7dab481ea558ac13939994a97df6b0942c706c5afd5fd2623bd0172d1a05191b

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 17:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
Size 5.5MB
Sample240527-wj2xjsdd87
SHA256 7dab481ea558ac13939994a97df6b0942c706c5afd5fd2623bd0172d1a05191b
MD5 45935fb25cb9855c0080dcc145c7cecb
SHA1 534f54223f4af78451b9159f7a4d6ddaa814cfb1
SHA512 80f7ad25fa59b97392330c6f4b4e01608516f3d416d07c0fd1e518e0af2d780ee2576dbc26023aba475167ab168e17021cff526a784f754698393c31b26525f3
SSDEEP 98304:WAI5pAdVJn9tbnR1VgBVm3U7dG1yfpVBlH:WAsCh7XY+UoiPBx
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
3844	alg.exe
1728	DiagnosticsHub.StandardCollector.Service.exe
1044	fxssvc.exe
5048	elevation_service.exe
1144	elevation_service.exe
3460	maintenanceservice.exe
1504	msdtc.exe
5012	OSE.EXE
4044	PerceptionSimulationService.exe
468	perfhost.exe
1752	locator.exe
2972	SensorDataService.exe
4904	snmptrap.exe
3832	spectrum.exe
540	ssh-agent.exe
1476	TieringEngineService.exe
2020	AgentService.exe
4152	vds.exe
1652	vssvc.exe
3572	wbengine.exe
4564	WmiApSrv.exe
4200	SearchIndexer.exe
5024	chrmstp.exe
5440	chrmstp.exe
5640	chrmstp.exe
5716	chrmstp.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c1331ead4a48edc7.bin	alg.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95203\java.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fa6450745fb0da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133613062872386348"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000256631745fb0da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fa6450745fb0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
3412	chrome.exe
3412	chrome.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
4284	chrome.exe
4284	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	116	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
Token: SeTakeOwnershipPrivilege	1496	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
Token: SeAuditPrivilege	1044	fxssvc.exe
Token: SeRestorePrivilege	1476	TieringEngineService.exe
Token: SeManageVolumePrivilege	1476	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2020	AgentService.exe
Token: SeBackupPrivilege	1652	vssvc.exe
Token: SeRestorePrivilege	1652	vssvc.exe
Token: SeAuditPrivilege	1652	vssvc.exe
Token: SeBackupPrivilege	3572	wbengine.exe
Token: SeRestorePrivilege	3572	wbengine.exe
Token: SeSecurityPrivilege	3572	wbengine.exe
Token: 33	4200	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4200	SearchIndexer.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe
Token: SeShutdownPrivilege	3412	chrome.exe
Token: SeCreatePagefilePrivilege	3412	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3412	chrome.exe
3412	chrome.exe
3412	chrome.exe
5640	chrmstp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 1496	116	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe	82
PID 116 wrote to memory of 1496	116	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe	82
PID 116 wrote to memory of 3412	116	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe	84
PID 116 wrote to memory of 3412	116	2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe	84
PID 3412 wrote to memory of 2676	3412	chrome.exe	85
PID 3412 wrote to memory of 2676	3412	chrome.exe	85
PID 4200 wrote to memory of 2208	4200	SearchIndexer.exe	111
PID 4200 wrote to memory of 2208	4200	SearchIndexer.exe	111
PID 4200 wrote to memory of 4320	4200	SearchIndexer.exe	112
PID 4200 wrote to memory of 4320	4200	SearchIndexer.exe	112
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 4512	3412	chrome.exe	113
PID 3412 wrote to memory of 3344	3412	chrome.exe	114
PID 3412 wrote to memory of 3344	3412	chrome.exe	114
PID 3412 wrote to memory of 3120	3412	chrome.exe	115
PID 3412 wrote to memory of 3120	3412	chrome.exe	115
