8da03eea5d20421aac127fae9b30b75e278979b6a32ee71fe938ffcf6a1050e5

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 19:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
Size 5.5MB
Sample240527-xr2gesff27
SHA256 8da03eea5d20421aac127fae9b30b75e278979b6a32ee71fe938ffcf6a1050e5
MD5 213e977814e456dcb46b1fb6261196df
SHA1 f20ca209ca1b4fcdd9dbdde66247536ad283fec6
SHA512 aa300061c093c08055fb2a92d35c1583371d7e4fb8e0257862965ce6a421d24a56962683abbb404b6b61aad9d4737f1083f2f986d01540843597fe445e48f37b
SSDEEP 49152:qEFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1Ln9tJEUxDG0BYYrLA50IHLGfP:AAI5pAdVJn9tbnR1VgBVmMEnW6at
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
2764	alg.exe
2072	elevation_service.exe
3480	DiagnosticsHub.StandardCollector.Service.exe
1048	elevation_service.exe
4544	maintenanceservice.exe
2880	OSE.EXE
1604	chrmstp.exe
4464	chrmstp.exe
4480	chrmstp.exe
4228	chrmstp.exe
3812	fxssvc.exe
2604	msdtc.exe
4608	PerceptionSimulationService.exe
1084	perfhost.exe
3836	locator.exe
1488	SensorDataService.exe
3296	snmptrap.exe
4668	spectrum.exe
4508	ssh-agent.exe
3876	TieringEngineService.exe
220	AgentService.exe
4072	vds.exe
3912	vssvc.exe
876	wbengine.exe
2896	WmiApSrv.exe
3516	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e97a457c8beeeac9.bin	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_93484\javaw.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca5c561f69b0da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5a5e01f69b0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d2d26b1f69b0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000807b172069b0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000045b941f69b0da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007c0aa51f69b0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000096b3502069b0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
3044	chrome.exe
3044	chrome.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
4612	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
5888	chrome.exe
5888	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	448	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeDebugPrivilege	2764	alg.exe
Token: SeDebugPrivilege	2764	alg.exe
Token: SeDebugPrivilege	2764	alg.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe
Token: SeShutdownPrivilege	3044	chrome.exe
Token: SeCreatePagefilePrivilege	3044	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
4480	chrmstp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 4612	448	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe	82
PID 448 wrote to memory of 4612	448	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe	82
PID 448 wrote to memory of 3044	448	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe	84
PID 448 wrote to memory of 3044	448	2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe	84
PID 3044 wrote to memory of 4364	3044	chrome.exe	85
PID 3044 wrote to memory of 4364	3044	chrome.exe	85
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 3040	3044	chrome.exe	91
PID 3044 wrote to memory of 4788	3044	chrome.exe	92
PID 3044 wrote to memory of 4788	3044	chrome.exe	92
PID 3044 wrote to memory of 4852	3044	chrome.exe	93
PID 3044 wrote to memory of 4852	3044	chrome.exe	93
PID 3044 wrote to memory of 4852	3044	chrome.exe	93
PID 3044 wrote to memory of 4852	3044	chrome.exe	93
PID 3044 wrote to memory of 4852	3044	chrome.exe	93
PID 3044 wrote to memory of 4852	3044	chrome.exe	93
PID 3044 wrote to memory of 4852	3044	chrome.exe	93
PID 3044 wrote to memory of 4852	3044	chrome.exe	93
PID 3044 wrote to memory of 4852	3044	chrome.exe	93
PID 3044 wrote to memory of 4852	3044	chrome.exe	93
PID 3044 wrote to memory of 4852	3044	chrome.exe	93
PID 3044 wrote to memory of 4852	3044	chrome.exe	93
PID 3044 wrote to memory of 4852	3044	chrome.exe	93
PID 3044 wrote to memory of 4852	3044	chrome.exe	93
PID 3044 wrote to memory of 4852	3044	chrome.exe	93
PID 3044 wrote to memory of 4852	3044	chrome.exe	93
PID 3044 wrote to memory of 4852	3044	chrome.exe	93
PID 3044 wrote to memory of 4852	3044	chrome.exe	93
PID 3044 wrote to memory of 4852	3044	chrome.exe	93
PID 3044 wrote to memory of 4852	3044	chrome.exe	93
PID 3044 wrote to memory of 4852	3044	chrome.exe	93
PID 3044 wrote to memory of 4852	3044	chrome.exe	93
PID 3044 wrote to memory of 4852	3044	chrome.exe	93
PID 3044 wrote to memory of 4852	3044	chrome.exe	93
PID 3044 wrote to memory of 4852	3044	chrome.exe	93

