

MD5
7c63ba5f31480d84df3e107cc2349263

SHA1
f4d801878b2ad145a4d423fc48f04dbeadb9cc5b

SHA256
37531d2719ada84a4733636331f7d064c99cd8392fec2c351c12da121c8d2a1a

SHA512
105731727181601f93c37f20e6f4813c7bfb75fa68903396afd065c75b1f4f5cdf5f26f9891cbeb907c41ad94cca40bd5ea0c0501817639cccb0b7a9cf6ee037

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
e646991f9b7863013f4543e5deea2d49

SHA1
7d3ab1c249b15c5bc5761baef819fa96b043539a

SHA256
0cc277125b5bd55a7c42e32f351b5bce3ca6003f28bc0646db5bc6b9b5135c07

SHA512
8b7b264f086ee2d1c1ec1199307d6511ce964890e84312a1c12c21a0a1fac24d6bf005a2ded820ecae3b51b58229a8ce724e98e40b03e1f93d3914948025a76f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Filesize
193KB

MD5
ef36a84ad2bc23f79d171c604b56de29

SHA1
38d6569cd30d096140e752db5d98d53cf304a8fc

SHA256
e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831

SHA512
dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
95df65c8e5c16efa2d6c5cd94896353f

SHA1
cdbbcfe826339d773bdff906b2f321bc45fb3325

SHA256
f33a3b3bad3f761ccdbe7bd544b0feb1d0617370df6552395c8e911a6ed997df

SHA512
ad34d0a09ab216acba64762b1493f0beb88228e6342d30e8ef86221e19292d62b43a11dd0ca03e9172fddc27f993e7a229e16dc8b5da57e07ab6433eb5330dc0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
356B

MD5
bf91efa5d1815fa4b74bed8b94e9ca88

SHA1
a747117b1af32518db7aa75ed969f5160ff22cd9

SHA256
36656e206669731ca319783299b9fd3be0e4e38bf680b8954f0d2d957e1d86e1

SHA512
dedfc1a91ceb3a598e9fddcae78c9f6395150dc52eb711a0c1f6fdf21ebe53675e03bc367f1a780f48e730ac9bf91ded45b9c64b71efa8faa4b80a58a3a5f721

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
af3eaab11835fb6ab382539508b28e59

SHA1
fe5d9178f0dc7eba64889dcfd906ca8b4deabe13

SHA256
6847d230db3274be402a922ddbe5984d06d7c23a5b4b949a961e15c37a35302f

SHA512
5201cfbe6ede07053532632cbb4345513dd8ea92f652e41eac258355d2a25afaa696d8bb8d5a7895c1a858fa36b9065c6b2905e788fea3629d53622d844dca87

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe5820b2.TMP
Filesize
2KB

MD5
c4d12c24a85b7e1aaf85cad983fe7610

SHA1
00bcb6e962cbc5a3d88689ec2f8c15feda6ff7fb

SHA256
6568b506f3cb4367abf414e66e1e93a4d4e40339dd3a2a1d5ded1f1907484337

SHA512
0d45cd5f36424147b7a67d4f154539d9ddde285cb363a139c5922814e6073cf731d61902a7eb84e9ac6547bcd52e65b023a2f97636072db478ccd04495a59aa6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
16KB

MD5
d7ca005a559934f0acac16c7c010743e

SHA1
10ea49ab9223bea1f71e2cb5f51557660509a896

SHA256
dd059addce92514620388dc7bbe0c758ae098379d6f924758124e2e34ed3cc91

SHA512
77fffe852016e6daab933ab11011757a287b6b3012ec302c8a970c3be1e230881d6a18d0434c59c4157b09af92eb775924d708fc1d8011477358fb7d06d159e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
260KB

MD5
66078758826bde60717c9a901dc314a5

SHA1
0a091ddb0268d115e6a220e9467f27245486f0f0

SHA256
dcd84792d5fd5d7132c860728e89405ae045f40b000447b5f04ab77bc77fa50f

SHA512
a55966770468a317074bb2c6238d800de0ee472e9a869ecacc4e33fd1a8458521ea16e1260d22872206e818ffb69d0b9c88ff216b40d5b00dcefae823f8f8b27

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Filesize
7KB

MD5
41ad11155b3495a76b7bf4ac9d336a87

SHA1
1e5dbf23fa1106bb2483526f082033c91dc5bfc4

SHA256
926dd0b48995e64d75da6088e9aa0c0e0e95c79ad7fb57b156db957df6482e45

SHA512
c79f5a612b053163915f8c11ea9c6ac46686fce562e753ebbd9310bf320e285148698c0cc0dec1aa18a61a3e67b7bc233e6b92b9878904a194451b8a284adc36