PID 3412 wrote to memory of 3120	3412	chrome.exe	115
PID 3412 wrote to memory of 3120	3412	chrome.exe	115
PID 3412 wrote to memory of 3120	3412	chrome.exe	115
PID 3412 wrote to memory of 3120	3412	chrome.exe	115
PID 3412 wrote to memory of 3120	3412	chrome.exe	115
PID 3412 wrote to memory of 3120	3412	chrome.exe	115
PID 3412 wrote to memory of 3120	3412	chrome.exe	115
PID 3412 wrote to memory of 3120	3412	chrome.exe	115
PID 3412 wrote to memory of 3120	3412	chrome.exe	115
PID 3412 wrote to memory of 3120	3412	chrome.exe	115
PID 3412 wrote to memory of 3120	3412	chrome.exe	115
PID 3412 wrote to memory of 3120	3412	chrome.exe	115
PID 3412 wrote to memory of 3120	3412	chrome.exe	115
PID 3412 wrote to memory of 3120	3412	chrome.exe	115
PID 3412 wrote to memory of 3120	3412	chrome.exe	115
PID 3412 wrote to memory of 3120	3412	chrome.exe	115
PID 3412 wrote to memory of 3120	3412	chrome.exe	115
PID 3412 wrote to memory of 3120	3412	chrome.exe	115
PID 3412 wrote to memory of 3120	3412	chrome.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:116
- C:\Users\Admin\AppData\Local\Temp\2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-05-27_45935fb25cb9855c0080dcc145c7cecb_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2c8,0x2cc,0x2d0,0x29c,0x2d4,0x140462458,0x140462468,0x140462478
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb1a35ab58,0x7ffb1a35ab68,0x7ffb1a35ab78
    3⤵
    PID:2676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1892,i,7957906103108448819,17485580981885462764,131072 /prefetch:2
    3⤵
    PID:4512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1892,i,7957906103108448819,17485580981885462764,131072 /prefetch:8
    3⤵
    PID:3344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2208 --field-trial-handle=1892,i,7957906103108448819,17485580981885462764,131072 /prefetch:8
    3⤵
    PID:3120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3008 --field-trial-handle=1892,i,7957906103108448819,17485580981885462764,131072 /prefetch:1
    3⤵
    PID:1352
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3016 --field-trial-handle=1892,i,7957906103108448819,17485580981885462764,131072 /prefetch:1
    3⤵
    PID:528
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3612 --field-trial-handle=1892,i,7957906103108448819,17485580981885462764,131072 /prefetch:1
    3⤵
    PID:5220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4468 --field-trial-handle=1892,i,7957906103108448819,17485580981885462764,131072 /prefetch:8
    3⤵
    PID:5380
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4464 --field-trial-handle=1892,i,7957906103108448819,17485580981885462764,131072 /prefetch:8
    3⤵
    PID:5388
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4492 --field-trial-handle=1892,i,7957906103108448819,17485580981885462764,131072 /prefetch:8
    3⤵
    PID:5396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4908 --field-trial-handle=1892,i,7957906103108448819,17485580981885462764,131072 /prefetch:8
    3⤵
    PID:5512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 --field-trial-handle=1892,i,7957906103108448819,17485580981885462764,131072 /prefetch:8
    3⤵
    PID:6040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5076 --field-trial-handle=1892,i,7957906103108448819,17485580981885462764,131072 /prefetch:8
    3⤵
    PID:6056
- - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    PID:5024
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x29c,0x294,0x298,0x290,0x2a0,0x14044ae48,0x14044ae58,0x14044ae68
      4⤵
      Executes dropped EXE
      PID:5440
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:5640
    - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x14044ae48,0x14044ae58,0x14044ae68
        5⤵
        Executes dropped EXE
        