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:448
- C:\Users\Admin\AppData\Local\Temp\2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-05-27_213e977814e456dcb46b1fb6261196df_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2d8,0x29c,0x2dc,0x2e4,0x2e8,0x140462458,0x140462468,0x140462478
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc801aab58,0x7ffc801aab68,0x7ffc801aab78
    3⤵
    PID:4364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 --field-trial-handle=1916,i,1669819316139428654,1014227834963245171,131072 /prefetch:2
    3⤵
    PID:3040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1916,i,1669819316139428654,1014227834963245171,131072 /prefetch:8
    3⤵
    PID:4788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2224 --field-trial-handle=1916,i,1669819316139428654,1014227834963245171,131072 /prefetch:8
    3⤵
    PID:4852
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3084 --field-trial-handle=1916,i,1669819316139428654,1014227834963245171,131072 /prefetch:1
    3⤵
    PID:4644
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3092 --field-trial-handle=1916,i,1669819316139428654,1014227834963245171,131072 /prefetch:1
    3⤵
    PID:3508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4352 --field-trial-handle=1916,i,1669819316139428654,1014227834963245171,131072 /prefetch:1
    3⤵
    PID:4620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4380 --field-trial-handle=1916,i,1669819316139428654,1014227834963245171,131072 /prefetch:8
    3⤵
    PID:4608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4624 --field-trial-handle=1916,i,1669819316139428654,1014227834963245171,131072 /prefetch:8
    3⤵
    PID:3640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4804 --field-trial-handle=1916,i,1669819316139428654,1014227834963245171,131072 /prefetch:8
    3⤵
    PID:4544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4484 --field-trial-handle=1916,i,1669819316139428654,1014227834963245171,131072 /prefetch:8
    3⤵
    PID:2040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4604 --field-trial-handle=1916,i,1669819316139428654,1014227834963245171,131072 /prefetch:8
    3⤵
    PID:4224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5012 --field-trial-handle=1916,i,1669819316139428654,1014227834963245171,131072 /prefetch:8
    3⤵
    PID:2708
- - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    PID:1604
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x2a0,0x298,0x29c,0x294,0x2a4,0x14044ae48,0x14044ae58,0x14044ae68
      4⤵
      Executes dropped EXE
      PID:4464
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:4480
    - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x29c,0x294,0x298,0x290,0x2a0,0x14044ae48,0x14044ae58,0x14044ae68
        5⤵
        Executes dropped EXE
        
        PID:4228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 --field-trial-handle=1916,i,1669819316139428654,1014227834963245171,131072 /prefetch:8
    3⤵
    PID:4536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 --field-trial-handle=1916,i,1669819316139428654,1014227834963245171,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5888