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Filesize
8KB

MD5
aaba21330e37aa4060deee33056d60a8

SHA1
8a26742ecfc3c187c9d16b6ccecf1f40d23c0be7

SHA256
ab0c600317533edcaeb82857b975fa2125280db6b25e290ed7f80dad120ded3a

SHA512
c353dff6ed914b4ba28e9341994cfb913b64414609d31f4b646dae5fecf7c0a761508b70bfeca9eda10fd0c23f4f0bbee68847ff0b5c9fdb1b93209131fe6e5c

Download Submit
C:\Users\Admin\AppData\Roaming\159adcb5c3a5208d.bin
Filesize
12KB

MD5
59154790322b564d12a2c0b83d4e8b8b

SHA1
1aff36a2d2e5c3066e07480b329638b1da135a76

SHA256
6e98ac0b4e8a25223d33df21ce2faaae824bfbe53c710e39137c4bb15a3c2d64

SHA512
2488b5cc00ca58fdf8767e052dacfee64271e112d725cf9d7926b2142c75bb41d9fe69a71629b199b9179225582ca67b136615e84bc4ec20e3046091d4541f59

Download Submit
C:\Windows\SysWOW64\perfhost.exe
Filesize
1.3MB

MD5
ea85f08ce4851a1b0b439227e37b85f6

SHA1
225db60157c393b93a5065b5dea18fa62b30edc5

SHA256
d6fbc534264723eb22464511e624f85a244f009ad3f0213e1a7f64164598b827

SHA512
489445bf16f0c2e33f32d2716b9926f7502ba87962d9f7bb6e9db9f0d3e05479081eae1961ea267db736806566c43aa5414708f59ed9fe9b93830d2fd9a7f790

Download Submit
C:\Windows\System32\AgentService.exe
Filesize
1.7MB

MD5
72f166fc39a808f36cc9eeacc99027a8

SHA1
251771b890b3af3c8cf6c26b6df05986ac1ad0b7

SHA256
c2ca8bc3c2feda632dbd8c40c27e6d068aab2ebb99814724f6ea5b323c97b9c0

SHA512
223aa9c6cd6f13d68268dcf2c4d0d348b57372aa9ed3a06a6d1ee239d762c3a5c26a97566d20044ae4097048d9919535b44d51fa795e7f54e1b106ec710e650a

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Filesize
1.4MB

MD5
0022577390a84094a8be838444fdf30e

SHA1
24fd0ef51aed102a2ba6e7eba1e12db6b5684162

SHA256
ef90556ac7a08b23a3652e4f4655d5ff49c6ce5272e662152438815280b2f620

SHA512
66d12c765a24ea114a7c20c86e93431d1261bb6d90866059f5293f3e4269304524968ce719f940d7b847f51b7ec47c9b3e39386bc9253874b6cf00174a617d3a

Download Submit
C:\Windows\System32\FXSSVC.exe
Filesize
1.2MB

MD5
57ad4515d4e994e3deae47fb5ed6a964

SHA1
9373ab566f332df716264412c429279f20b54cba

SHA256
b9f3336a882a8bba434b9283dc69b8580f30e12969bcdab00f20ea620b241ada

SHA512
3859254a1a00300be41d995e2d7435da07088244c6bb417f51e333ccb671d7df9fe29efbc98b27fb64060652033d9a6f90fa2ad56883fad08eef3af4e0c1af20

Download Submit
C:\Windows\System32\Locator.exe
Filesize
1.3MB

MD5
f78d403f241da3d8b891f8a3c709fbb5

SHA1
a1f293e56698f44dd649d7c730c454e131fae5f4

SHA256
d6bc639ebf52d1069ae9e06fe853c552115b1b306d806bba634160af00fb9c0a

SHA512
9f887e3d3e906665abe9f9866b1474fff24740b3d036af33e2c039c7141381d0e7b39e9ecef61117620e705bf2b8655e3307bcd113243350148fc5dedadaaf61

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe
Filesize
1.7MB

MD5
d485ed4381ea9eab8028a56450d69565

SHA1
97336143056fd9cced69ab160beca3703781a1a6

SHA256
66320240cdca280d02c409e566e3a4c7bfb78c181bbd59081bdbe536e065a978

SHA512
e91491202f1e09c8f62b9784f7a798c26776aae83005155384778b0e94e08846967b1b50d94b47a16d087227d39226526e11e2593d796cf4be368e86fa5a23c0