        PID:5716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 --field-trial-handle=1892,i,7957906103108448819,17485580981885462764,131072 /prefetch:8
    3⤵
    PID:5376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1892,i,7957906103108448819,17485580981885462764,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4284

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3844

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2948

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1728

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1044

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5048

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1144

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3460

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1504

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5012

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4044

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:468

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1752

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2972

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4904

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3832

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1484

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1476

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4152

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1652

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3572

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4564

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2208
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 aa22378d5e35c77f4576a12afd9500b829688a2987f92566a124d2f40f797fe7
MD5 cb06bea66341b2a478843eeb1612e343
SHA1 7d0590c33d48dec52daf4263769acc5d5528e3b3
SHA512 bb75e6e6637e217446575443b6422648b0109ba07a569eb940d16226fbdf41aad83a1d7dec518297de44727ee9398a51239bcf37d735d933ad1b2a8acdbbe2a1
SSDEEP 49152:QuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5kgDUYmvFur31yAipQCtXxc0H:QPfTqi90bZU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 4244c4d3734264b848197a494908f4cdaf2d77cfb1ebf2da803f64ace763b8f5
MD5 1e5a5984050513e9ca80edca0e7ac2d9
SHA1 9b0ffa57ea2724b23b43db9a69718f4c12393ca6
SHA512 7100c7766de6c395066cf61d535158120acf37bc66e2aef27e1e084596bb3cb057ae82901ff465953980bfb930fbea44faae8eaf64f6b775e8c5ae2284ab5e11
SSDEEP 24576:giTnBsuEJ8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:pSuagDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 a6072f7312e43af65a76b8bdbcc1fd5a301ab90771dc8c6009cf56653513be65
MD5 79ac3c4a0b5cd889c9926e973a8c2355
SHA1 50e29eccfa2e585536212df654b41b822db4ffb8
SHA512 0f462513e76c981cd9db7003e6b1e3f413e3f593099dbf5449b4788b5c3a2e37fc01fb521a136f36689e8afd1ee04fa796d183d37560f1941fcbaa28277b300a
SSDEEP 24576:d+gkEHfh4Cot8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:EgkE/SrgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6af8ac679ed29788bf007613cddfd17e1357af0f308b504b503c3a3b4b7d8eba
MD5 926085248ec2d970dad013a3738f8283
SHA1 59d21640793673b86dfeaa667223df028b6d9e19
SHA512 67efe7c8c2610e5cf644826c2b3a68c777349ddba7c819263c84b5849ddd48b973c658db059e09cfb7c929453ad215e0aa757d1f23c7207203d597090e4d00f7
SSDEEP 24576:eBpDRmi78gkPXlyo0GxjrI8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:qNRmi78gkPX4o0GxjEgDUYmvFur31yA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 72b98635e8fff99f91d6a7fc4bf4ff46d463369e81bb603497782d4a0f644492
MD5 43f4d92bdbef1bc103fb26051e5023a0
SHA1 2d8c4bc3ff2e5138b02763649f18f9ad6142ba9b
SHA512 53fca526c41c47edb6b6da0bb5977ef84f148d8c69c54d962cd2b90b7a46170bd3a0f599907a927e505e710ec3cf23e46c2e6c8460847f796b6f50fb212625bc
SSDEEP 24576:GLOS2oyPIXVt8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:2/y8gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 b55e0a8cfb5de0735220c39fc154748680914d1f923e83d270942e90ad22ab1a
MD5 124128403fbde450328931ecf8c10001
SHA1 16ff0f98fb5b844cbacc127942bdd10e08759340
SHA512 13b38d6ce8050a518ec0f265d7a041c9fedf52a60ec5761a7a0080b26bf7f3c778f44faf911091772317cb780d94c2aea9dd7ddc19c22d9176dee1a4c02eb8be
SSDEEP 24576:itL8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:cgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 8149d9e6d5a56995f8400317ef880ca13b19061c35291e4c0978799ffea69f49