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2072

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3480

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1048

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4544

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2880

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1364

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3812

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2604

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4608

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1084

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3836

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1488

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3296

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4668

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:628

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:3876

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
PID:220

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4072

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
PID:3912

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
PID:876

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2896

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3516
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5436
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 645f9fecd028bfa872d851555c7665d809d3dc9f9eef98e3874b67522ec0601f
MD5 c46913544b13640e7d310182a28fab5d
SHA1 53821f7340cbe81cdd24b90641f88e41fa08129f
SHA512 978effd02f7f36db0c718c7082e410103a98624d78585c4130fefc359f4356c54614bb7c4625e91d50a77b84a3838fc89c566960e729c0de97ab2f1e473299fb
SSDEEP 49152:RuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5m/snji6attJM:RPfTqi90baEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 cbf3cace4d479ca7cd2d31e0e9b1b60b09508d3c626298f6807840593fec7bac
MD5 766c3a199a976ea6dad93246eb038668
SHA1 83195404aa745cdc27acfe88396f42b066eb156d
SHA512 1f9aea2a052bd2661f755a01857263dc205e38eb85061e0d5bb9d29ceb2a8e5fb83870fd12d92778503f14fb43787a431b9b978c42bad33ef928adbaf05179c8
SSDEEP 24576:1ijnBsuEX7t/sBlDqgZQd6XKtiMJYiPU:qSuc/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 6d3f9e9b2d7f80cd5784ccb8b82e93b09e82a74291440bbe17f8e25f3a16da28
MD5 aaf202b0bde4948b8c3965ce891332d8
SHA1 172fad62d4d9b2ad426353d3e6d1724a12080b56
SHA512 a8b811690924a79d660ac5f15aea03208db2931a2d5e69673fbfef36970240108a5086fd091ed263f1067db2bfba7112d90926457609ead805d9b2056fd84444
SSDEEP 24576:W+gkEnfh4CoL7t/sBlDqgZQd6XKtiMJYiPU:LgkEfSr/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d44e4020544a476caa2a3e740b77b41f443d70aea71804d835df2c1b28a5fb39
MD5 bec88e022a94ab7f100ee71510f08d5b
SHA1 696b6048b861eccc44d983a0b3f2eab060151fc7
SHA512 75e9c784ebcf01c737c2780d0b721bd14b95a4dc1085d1d5b95985f89c468f8a8f423c37ff31de1c5112cdfa69216a6eb27ff6bb54cf47e24b7cddac12c81e7f
SSDEEP 24576:DBpDRmi78gkPXlyo0Gxjr+7t/sBlDqgZQd6XKtiMJYiPU:FNRmi78gkPX4o0GxjG/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5aa65718e21ab793116ba5d6d75e488a7c2248cedb4b6346e093c77a731846e5
MD5 6a8910811fd73e284b1088b2904700ee
SHA1 c20c4922058dca46471fc3ddda96f5eea9f7340c
SHA512 56265de243369d0ee15ff4ae05ea22420971df111d53d1068928072caf2d59aa95b2e45a43abfea85db115204031f4848d4bd9fac432a2dcd63003d7364e9ab1
SSDEEP 24576:NLOS2oyPIXVL7t/sBlDqgZQd6XKtiMJYiPU:n/yu/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 1f3c24f6f0c473778c528d71582650c64678c8a26aedc6d2e771e379637ae7ac
MD5 56d05b11cf68b4497e8c5e9cbf4c6d39
SHA1 17a2bd6649afbb40c0623ef2fe95355a0e75f387
SHA512 ef851fcd114edeb8155d4456c2ddab486644927ce0d70cfb333a59dfdc8635e3adb4649b01c44efdcf38daa233da216bffd6bda9738bb8e4de5e8402442818f0
SSDEEP 12288:M9RUGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPhL:M9R7t/sBlDqgZQd6XKtiMJYiPUL
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 02e5916b11a4fc204df28b4e94b997b5123aa701c8c4333c1e07cb81ea029ac6
MD5 afa734da957cd1c4cf7a72c849f0a726
SHA1 8c56a3f604abbbbf4894e270bedad6682b2fd1e2
SHA512 9ed2a6cb3eb8fd8018ae9eb0ae008cdfe8bd066363ed14f38488f98268eeef0f3100b2a000e02531ff4ffc0959a7c17431deec3efbca92274b8196d996030452
SSDEEP 12288:1eBNUbTVO86UEUGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:1JIUE7t/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 15dc36ed6fe0e90f08d1a67684bf4e24eaf1145ef7e39535f0cd2a5f047547f7
MD5 398cb582f5574ba402df91be907ec3d2
SHA1 6ffbdcc8fa32aad144bec93c936cb38e337719b1
SHA512 58387c866f7eac0a2115813b771a21585ff53dc1586d45c4888f240d62c01032ebade031ffefec9193686d0e2aac4fba31dcf743491a3c46119990159fb40153