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Filesize
1.4MB

MD5
b23a44997d31c842887fdbe66d630c38

SHA1
c421c1c2951eb14d84a56752a1ac22d04d972abf

SHA256
ca7be95f4221a328dbaf6b36ec469e33a29f90b10edc3946dce30884e6605d9e

SHA512
db9fae4a4680d729f25a826a340e566a590791b6f7e6988715a00f1f97d52bfbe1835ba259a59f0450f8f4a43fb6ee141d8c673f645a7b932a71484458043dd4

Download Submit
C:\Windows\System32\SearchIndexer.exe
Filesize
1.4MB

MD5
be4376aee5cc78a4c36cbb4cd2277dae

SHA1
86ffd4017ff6fdcc09499e08bab76fd94c6e5526

SHA256
7a10780144927d1b9b4027737d02569afc2c3c6dd9559482d296d89dd8cd23fe

SHA512
94420f18b4753d6193cd37ef534acc3e3a57dc6b79cb9fbdcb5e1269404d547aea6757e5a8baa7199e2d596065f83135ffe6ba59816a1f7164d5baf2a6807f71

Download Submit
C:\Windows\System32\SensorDataService.exe
Filesize
1.8MB

MD5
99280f2b9b03ee3ee5af2b2fb29a9fa8

SHA1
00ad3cc42cd05d3581eaafbca562cf5db6a36ff7

SHA256
5f3032c2624df88dfa1a9a3b4dac9bb0c3d959efac42f61fa32d6ffa4fb6014e

SHA512
83a9fd5bc3651daeff78699f9e8777b0375542227c894b58ac359c402cfdf6b76f6b917e70b39274f705141aa842513507d1ca4094e6fda40548bf4ff36037c2

Download Submit
C:\Windows\System32\Spectrum.exe
Filesize
1.4MB

MD5
73ca9df2260ec29d71792f414da43b83

SHA1
33189d0f2fb971cf53165c8d5687a45888c293f6

SHA256
1e2fbb37c8e8591f58d241e1e9a067b5fff4d561574743d97ee1f3e8b5e99520

SHA512
b69e19256f79530d8b35469d1c8cdd1750105d1481ff5617ed8c7ce3b9a30332aaf2a38874a74d9343eb58c9ef89253d3b2128d75da33616fe46dfcb8a94713a

Download Submit
C:\Windows\System32\TieringEngineService.exe
Filesize
1.6MB

MD5
1c15a8921546078c12e744bdbcb9b2b7

SHA1
b8d54c6eacd4dd7a5ca660c5225881b664e03db7

SHA256
3b36279d76b8e1e39700048351ee05807137ef19439fce5646d6a6f22d024ec1

SHA512
c98fe47dae211cfb98ceca71c05c75459b288c391e88811d455c33c3f03f801603e458ef08a022a91b20354b718d1a2ba37783bafc484f7c3a2c4cdf2a67b490

Download Submit
C:\Windows\System32\VSSVC.exe
Filesize
2.0MB

MD5
837b0a29aece2f4d5656444657e558d2

SHA1
1d750af430612081cae9a2a531a81679545d6437

SHA256
51f45c824afa79418e9ef9f81f4887402e9e7321438e63f57f27fbd52639df07

SHA512
982dcd8fd8bfcc7b008a9074010a2dbf2938075b43ce8a933f3db6fa5614693aa53f127ffc5e4e5df18f79d168af66cc1415721d9223e6248c57502918476d3c

Download Submit
C:\Windows\System32\alg.exe
Filesize
1.4MB

MD5
79926e17b1b44ced8e2c433965c87b28

SHA1
f63e7f05684b57b073137eaa9288c23e756018c6

SHA256
bf1ce6ff064ce1b961bbd6b36c3d6103cba178a8a57ccd86aabc32b1de308c76

SHA512
360f040b0ee9c5a8d45e0644ec5a91c63e832fda5f5f63f882fdb9e257f108d752eea718673a8db675e436e5ed21e9e63d03684385b10959335f54b5d41e6926