MD5 b2c977ed7c2423684080d14afd696089
SHA1 3c9d868bf7129a0091143b3335a2e76540684036
SHA512 b787875518847e229c8ce2cf297b59482b2664c2ba022729de2e2689e04adec4a717998156e65f967050efd8dc0defb30b310f26af3709ca87cdd0f793c8cc35
SSDEEP 24576:aJIUG8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:aJIUGgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 bed6babcd27086b4c7d7d07b1dc879331c1263a20a22b492057d63b96d6fd044
MD5 20027dc2c6d18b38c821f5744e6da246
SHA1 03a246204c32b5d421ca022fd358493cf80be720
SHA512 3dce5de039b0d68c663647c3b3b7be6cd2147b955b7948a6f9a275707204418df2554007d30d0c17b2333e11cf2c977a615d33c7f745c16e6238fb9e31902911
SSDEEP 98304:VQvGAdlCEL8c/yRNw5CIU7dG1yfpVBlH:ivyEYc/y3w8IUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 ed8ef253c73fbb0e660a0e20033c4ae070fafc5e14268b771f39b5d60100be39
MD5 234cb4373addc6e5eae91d8d40ae9dd2
SHA1 868aabec3a74f7d16b477a23985d390dc68fba8a
SHA512 5b4bfacc99d354a1ff5024a65143a13198f76e0dbe1f5d744645064bb48273920042f3e52f475ef74a9dfbbd72961123dc0a35d95a218b51c279dc7b0610a60a
SSDEEP 24576:y7ewsAjg8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:gljggDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 00821077bbf905552e7f98aa0f84772ae1dac7df0e9da688eb250fd1f203895e
MD5 faeeb07004792cb2ed5899b55a080a5d
SHA1 93aa277184cef1a3bc234f8357dd6d6b541464eb
SHA512 87a7f8d052efd4a7abfd47f45769f29c1fba123857ed2893635898dec9c00c463ce5ab7b10f7b01f1e515d698f41acb74ccafac3377061c5f90c5740f8589c97
SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHRUoiPBx:gUEtQevvqc2W1cpV2EI32R
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 671794bdc1a3c374a2c91f26a7a1f53f2c9407c1fbbdb28d7766303b51304581
MD5 bbc2b05d2da4be8ba5ffec8cdd555387
SHA1 8c4d78a6bc5fc34b9528d47fc51d0441bb3465aa
SHA512 18b7731ba39e6b69f5c01e512bcd025a8ea2aa57f676429a8eb7943ffa95011c0c29f2ab7e20c2a1a0bcbe84acd0d0a75f22a752138da5990dfeedf5a3b17f61
SSDEEP 49152:vCbRquA/m2yL5zifFiV+XenmE3/zAgDUYmvFur31yAipQCtXxc0H:ooqHVjnmsU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0f006146e45a0954981da72194abc81e80f3885cf9bcf517aa51e97680b20d38
MD5 844220d2fe8d7ffc67e96a862b970718
SHA1 b1970e29824251f6b862be79518c3a1e0ddcc3a0
SHA512 372f5e878d5889864e39bb7ed94e7531aab0edb9e89ea859fad7a37304722d904a0af3dc11708e565e0801abd8fc8ed5f366aeff81b95d79a78a7ddb5dd491e9
SSDEEP 24576:MAhGLJIFoiwtA5l7S53d8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:MAMyFoiq5NgDUYmvFur31yAipQCtXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 ff97604a25056d5299988bdef25d078fe0abdde15c0930d7ae8884bd05453826
MD5 cde1b60ea3bba76412dd7c38627189de
SHA1 0518cdaf98b9aca2837bcfca332d95ba45cb1749
SHA512 1d6236abf9bf78086e6a9ab46eeacf5937903afe152c969e71530ee6989b7d0a786e349db825380abb0c25afdaa3601ae0223d8441b6444e6ff7d197e40f27cd
SSDEEP 24576:rwuSOW88NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:rw9OZgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 994ad97138d48701b9e08c624445de782ca0cafdabd8ffe0cc32df1c20eca669
MD5 1f23d3c2fccb7650d6034fab51f99015
SHA1 a67fd34057af2936388589462d9268bc93a2f6b7
SHA512 9e340c3ef266146a0168c8c8762b54cbc85775906cc4103ad2a077475a468f1a4bfa016152c73be09e9cbdeef9b44600898f17c9f228acc33201abe3fb5c4cf5
SSDEEP 24576:fZu/8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:ogDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 eb95982d7843fc2f76fe3037d686a951bcc170484b078bc5adfef33825262579
MD5 46e2ec7a412432e5c2a150f3544e7d1c
SHA1 147e949e63c1b8a77c927f5f5067c65e7af591a4
SHA512 831f0f76492fb55b17495a923f1c4787041a4875282cfddad1317a9da982285ddc1bfe3c338eacc30a9458ec0b6280b172dd8f0759d970048ce9b9b7f0830600
SSDEEP 98304:FwfhY7g/rLd7yYA3awr341g0U7dG1yfpVBlH:n78yh0UoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 e1a899aeb68e145ae65c4c56f9d7f206894c0fd6abd649f1ffb2030a78e8b0a9
MD5 32b2c7f053ed5e7c6c04c930a3a0c6ce
SHA1 19aa99ce703582351f5b8082d9d3ad5fd0498273
SHA512 96891620c09408a1cf362943558c2e05675b59eb0f45e81cc2dac86463c052b222254fca545cfa9d20e9ad70c1d1311df766524d40fb60b401817008fe8111bf
SSDEEP 49152:1y7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxggDUYmvFur31yAipQCtXxc0H:QmYeyxHjWjMTZU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 468e9fefa4357757d15021f4a2d81e3a2c62ad4e3c9541c64cc29784853d5485
MD5 5c278fd2c7eee61a42cbe0ced5acf139
SHA1 858ef02d32fe2ee7323539d23c937e2936b7ecdf