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH9:BQvGAdlCEL8c/yRNw5CpEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 38d157ae2e5fab2bdd669f0db7d91dfed81cd12aba172a25f32c5ae95a09fddf
MD5 bd862e76996b3709d8f5737712dd7efa
SHA1 538445769e2a0bcab369c36807b4f718ca23f3f4
SHA512 9fd07fba7a95f8c2f6343da146db4953c0221a8da6082e2ab43eec772223cc4701810842d329e4692fb48433ae489ef000823f1bc585eaa865bd1f85c118396d
SSDEEP 24576:sLewsAj27t/sBlDqgZQd6XKtiMJYiPUQ:elja/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6301947387970621e711c22d765f9aa0ee83d537cc5ea38a586c7c2a34c68a23
MD5 2519031ffa6f411695e75397f8e38718
SHA1 04eddeb05a17e6da279a1917b09219c1c2903db4
SHA512 8b112f46453d7911d72e41e4e44fbba578d7628b690f38423ee85016b880c8dfe6d8f82edd83c231a88738f90f7fb50cd6784f87e285b3a48d38c3324d17c8bf
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHBnW9:bUEtQevvqc2W1cpV2EI32B
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 83ee6a4c190338f1179b076644692c25865f7a36f2a080bd72e5f0457291585d
MD5 ffd7cbccaa53c16b54a1fea25ca3cefa
SHA1 885f00c715b449fe8db75e268494886db6644319
SHA512 87fcfc06d6cc10fe347feff63597ee51e2e4db9fa5dc5269bfea6eaee1262532669e88527d0e7284eaa819b3d355cb45691f0851f6ba4cf0445757d5ebd3a7d7
SSDEEP 49152:JCbRquA/m2yL5zifFiV+XenmE3/z6/snji6attJM:GoqHVjnmtEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c5c9d6f66c2e43e6aedf735110197a700a7630b5a92a34f9fedd36f12515552c
MD5 5bf673c14ad5d997120e9667a5ae3d96
SHA1 11c0a1c9a6c6196d9341ff3a09ea14746ffd3740
SHA512 3b0d8e292a5ac83fa0adc0fe41ba21b0ae60ee3ed1f3678d8208355e3c58569646ebb975790bf916d25cf0b27b0b24e294eed5ef952bf01129ea1d9028845a37
SSDEEP 24576:rAhGLJIFoiwtA5l7S5377t/sBlDqgZQd6XKtiMJYiPU:rAMyFoiq59/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 2c74918c8f28661af7d621d28ec9ab34eb2c0f4740f3af867412ab202424686c
MD5 c6e39ada5a8a3de714b144f042284e20
SHA1 faeb9d76884450a34c076c5c9fb75183ddb48adb
SHA512 158615c6c4cb036efc5014948d6deea0bb3fe094d5843d6efcc61db3985ce9908c61d5356dd4ca330ad4430ee59abf2a5bc9c7130d2ea45ff2c16631d59ba81b
SSDEEP 12288:xmw5HEjsChNDBFgl0WDm+C/UGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNS:swuiOWC7t/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 bf162e797bdfb99796e3dff0febcfa96d632043e5687cf1b03b3f9f3283a4883
MD5 f00b9812c5dba9e2ef57644716b01372
SHA1 2b7cc5248114efe3cc24bc1525cc6c6ac57cf1d1
SHA512 8450918f2148dfef783afdc7696eb5a4843133e9a7387d099c0d39c0b8003540da28e957ae30c33956f0032ff0dad0ff777994b311dc4786827999f8158693f4
SSDEEP 12288:HTZ1IyGUGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:zZuV7t/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 e8a08abf0ac04ca183ea9f8b0c8f31522ef41e8ac849544ad19f4be8d9872e32
MD5 e328508f4e70afca47b1f874609af0fc
SHA1 4f56612119eaf9152764a7d470159f9e6975ba39
SHA512 caa057576e76e34ee87bb6e6c0c0d8580721acf48b082afd59cdc15c7d54d15692628802b0218e4baa5b66be5db22eff028dcc37e671c6705469f6f48a316780
SSDEEP 49152:B0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLt:xwfhY7g/rLd7yYA3awr341gFEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 4832c90a43b209d2ecdba42f3d61d8495de0011ea1e5f4f46bfd59e943127377
MD5 5e4491f89ea3c6587b75d0a807fe87c0
SHA1 7824700f1ff05b9556d12e510e1aa5ff64aaee60
SHA512 a84c22845a402254630b74654e2b2205d2c23346ea828b214403a30d1e6712f393865390151aa9ef574aceb07bf4584d98ae396ac203f78e45e713aa94b2c864
SSDEEP 49152:j0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLt:vwfhY7g/rLd7yYA3awr341gFEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 a07ed5e42d30f5fdbc2fea32b0b3dfd7a85cf425b52a6ce09460ee227a801134
MD5 308860728b3105cf23887a9bedc557fe
SHA1 49f554ead64853c1205d75e0b2800c81facc7dbb
SHA512 92e3bfe9e501e4632a1fdf0fb2d05499bf1b8242df4dce5bccd11405a47c65fe23c88721b55081f00e6e6167868807af0c3d1bcacb3b3ad654b37984fe5e78ab
SSDEEP 24576:RcTyYv0FteQU+5I2kjgD6iQacAC7t/sBlDqgZQd6XKtiMJYiPU:RuXv0Ftpn5606zOu/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 585643bef92205ef2b9f5a5e8ae840eb7c3686bae3981f38959603f32097ab9c
MD5 e246ac1da99973c8a9d48ce5e6b28a13
SHA1 d33df18931e3cac33c8e359ce7cacc479532975d
SHA512 0e7a873ed71c075a2c44702288421dead6ad83a32a818ec9cc1f1682398d59ca52ee23bce8b1df147e94ef03709b2c7a5ff4e93fe1c9724f1bcfbefa60e5a5ab
SSDEEP 49152:Vy7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxa/snji6attJM:wmYeyxHjWjMTaEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 ea673e6d18ac3d803e4a8b111a4f8ed6e9d93b7121c7a9dea7fcdbde83a95d60
MD5 c355ec18c4df8d8f79168d05a694f505
SHA1 d796f6107fa8af1050035475118e54e39e960add
SHA512 fa9f92dd35a15a39c72687e1b5d27af82c0761f30ca2de684f48ded25d2be76282d9b266753af1eff5ea487c07c7f2eb64eff41a4653095606ef261c8b890cd6
SSDEEP 24576:66drZn1WEci182IEUeNbJeRgUebgW816t7t/sBlDqgZQd6XKtiMJYiPU:6WnDci18yNNUgbYm/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