Download Submit
C:\Windows\System32\msdtc.exe
Filesize
1.5MB

MD5
2c2b0f08171f43edd9646d7e888427cb

SHA1
08ebe94d456dfbe0e00fcbbc4a199e6a52b9a4ea

SHA256
60754600f095ad7bccac27476dee5da67d15dba4536436007dd3c8fd342e649f

SHA512
996c573c8817a0049192e53302c8d8c3501c726d3c166b68e2277313998bba1040f789a31d2453ebdc17b5a537a3c735fcebfed9645dc9c0fb87aa3749a053dd

Download Submit
C:\Windows\System32\snmptrap.exe
Filesize
1.3MB

MD5
afd3eacbe52485585683fc98dc817670

SHA1
162d97bd5d9b89f54bb1275829d829ab59a46b68

SHA256
b3592dc9ea67087886eaf7692bfb5a9571c0e912a4d17b6f0dd9388c4f811415

SHA512
7347cdd754681377d9761300ba44828ab9a63e6710bc032f167e621d8f8fa8e131da938698d52688e2d2c43843e7d906921ef24bf90ce11a5258237e16fd473d

Download Submit
C:\Windows\System32\vds.exe
Filesize
1.3MB

MD5
0fc9b87dbb9354b64f5f9629da3d957d

SHA1
3ecbb28d160c5ebb298fc7761adb742cbb8c05dd

SHA256
fe9508bc286ea2db84f61990ce656f0edbb5f6c37bef12273f9567ad1c27d3dc

SHA512
5e8bf0e7bf61cf3ba9a11adbaa7c96f52e6cae9a003c0bd81b3fbebae8a7c65a7801ecd3d2d9903be684cfaeae474d2e30d61d3a3ee927844aab06985fb2590c

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe
Filesize
1.5MB

MD5
d240107a7a763c4695a472e53bef61cc

SHA1
8a0499f3069c92a0083694996cab24a4dff08632

SHA256
b8c6d4618b95f5bd07fad071ee129a3c93d70c802ea4afa013e9f8e6fa70d1e5

SHA512
d82165d6790f13496a0c6d76aa881985cf9bdd6b5e709235fcbfa80e08b6d8755588a81ae9532dd60d2a756ac097f9a21e75fed03cf72433efb7d3077f3ab942

Download Submit
C:\Windows\System32\wbengine.exe
Filesize
2.1MB

MD5
e70c12c68527f5e56ca763c19998670e

SHA1
3429b457e05f0708de0dd9e6b143ad206d08f5e6

SHA256
fd744ec36a68a7bcd3cf0c3eb500b0fcf74be8e0512a89d54c6f0b8e6a86bc50

SHA512
3ddfb2f00eb6ab935f90acdab87b64392f5b407c32898d22d9d3d58814774be3e67de20ed9ea18b8a772bdd80e014433d712027e671048df6c99c91110b98535

Download Submit
C:\Windows\TEMP\Crashpad\settings.dat
Filesize
40B

MD5
de12892063f81f60b11c0497ec332fa7

SHA1
ccfa0530f55d277c3fe6d75260088ae08d5b7616

SHA256
afd8ccad757251c38eecbb67fc9f41af5aecfec62b521b229c5b17e17ba05eae

SHA512
441e809f431b7d1715efa1a6eeda910ba6945b9529a6330cf964a1d8f7233e97893e6eac6758abbeca4c61d315829371fa2e2fa02a5b838d1fb79e7a43b6d7ca

Download Submit
\??\pipe\crashpad_4936_SOEDNWAGZSYHNJJW
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/216-395-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/732-388-0x0000000140000000-0x00000001401A6000-memory.dmp

Filesize
1.6MB

Download
memory/940-54-0x00007FF8CA9C0000-0x00007FF8CAC89000-memory.dmp

Filesize
2.8MB

Download
memory/940-45-0x0000000000580000-0x00000000005E0000-memory.dmp

Filesize
384KB

Download
memory/940-648-0x00007FF8CA9C0000-0x00007FF8CAC89000-memory.dmp

Filesize
2.8MB

Download
memory/940-647-0x0000000140000000-0x000000014016D000-memory.dmp

Filesize
1.4MB

Download
memory/940-52-0x0000000000580000-0x00000000005E0000-memory.dmp

Filesize
384KB

Download
memory/940-51-0x0000000140000000-0x000000014016D000-memory.dmp

Filesize
1.4MB

Download
memory/1084-82-0x0000000000890000-0x00000000008F0000-memory.dmp

Filesize
384KB

Download
memory/1084-335-0x0000000140000000-0x0000000140267000-memory.dmp

Filesize
2.4MB

Download
memory/1084-649-0x0000000140000000-0x0000000140267000-memory.dmp

Filesize
2.4MB

Download
memory/1084-88-0x0000000000890000-0x00000000008F0000-memory.dmp

Filesize
384KB

Download
memory/1424-390-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/1436-75-0x0000000000510000-0x0000000000570000-memory.dmp