SHA512 36547bb45faf185c19f0e0f443671025486ea185521a00edc602d015b65073eb02d776ab64e17ec8f9edeb50155892e2004dac12390f0df7fa58e7e63402d5a2
SSDEEP 24576:AcP4mcvIjkGOxhKP2l71SNKbrh/8KBn8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:LP4m4IpOO67N8KBgDUYmvFur31yAipQi
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 be7c1faec23a46d25250554bdeb10d8f49b4fc3176004c914f34cd0c8caa990f
MD5 ead5c5b65992ef68cf2eb90edd0f8846
SHA1 e23f95767614ce9830147ec6ba7b0b5ca18a8101
SHA512 043645f254ad57e33e6968a60ad645630ca980de7555b410631fbc597bdee7402e1f4b15e7d522537f01304ca08400fd58a69609a125e7440dfa3f1bb33d1077
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 193KB
SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
MD5 ef36a84ad2bc23f79d171c604b56de29
SHA1 38d6569cd30d096140e752db5d98d53cf304a8fc
SHA512 dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be
SSDEEP 3072:HXm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4g2rJBXCy9enoN:HXUMCm4U6q62MEBi99g6JVCvoZhhl+No
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 479c81f60e03f73c8e547516d70a85adf3a1707b2ed409ce21e0b34babdfb5c3
MD5 7970f29729affd21d7c2ad97ba9484e2
SHA1 8ca8385b1226e7d7f9ca0b3eb060368b3e635049
SHA512 e82bb0f4161a0089b9dff2b5fe26316d84f9297b534d751ca1c9e3613042a499742f4fe84e26810d6e2d62edfcc3111f1dc18a03c26252a618c9b87bb0560681
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 6aa10c3f674888cd8b327f1bcd44576d9c1030a5d7d235f5b582b597f41cf0b3
MD5 48c4137cb54994cbbfc3bba24a6c74f4
SHA1 c4b04207e7b11098e8dc6ed95fb944936850b94a
SHA512 fe8ad48361504db35d45b2e6fbfc9003aea017f78c324a2d3a47d06ad6a8662823997fd579884951760622975eae7349d8929239a4d899e3aa799bfbee368455
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 9c20c7b1560b49dbfc65cfd1cb3cdad38ae9570d0a8f3df15e51393153024c4f
MD5 653f419770937d81ae85c868426fc239
SHA1 2363e0cf0d93d22ff49be5a95835ebc3414744b7
SHA512 6acc15409c376f3c55e668b0a368fde274cd77d62d8469617a1a1c16a7fb523aa696b6ce0ae733852b42eaa03088907f2fbd68d2d3c1b1318af3039fea46b786
SSDEEP 96:WGghkcXTdalc22MhkJeoXVh8iZRy7Dx+6MSmueOBOoXgS2MEVMup:WFycjOmJJX38syh+FeRgSPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe578414.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe578414.TMP
Size 2KB
SHA256 bb4c89650137cd1ed35cc2299d77c4b282072dd0e43418272d06a04c82c3733b
MD5 056cebe70ead07d8acc38f1ddd50556b
SHA1 906167b4de443ef14bb095ae8f196165c25d17e0
SHA512 ba3fc43ac1e418b5c33910a18aa115755a4350b946b3a6589b77361b95f5f109973c3a072b4724ae9590f8ef2cdbe52ad0958be62d7d08ac46fd90dc3de00fe6
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 2933c41a2588f0737ebe14bd1bf6d3440d1cd7595216f8e0000bc1efe9f0f61d
MD5 6754b8724c20f6d42646dc2b561a4abd
SHA1 3f88e920068a26ded1e3f5f950924b912826ab19
SHA512 d1cf10633209ba3fec7af64694434a9e97414917e251f88dcf38a07193415bcac253713e2878da43d926cc1b28861b00a651c62959c50995fe587671adf84785
SSDEEP 384:aabQ7pLhLcEv1rXl31kXqKf/pUZNCgVLH2Hf9ctrUduHGfus/cRVn:a0Q7pLhLZdzl31kXqKf/pUZNCgVLH2Hw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 260KB
SHA256 a2b1bdf078002aa9c8aa10562761e3d23f0d8e3700a6cb82595f25f18113b05c
MD5 ffd8b1a0cafc3f9b0b4ced7d09224931
SHA1 3221dba0e7b7dc2dcdbc2b14f87799d6dabbf86f
SHA512 9fd753c09beccdc6189f73cbcae0df50edfe7d4038f726a3910da4d776c65379c2de05f92571b881f5e72246322a91270bcf87b892e5c9a473ed200e6cd3dae8
SSDEEP 6144:UJlamLOGrJZiwb+vF9te35nfC5mgMatpT:k9OuJA4+vFu35tgMypT
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 7KB
SHA256 edac6203e47d9d2ccb5a5cedc1a0ce1e285aeaf3c703e6dc68623aadc2551dcb
MD5 2415e00c367e8e91ff6a8505782b382f
SHA1 fc626ac83c3163d79b4b9423ec5b8acdaf2eeff0
SHA512 f51bbd58c1bea59c0eaa2ed69101a4f4b6ad67ff564436697d1f308a401529ee66abc0ac16270b744291717d4ca43bc641dfd653836e50b26cafe6946c273acc
SSDEEP 96:1AdfQ1g6nOXMRwK38K30iAZIj2kWpi3FfpPoOoOTPzwK2zK2ruH5c8Sa:L0Xnx7I89Dd78V
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 8KB
SHA256 58eb8aa8c6d3c2d949fd31218d1852ef5cc921ba8f3465e936f4aac85f088549
MD5 9f594fcd048c0cc6ad87acdf3931d805
SHA1 e8910747d6e84845b5c71ccc2e1dce95f770bfa9
SHA512 506b9e067ea1e99a7b200ddc162df17014464ffa592a50121453e667c25c5b25c2f100dd5e217fb9e72f30441968bcbfdaa6a17041a6e7b648a676a51bf6519f
SSDEEP 96:1AdfQ1g6nOXMRwK38K30iAZIj2kWpi3FfpPoOoOTPzwK2zK2ruH5c8S/bVoTiwKi:L0Xnx7I89Dd788o7AQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