6bf66fca-a5e8-43d5-96f6-66e91a35e8eb.tmp

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\6bf66fca-a5e8-43d5-96f6-66e91a35e8eb.tmp
Size 488B
SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
MD5 6d971ce11af4a6a93a4311841da1a178
SHA1 cbfdbc9b184f340cbad764abc4d8a31b9c250176
SHA512 c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f
MD5 SHA1 SHA512

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 9088567a7fcdec290866f58a47844ee1472bb9555227b5ed690ea471f29ff08d
MD5 94d8168e5acc6ac430b5f7ad5c37fe1d
SHA1 d2898829613487e5f83cbbdce988ac36596ea4cf
SHA512 5af0f72bfd406c626688c7b80d6916ccb72c957a794907bcd7404b687e166618b2d49318392a4a2402683a1beeb53c0cd60775b8d8ed708d3d62c8b97f107e97
SSDEEP 12288:OUFmDDLwUGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:0w7t/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 001c51870a28710313d50d9037f261881517a384d3e502d9112b04ea2e8538a1
MD5 90b8e3c077c7289cf4b7078243e26f76
SHA1 c8e3387c59c20fcff770b846e972a52f7f93591c
SHA512 4461003ce00d03608509d7ab645b933ec95c398623a1d8c6440c8a5b069d32e73aff391a1d3954511dfca7da698c0820970017b66629e3647800e5cc3920f1cf
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 193KB
SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
MD5 ef36a84ad2bc23f79d171c604b56de29
SHA1 38d6569cd30d096140e752db5d98d53cf304a8fc
SHA512 dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be
SSDEEP 3072:HXm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4g2rJBXCy9enoN:HXUMCm4U6q62MEBi99g6JVCvoZhhl+No
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 916df1df09bb72fec55cc0e222c83d7f237a132505f6c733a4c4e3e6d8e16001
MD5 a225dca4ac9c9b138314b44d18a2f27e
SHA1 d492d83a74ec706d849366b66cef422651ee6f2c
SHA512 acc2789eef850181ece4c705f402a2c389467ea67bde1c4a8bd373af302682b9bcd79b0475efa48bd1cc57d7323d39afed08c91645b7d90483dddcd5e2687798
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 354B
SHA256 823aad1aedce1d9e7229f8d45e97c7aa0530260d5f9844e786e4f057b6f08449
MD5 5e96074fcfb5313829be2912729c84d3
SHA1 77d808ea37351122d440e8222a1aeaeaf3bb3f27
SHA512 1ce5048b639dd4600b501e98bd1e9e7e55819116b3d052ec21859e8669168ada113036fe2ad3007501df6221fd79e9097bd95c4981fa4d141289ac3e75caa28e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 3312622d67ea9afc06d002f326a352c9a2a649310b6b5a1452874f2603893b57
MD5 58c5757b6e3e0e83aefedc66fdf0ae15
SHA1 792cc34f2b7d53d6fea4dfaa0d8533810da1b040
SHA512 83d45bd506d80b90af61d46df6274749a6588788dcc6cf0ada3fef4460611dd10067b6190ed101277d4ed0c03e88731f1c4ac213223fde571c5d7bac072d510f
SSDEEP 96:2shg5GctcXIeevLXykJF08iZRy7Dx+6MSmueUBO9Wu2MEVMup:2sa53tc45vT1JO8syh+FkluPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe575d33.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe575d33.TMP
Size 2KB
SHA256 13f018fd7e8d456a16ab52c9430b449ed2f126386dc10abb8d01ff752f92db72
MD5 2439032641f0c53dcd64320bfa02af0a
SHA1 a1820031d22a713be8ff0a020783b7bc72860ae1
SHA512 d9e02ab626313b138f721b369d987f45e68682f6cf2d76138195cedc75cea2237cf36677173a82672bf54ae9fe480b54f42c76af18e8e4c6cad76da85bc178d1
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 aa4cbf0b5bf1373a963dd462fc46d6322fc39d84436982c79734af03fd25118c
MD5 492e40edf34ca3943fb7e54cb3fd4fcc
SHA1 39b2ec8bf44f5a202c381de396a72225c5fcb186
SHA512 35ce76270950682db84535b7f1f66388488b062b93c928878382f48243428d0d6c30fae1cdd272735258d57523e496bfef8b12800fe5c9b39cb752365d645dc2
SSDEEP 384:NZbR7pLhLcEvm4Xsk1kXqKf/pUZNCgVLH2Hf91QrU44HG+Xb:NtR7pLhLZ+Csk1kXqKf/pUZNCgVLH2Hx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 260KB
SHA256 96b1bdc306972b6b0205d5498aa9b8f4343b1bf56152f5e5cf6e97b88b50207a
MD5 dcdc91fab7d19447f1e8f90db4c1f602
SHA1 23e3658f85e98ec2650b5b0968cdec27c0ef9319
SHA512 f76afc488c97360add4ead3f271ca34f4f4194559b6aec4cbb351a22aec0eab1a768cd83558647be8ac326105620fc3ec395b3ea9fcea66b0615e892a099065a
SSDEEP 3072:51clzRhZoJzT8ZxOzKn7Nw0rA6trZriwx44fQ+iuZHLwnz4F9teZuyz1nUI3S6vV:slamLOGrJZiwb5vF9te35nfC5mgMatpO
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 7KB
SHA256 489d23295ebd0063c778b45db77d4711673a6e61e2ff0ffedd1e81f6cb8822cb
MD5 a1b126af6d955994a42bc2ff889653f8
SHA1 c81ecc2af9e0290ae082ecf1b232f61bf0b91ef1
SHA512 b19ae120c9ee5c60a5ea537767caf468419255a25579dab608e00622224a57442c0c39d6112e9fc20aef7992abf8f478697b7aedd31096c58f9d29033551f7be
SSDEEP 96:m+8NF7VdZcvvRALWwK36KK3x1uEw7p8n+wK2DK2zSom5UMsv:SSAPtK3B8z5ad+
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 8KB
SHA256 a44733f129db727f4f817ddf7071a101df9bba65993f26c97ba24b93aea31a74
MD5 c06315d38cc2d9410c744adb745c3da3
SHA1 23e8b1fc501b7937d0db04e704d2ffc745f8726d
SHA512 d9f8c6cd420e77eeb81cc3f4804d7346344c1054cb9d8716c350b8424d842f61edfcff38a436858a9cee9b16fccb4acf99d2ed1246dea0eb9705a52e34c4efd9
SSDEEP 96:m+8NF7VdZcvvRALWwK36KK3x1uEw7p8n+wK2DK2zSom5UMs2fo5qzwK32rK3Ynuo:SSAPtK3B8z5adS5L9rZnjT
MD5 SHA1 SHA512 SSDEEP