Filesize
384KB

Download
memory/1436-455-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/1436-336-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/1436-69-0x0000000000510000-0x0000000000570000-memory.dmp

Filesize
384KB

Download
memory/1756-40-0x00007FF8CA9C0000-0x00007FF8CAC89000-memory.dmp

Filesize
2.8MB

Download
memory/1756-37-0x0000000140000000-0x000000014016E000-memory.dmp

Filesize
1.4MB

Download
memory/1756-644-0x0000000140000000-0x000000014016E000-memory.dmp

Filesize
1.4MB

Download
memory/1756-643-0x00007FF8CA9C0000-0x00007FF8CAC89000-memory.dmp

Filesize
2.8MB

Download
memory/1756-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Filesize
384KB

Download
memory/1756-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Filesize
384KB

Download
memory/2316-43-0x00007FF8CA9C0000-0x00007FF8CAC89000-memory.dmp

Filesize
2.8MB

Download
memory/2316-38-0x0000000140000000-0x0000000140592000-memory.dmp

Filesize
5.6MB

Download
memory/2316-0-0x0000000000440000-0x00000000004A0000-memory.dmp

Filesize
384KB

Download
memory/2316-11-0x00007FF8CA9C0000-0x00007FF8CAC89000-memory.dmp

Filesize
2.8MB

Download
memory/2316-6-0x0000000000440000-0x00000000004A0000-memory.dmp

Filesize
384KB

Download
memory/2316-23-0x0000000000440000-0x00000000004A0000-memory.dmp

Filesize
384KB

Download
memory/2316-8-0x0000000140000000-0x0000000140592000-memory.dmp

Filesize
5.6MB

Download
memory/2488-18-0x0000000000440000-0x00000000004A0000-memory.dmp

Filesize
384KB

Download
memory/2488-635-0x0000000140000000-0x0000000140592000-memory.dmp

Filesize
5.6MB

Download
memory/2488-629-0x00007FF8CA9C0000-0x00007FF8CAC89000-memory.dmp

Filesize
2.8MB

Download
memory/2488-20-0x00007FF8CA9C0000-0x00007FF8CAC89000-memory.dmp

Filesize
2.8MB

Download
memory/2488-22-0x0000000140000000-0x0000000140592000-memory.dmp

Filesize
5.6MB

Download
memory/2972-383-0x0000000140000000-0x00000001401C6000-memory.dmp

Filesize
1.8MB

Download
memory/3136-92-0x0000000000C00000-0x0000000000C60000-memory.dmp

Filesize
384KB

Download
memory/3136-104-0x0000000140000000-0x0000000140193000-memory.dmp

Filesize
1.6MB

Download
memory/3236-389-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/3300-80-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/3300-78-0x0000000000E00000-0x0000000000E60000-memory.dmp

Filesize
384KB

Download
memory/3300-59-0x0000000000E00000-0x0000000000E60000-memory.dmp

Filesize
384KB

Download
memory/3300-65-0x0000000000E00000-0x0000000000E60000-memory.dmp

Filesize
384KB

Download
memory/3548-340-0x0000000140000000-0x0000000140193000-memory.dmp

Filesize
1.6MB

Download
memory/3556-351-0x0000000140000000-0x0000000140159000-memory.dmp

Filesize
1.3MB

Download
memory/3644-343-0x0000000140000000-0x000000014016F000-memory.dmp

Filesize
1.4MB

Download
memory/3668-397-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/3668-650-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/3788-396-0x0000000140000000-0x000000014018A000-memory.dmp

Filesize
1.5MB

Download
memory/3940-215-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/3952-345-0x0000000000400000-0x000000000055B000-memory.dmp

Filesize
1.4MB

Download
memory/4268-587-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4268-352-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4324-357-0x0000000140000000-0x000000014015A000-memory.dmp

Filesize
1.4MB

Download
memory/4632-382-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/4940-339-0x0000000140000000-0x000000014017D000-memory.dmp

Filesize
1.5MB

Download
memory/5288-546-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/5288-594-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/5808-548-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/5808-715-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/6240-549-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/6240-584-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/6340-569-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/6340-717-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download