c1331ead4a48edc7.bin

Path C:\Users\Admin\AppData\Roaming\c1331ead4a48edc7.bin
Size 12KB
SHA256 488812cdb616a0e3a71ba8c405c83fa90c9a61d9afb7d744cf5efdec2a208fa6
MD5 05d042493a4e533b24766451152f6003
SHA1 a16e1c41a5e5f8818e7583d344fb709df83ab48b
SHA512 0af29fa9a6519483c18e098fb863a75878ed2dfcfef012b14cbe5edc0fea12a916283e261b8066e617b0aa53926fa6633ea10dbc2b44cdaec8baa9f38299cd04
SSDEEP 192:istaZCW8sawLUnGfhhEcPyPIJ8Grr3e3/q0BKH9S+bHgbwK7830zdYV0dwlDGZ0:gZCW8yUGfLP7rru3FBCSeHg0m83WGlt
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 d40d40121378ef4e8cd076911fbb59d4865eb5507badaa545f1be85dbc08e88c
MD5 7ae25b0373f21dd0c53c3e17a18d7942
SHA1 2566e6a8019b81e4bee737e2767962224b31bbf6
SHA512 bf3eddcc906580e8ae2b94f7d32e99ede3a07d85fedf933acac85a90fc3de70ba9c993a9de3eb33fcd1b5af55366c145f779da789bbc326e37f1bcfa4d6c1634
SSDEEP 24576:Af8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:AfgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 c2c8d428434aec39b5eff140784a1a227a327200148f73e146cf476507f72551
MD5 3132321eb63c41de42e25483230cff9d
SHA1 29b3679dd230255180f5dcd823175ac4a506df7a
SHA512 18c2ea0138d6b3f0685b7d20f7142ca68a4f883e6a6fcb33050674b01e8573ba69b66acf493f4038afd7b472031069dbdbc7699d83c734c7e55d879ee83c4edb
SSDEEP 49152:ua0h2GEkuAe73q3pp46zwwQVgDUYmvFur31yAipQCtXxc0H:ua0hNYG4JwRU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 f614aaa60699f8c4a8302ab19885cbbe946f290891ef357d771f06395f26aad7
MD5 93095632a4db1a30cfeb0cecf75dec17
SHA1 e16eccaa5760f3db52d27d6606c69ba3cdfe82d3
SHA512 7176b0a7be6aec98d48464e59a1fc465b82ecf2801b5991ce26cef7a4a6d230aa687344f17603abb311c5f881c823dee9c43a0ebfaf35b62bb10838b3e02de77
SSDEEP 24576:ShbHjP98NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:ShbHjFgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 c4ccad36e5f182c7afe09646e0214fcda0d1335f92e80c9aa46496e920407111
MD5 cd1e7aa213fd0825f880d555aa6d4bd7
SHA1 7ddce27000693d24059891d79dbcccefc679911b
SHA512 b53b2d4ca2eb28eabcf91fff2cab16deb7a16b4930c7c95b334fb21de14e24380f64b5720230c90ccb4b7a1445cc8b5144fd2fd7fe561923f6dc6e76f32aaa82
SSDEEP 24576:l3YgnJcRTk4yti+R5dpR/88NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:lIgnaTk46ppR/8gDUYmvFur31yAipQCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 edd357acd7bfd06397bf0ec19e165fb553ea90ccb8acc5134b0d7fc6bfb7e41b
MD5 ebc014be13e67fcb66808828ee0abab3
SHA1 d12b7ac90f12cf5fe5400936297edb6e45a5437e
SHA512 717ec6557da2e164d4b601f53e3ac501cd057a2c161ea31a6deb36caf84b623221c2942687d42551d7c896ec32acf34493874bb1c292961aa5ef4c75cb9a3f67
SSDEEP 24576:Tr8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:TrgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 ca801fa1a0b1ca38b0ab665b15c684820256e7e388d334c469fd7fd0f93be996
MD5 f7a46b22ba57ffee594375cad1e92a74
SHA1 059b4985e8ebd98a80c5dbdb2b9e33cdefdd2e32
SHA512 3d343c9e0e8bd7e49025df3932b8b0dc955c47ee76c0bc51f47022ee34e4fd8e8d79b13d25670b4a915e023234360733b8326e2e759fd3d8c3b0b9c0d4fd39be
SSDEEP 24576:ffL3UTq8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:ffL3UGgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 9737b120537f736f976089257d338c9cd6bc28131be1a15d6f94423af1c1b816
MD5 c273277e0f03ead43a9692fdf3f62a0f
SHA1 39f48c6b6f6ce24f7de22e62cc416f2c2c583446
SHA512 0065f9ca74493081d6f35df19090462c6677ab7bc2abcf8affba9fe2c5f9758e7692cf538e213150075e0ca4e2889f3351319ea37feb1ed8b8a89658c35f2982
SSDEEP 24576:IOm8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:IOmgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9655f4d42c66ec4f823990d9ffa832709af530417dc7e69cb03661446f5156e5
MD5 8af006925124494d121a7c169c866cd3
SHA1 90e806127a141ee54a5b356579850748e0c19ab2
SHA512 8f78ef155dc25a728db53961fc5194111ac15c0d522a4cb166417c077ef2eb849498cd0825349e49f47021e2c436dabe97d758b08541a799a941b4a899f65d78
SSDEEP 24576:s7NM9YmZqmWMUkPjZM48Mv6bEhsP8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:s7cBWMpPjN8DbEhEgDUYmvFur31yAipZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 dc0094255a1b64f88c422ad150b2a58fecf4e27587630388a6864fd1c6c3507f
MD5 25be00a8cd33bfee9d8d722849419f41
SHA1 f025ccd6c64671618ed833c26a7c3610e32e5e61
SHA512 ec8e22ae1a06a0e15c795ecf2fb38e2428bd85864b94ae949bf8b6c768ecbb19af7fd40d4c7704887efd335289c6e541af7916667b5a63c14024a733577120a1