Submit Download

e97a457c8beeeac9.bin

Path C:\Users\Admin\AppData\Roaming\e97a457c8beeeac9.bin
Size 12KB
SHA256 6fdbcddd26ad50ccd338d4d1589c306a05551c58cd14cd2bc4445436c26ab8ed
MD5 40ce7523c313282d27f0175963db27c3
SHA1 b42d6ef85e4dfd21fdf9b90e4ca7f8e3b4399d8b
SHA512 7118f1037107b3e267e4be8e1c80a096f0b8c362ad98201c56c530c4b8e3812910b83a9271458fcc52b46c5de62553f56a5eb9e96d838144c3c762dc6d55e20b
SSDEEP 192:04QbufVg97xRooTp5QiTtvbRcOZnwH03oKcfp5VUoo7yWCkv+TgEGf3slZUs:W97LooTHQ0FR/ZnwKoJpjUooRd+lZUs
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 62c9fd7101772546b3a46650d2196f3cc180ded7ec041c0490ede033223b6c19
MD5 cc64c556c20d12a90ac37a393ccec219
SHA1 45eeb5c05833e34c0d4622d86c9db02ff3afc708
SHA512 52386ed0487df8ab5a399e96d317127d982f34b013ca0c2b472630b7f45805f9590ebd8849898e974db6849df2a522606d7806c2a1e10720b4830ac53b9cd6d0
SSDEEP 12288:gQGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPho:gXt/sBlDqgZQd6XKtiMJYiPUo
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ac101fb8cc355e7284f79360d66e73b55d62186fe8a9d69ebc655714229add9e
MD5 d0edd14a8ad94789d96f1d4509d2100a
SHA1 a00c508134f77cb4798bf29073237eedea4a5912
SHA512 cd58a4a4505df150ab257f7f628e279f64f53a6a009c3c3ab6f56748513b34231c8eaf9bd3e57e7fc83ab7025870d80d24d38a915b69a7546ad8558a1c3384c7
SSDEEP 49152:/a0h2GEkuAe73q3pp46zwwQX/snji6attJM:/a0hNYG4JwsEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 1ba43e996a412322dc054144322dd74e610d704ff3afc58cf9530af748374cbd
MD5 dc3703fb7139e8f64f3c9335737b4de8
SHA1 7e392093128e755d553ddad68acf9dd6509e18ba
SHA512 abfa0efa37e85d679db0bbdde13289ce1a79e93d045bce1b3dc75151a95ddbb57e767c5f8721797063c6d694573a6b54fe859312ba91e1d86d5eb7ec1bc446be
SSDEEP 12288:1hbHjfXlGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:1hbHjPot/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 6025ccf60b0660d93b617445d54b8778b10dac9404431448e4d041d94180c995
MD5 dabae8e5c57b71587fa97b3d777dd596
SHA1 43d01a1815fc82035ead9e1bdb47a04f1fe207c7
SHA512 3162befd50a29c53ac9c773aaeffa61709a2708c64cd2d276e1067179f61dc46ada7050ced5a49e5299718e36fbeb7b56806fb3cf920524bcd58fe88f9ad51e0
SSDEEP 24576:93YgnJcRTk4yti+R5dpR/Kt/sBlDqgZQd6XKtiMJYiPU:9IgnaTk46ppR/w/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 c6aef98e707dd96c664eb776800e221636b1894cda0fd4c45a255ba657c9dfb8
MD5 2c0e57f0f3f098273ba7ea84aa78509e
SHA1 7dbec4adee023d96a361069f0b85a66ae6d0303d
SHA512 3fb1a11270f080d65964156f9c43881ceadb72837d7b9529a0a840eaade8f7964cc0a9717105f4393b0203f3e1969d172d9404f5c98b5ed87e0d73b7db662b49
SSDEEP 12288:98Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:9jt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 77128bddcf9cbbcc47f21d3bcfc52d37d6ce32d6f52e7695a3198f7821390453
MD5 57b4a9f3024519bb5940729e43948e08
SHA1 7cb8bc1de4878dde42e31470a17a901d25f5af06
SHA512 aaee095681f3af365b8b4ac29ba42690bbb308a8735d1c5f7e13ddde3baad5984fb94805bcc4a48d0a4c3cb730090ba67a79f5721a0ca66d4f5440eeee01f991
SSDEEP 12288:TObbA4LWOsvAYFTNGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:8PL3UTwt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 410fa20c481d576b2936c218a4c0ad18e67fef210f752ee83c0852d846187a21
MD5 f85ea9d4620e3cf587d49316be4fad09
SHA1 d33bac5dff6bf39bee1c83fdef6d837d0c46724b
SHA512 429de16e8802b099748d95835d5292db491d9af0703cc3566961d142368d23bcf3764f96c094db6e9103383d554c4a010b0704248a12dd375fb1b0a63fc3c966
SSDEEP 12288:ZpFtPOJGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:/Ost/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6aa7df8c8da467a3d264f4907576fa2137d816f39e324bb46defa5ff660c6f19
MD5 9cb4e708652158e01ec186382ea4aa4f
SHA1 a4f9744e7135f7f273607f749f340c8caef65b59
SHA512 73097a72c766fda149ed5e8cf0cb3c34ba84c21bd9e70f66d1e4a6186ca9010526a457d8831a6bab3b7d9b9d0b8b2ef5250ee8589e3cf16ca57cfd0ea5d1bb0d
SSDEEP 24576:Y7NM9YmZqmWMUkPjZM48Mv6bEhsHt/sBlDqgZQd6XKtiMJYiPU:Y7cBWMpPjN8DbEho/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 dc3a3db6152ed6016a67fa1f90a36d36050f871427388500b446be37bded8db5
MD5 016cb3e414279db4f986a8a9dd3f5f80
SHA1 04852f06a9baf9ce830abefbed3c3ee1590210ad
SHA512 6ad206636912adbd8e4180c87c49c0d31bff0ba43c23514895c65b1a19e006a3a7bc704e7d83bd6fb1fbab96b08a7917b16375cf1e6782f678e7c3933ccaa7d6
SSDEEP 24576:TW6BApg2YuyuNDYTabvcRvNYf8km1pt/sBlDqgZQd6XKtiMJYiPU:TF2YuHNETovcvNYf8kmt/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 32b55f5c46756ef6d3b7793373d7b542867a54893a69e14d54ce82db33aba15b
MD5 02fda0b16f4cbec5c1719e702bb5f05e
SHA1 2c6e7abc167acd0452dcfffc026ca113b4883229
SHA512 18b7b40be145ca2902f3bbb0ec6336f9b69a86cab9254168fda94760297b02542b0b4f5c73ed2a9bedf58f8aa26590431269ce184e3dbfe08c8dc658c57c2a7d
SSDEEP 24576:rAFs06+Omlf3NXEbToYt/sBlDqgZQd6XKtiMJYiPU:kFs060lVXu3/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 412b3d7ae236e10518a8aef4013dbdcc9ff4febf10ead46dca09d502bb951688
MD5 2da14c4b69300aef35557235d998eae1
SHA1 bfc67d2528e3757213ea226a348f4f1e20776a5f
SHA512 2b7ee3c4015c74045fd1edbf5c60ddc450ec81992d7d9f1490d17fc87beaf93632ee995921f5cc6fe40190e0aff7645eaedfc62d5a60dc7f79634d09149d531f
SSDEEP 24576:MJnJ5D3W71t/sBlDqgZQd6XKtiMJYiPU:MJnJ5DG73/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 26aa94b3986a96a2234995436b061f0a98310bb314cbbfdcc582c5cd92636390
MD5 e098b30ea789eac01ecaca9d1f9b62eb
SHA1 94e8f8796fec784f6f42aa6f251ded22b4bf7d90
SHA512 4b52cd83365f733353e42c2a14782c8852dcd97923af8ec5bf2d62c4c884fbdc896a67c6ab8992aa6477a3dbb3bb572a3d92c90e212f52d92740d7b504d66f75
SSDEEP 49152:3o06DIKdwc+eQnSt65aVh/snji6attJM:YrEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 e17e7b0e589f938ef4fe55450d353c389b6ec8bbde92d8081d44b975d1e9c3f6
MD5 c1366e4c3fe8d1cf24ca282842e6e910
SHA1 3f1debf0889d3a1e7f6a0e76155d1e397bfb675d
SHA512 e241d3bfc42e025afba03dbf851cc6011884f45f0246f4305ead9d5957b7c78739e5a011782af5b2058346d97e1cf47f0773406e51c4391c287767186496d64e
SSDEEP 12288:FEP3RR8Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:GRjt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 a9988d7b1c002b8fb3c1e02d74b9616bde3114c06be371181ee3fa2568a78335
MD5 99454af0d304d3dc0ed7844e8b244f41
SHA1 b1137cf20a7cd911802515584c72f8f7471ec05e