SSDEEP 49152:6F2YuHNETovcvNYf8kmvgDUYmvFur31yAipQCtXxc0H:z6tCf8kTU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 87479a19963825201ae8648b07d662005131cf11c707753d5be2a7189c954560
MD5 9405fc211a02aee38fc41be950b587d3
SHA1 51c07f09869703379890df4ce6c04123408882d3
SHA512 af91e6e8f36d2e5850e3b78b549537844212585707b56177c0fc17490e2526da1de2598f630535861d8314cebb8e7803e19d3b5e65bc7cde045f70972e983cd8
SSDEEP 24576:TAFs06+Omlf3NXEbToy8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:cFs060lVXu1gDUYmvFur31yAipQCtXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 eb37d2003358e87840638fb5aedfbd68ea0f3f852aa3c0f4bc471d4851c7026d
MD5 cc58461147945f3b6d1c4592f560f23b
SHA1 60a0831bc32264a54338ff2ec434797378b6fe36
SHA512 6013888b2f28ab6cdcf3c7c1a47d3e2110457fb78df4a59d9e8a21328e738d52eceff4f686377389d6e46eaaa1df66d0159c0be26e92d4fb7f2dc8f449180390
SSDEEP 49152:IJnJ5DGL1gDUYmvFur31yAipQCtXxc0H:6U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 986ca96a4040a9abe45651505443c1ab3752ced94fa274b0fd9edd59446ad88f
MD5 cb94a94fade920fd2367eff080468b47
SHA1 482caa4647d143cb37be0da9c37b7faaf2d4839e
SHA512 66f4970e58ec875c94c3b6c1c7a47515ca703aff72112f128de5737c98e2a142d8af7733815cbbb6348db8f1e331b141716c6c7a1d4b437c49edd5795d560434
SSDEEP 49152:bo06DIKdwc+eQnSt65aVTgDUYmvFur31yAipQCtXxc0H:0wU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 3dc5a6f60431cd58badb966af82f21ebf18f00b98cb0fe380dd3b5244ca54590
MD5 7da9554810e1bcad84ffae9e4dbbabf1
SHA1 920af65b9e421746301c9e7c854de3df87d2d304
SHA512 a579a3a5608add2db447b742ff64d6b232caab9cc77f07d1127bd4c84a0c283d6aae9a514379fb179e38646c93931cf0268c69a0fa3f4ff100a68a5a81d22b5f
SSDEEP 24576:4BI8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:4BIgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 421384706e09da3b7d0eebdab8b865ba211d67f1d5b81826af25ebe69796342d
MD5 7e5a0348b467a0f3584c54c0e06a2854
SHA1 34eb58a5b7a8b793168613b02730180706a93930
SHA512 48e8284c3683525d9e363e50af80916bb1e7bd4e04080ceea9707ff73748fa4953f171a9968144e2bfbdc914d9259552cc2de0416315a01efba61a3513529d7d
SSDEEP 24576:HIy08NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:HIlgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 ac053f66f5f68287d0e627f44c8eb5b4e742a73fe13cdf3514c7c096965d511e
MD5 5feca689bb897c55fc03a57d5649cffb
SHA1 cdb4af6438261d6ecc3db89948c0895741be67df
SHA512 dcf8a8490dbdcab88f1915c0c4b49b35feb1e08c1c2ab037f12cbd54e48bb2271b566963b0955aaaa8ff9f75b4e8b1fbd8af0ee82ad8c9d9b3d963b670b03b6e
SSDEEP 24576:D28NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:D2gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 e1fb8f5a22a26d8fc86f9b6af0a2d41fcbf4eb2b18051d7b8c9ebc6e170655e1
MD5 798a7e6110e5bb05bdab568ad33dafb4
SHA1 a106e5f56efab3c1e11139e478bb52837ba7bb70
SHA512 5e568864ced60a9537c3c5f050c8886a7f02d0198c0ee8a5d623023a3db1a787db74636aba80bcd3078497b5a5392a5663367f9568e6387ced3d971fcf4b8897
SSDEEP 24576:FQ9MxZKdcz97w3X8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:FVKXXgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 643386832ff6ceb47a6af8e438d88efc6123c45429b55463a9f7bdd6f450efe1
MD5 8ee2c560dccb59bea766d2ee2df221ee
SHA1 888d365ce95ce2d69fc1859924174b73fc39529e
SHA512 00332d0a28871d5d902054f2eb8873efae8dd4a7bea673e5e1bdab3f5c6a53f183e678baf59798cf0d7f4377e111e543c6b2ec2a7f9b3039e92f66b28c0af747
SSDEEP 24576:fyocbApg8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:aocbApggDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 c77ab0a29eb6c81037324629fddee37e52cebcd88002caab8609638f13d24ed7
MD5 0c7551ef14cc9b2c2eb738b0dcd00f1a
SHA1 92560019c685e3b818d1b285fab00e6146a2b09a
SHA512 4cf59594936b3e6b01b01c6ef23ef2451ac4bb3a5bbd3b78c06e3d71636a873d4686cbd483a63775049eb5258f1dd77fe9a5bda1353cdd3c301d2bec6f9416e5
SSDEEP 49152:DWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKggDUYmvFur31yAipQCtXxc0H:D0zuNINU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Windows\TEMP\Crashpad\settings.dat
Size 40B
SHA256 f022aa4752d0400339634741871e82f3bb6e1dc719e1ffe9b3987e457c01bdc0
MD5 295c35172675c56d85b3271fc5adbaf7
SHA1 fc8f7052aa2fdfb84e7cb6bf027db403bcb8cdf0
SHA512 15813f64afc1d8f3fb24db561e3b68c8efcdfe45dd0768d53f85b32e72352c0f22240b9f4156dfa8feb88fde664025c75d3fe6594c957aa961fc010496f8548a
MD5 SHA1 SHA512

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6c7a7242a875b5a5efca026c826ce81335dcafe1e55da1740b75e353ecb6698a
MD5 9f45d87f46765655408926816717cb68
SHA1 0685d075b29fe87ffa561421094ceeea21e118d5
SHA512 30ee137b89c22f0e9042abdfdacc65eae9893c1de30fb932f92facae91f20943ed365ee0fc371ceb9f32e8f9ef11330967c47d5d4121c0632d46444e0a04e7ca
SSDEEP 24576:z1QT7EcpfxR+N5AWAz3ooiYtjMqbI8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:uTDxR+N5YzTfjMzgDUYmvFur31yAipQi
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 98149b75f8f5b66f9c4007cda903ba8930d7a74358177b24c90d32911dab258b
MD5 6fea79136a5ca9d2b06637f64c671fc8
SHA1 24a362858f53d61c0c6b0b9c86f93d0f2892521c
SHA512 8ff357eb8d2c209035ccf44f7fab56dcf00385de2ede03a04cf6fcc3d6110804a3860179e97291d4d74329d5495c697186d37b8204372eeea9a3b7e360b76032
SSDEEP 49152:o0K+kmSL9gDUYmvFur31yAipQCtXxc0H:QcU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 087e035e49a81522484088dc0d5325f943cd0c596347ca7021d306e66be641b1
MD5 927d1e4f2f3db98dc18378050ae87218
SHA1 7001de179c3b403350d71acda13731e22f988569
SHA512 16dc8cbbe54a484bf9c55332649314d0d6118b8468d3860706fbb1ded769b3f59c8cb215fff6e77e945d2a0766defdef189154a0c9411b2c3b69e64a07d16e82
SSDEEP 24576:Vq8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:VqgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/116-8-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/116-0-0x0000000002100000-0x0000000002160000-memory.dmp

Download

memory/116-6-0x0000000002100000-0x0000000002160000-memory.dmp

Download

memory/116-39-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/116-35-0x0000000002100000-0x0000000002160000-memory.dmp

Download

memory/468-341-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/540-355-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/1044-62-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/1044-77-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/1044-56-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/1044-74-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1044-79-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1144-630-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1144-87-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1144-81-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1144-90-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1476-359-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/1496-548-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/1496-25-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1496-13-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1496-24-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/1504-338-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/1652-361-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1728-54-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/1728-50-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1728-44-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1752-342-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/2020-223-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2972-610-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2972-346-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3460-92-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3460-101-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3460-105-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3572-365-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3832-351-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3844-30-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3844-581-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/3844-18-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3844-33-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/4044-340-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/4152-360-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4200-367-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4200-725-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4564-366-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/4564-724-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/4904-350-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5012-339-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5024-601-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5024-546-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5048-463-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/5048-66-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5048-75-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/5048-72-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5440-557-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5440-726-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5640-580-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5640-594-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5716-582-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5716-727-0x0000000140000000-0x000000014057B000-memory.dmp

Download