SHA512 18a6c88c42bcf03daf3380e009e0b4ab98ec2a00ea7cf47b08e11511cf764fd66897073763c03268153948821fb56525b4c760aac29a6da25fe416ea81fa2b13
SSDEEP 12288:WjkyzGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:WIyCt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 90352fe2e3152b0706a1ec05ca9414ba58ae32dd8e803d57def8b9fd2795bd88
MD5 b1f7e289dfad42bcdffddd73c17522b8
SHA1 66563b5c36e80c0882871a68366014e5cc3d73c6
SHA512 c7348312af8943813feb251d1ab520875658c7c6a162169d76585230fa6ead848f01456097d3bd7862ecdf9dd54c94ce7035a06a4601c015e7c7792bda0a2a2b
SSDEEP 12288:wb5Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:A8t/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 46b4b831e10730d02b53c6e1a68e1cd9cb5545d5de9e5a65aabee145d294448d
MD5 777dc3f6dc7532fedc715fd7a3b93502
SHA1 cd12bfd792e34d87e8289efedd9e64d14d62e949
SHA512 6e8d72441f21a8ea01af5b80bd4b564b14549f566216cd02d2ac5e5c2cf90d79b6b7596b1bd899f4ff69a3c11b52e28add649187d5c764a4f5439f66e9282f75
SSDEEP 24576:yQ9MxZKdcz97w3Pt/sBlDqgZQd6XKtiMJYiPU:yVKXF/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 35e46bc18a65e4edac215e1723534b98eb4afd5bbdbb6fa98e2bfa2ca531a189
MD5 9ca417f7ed152545eb0fa4b10311ed36
SHA1 fde112452dd44289bfac729b6feb30c3a9624afe
SHA512 80c1ca9deb5fea6c65d5f2d90d401b22c51766d8238637658ccae6b8ffa02fb12eb8fd3cbef96caf36153cd96c96f6cf61843d1cbf789e69e62c0bcdce758f6a
SSDEEP 12288:byoKo2RRple9pPGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:byocrAput/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 f8271603330f9a5ba78bc5a7a78a59ea7fbf36d9dfdcbda9bb0e61799ed78039
MD5 41b8e2f9acba3a728cde427af8bde46f
SHA1 286eace8d039327810a253cb94b5937a65e72b72
SHA512 54af47c3a485c47c26f8cfbabaed1b5467cacca888a8bf5cb4985078f693e9cbe090e0d4676785080dd299bf12e0f6756b6e145629a0d4f97cefe6d0ca5cd387
SSDEEP 49152:8WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKk/snji6attJM:20zuNIgEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Windows\TEMP\Crashpad\settings.dat
Size 40B
SHA256 81519c37e7b764606c063607c2fdc287f28845aed7cce899222c4f714f16f860
MD5 0a8c17e97526f751a8aa475e8c8b7983
SHA1 2cb070d16a547e867aca22af457f13c44c17d0e2
SHA512 40a71708d63ea949f7132ef01340b3202eb349119623aa849b0e103e4b7ddbea543ba7ebe98b255eb58e26ac050c09a1dde89327f31deaa77f483dcf16136593
MD5 SHA1 SHA512

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fe101da1862c938035cf592afc12cda1f944555ff43d9417b9643a53c48b9a5a
MD5 089c0d59501a9f0fe4819c4c5eb35677
SHA1 4ca43140bd05de19fac0ad51de17b4170123dc49
SHA512 9b2f409616a30a3f03aa75201e97c4235767b9c3b507c8e070ad0f7d5888cf3c7de2847faba6f073192a4975b4f2cd18e9116a8c19690ac499447347bfde3e86
SSDEEP 24576:b1QT7EcpfxR+N5AWAz3ooiYtjMqbjt/sBlDqgZQd6XKtiMJYiPU:mTDxR+N5YzTfjMA/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-581-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/220-569-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/448-6-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/448-51-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/448-8-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/448-35-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/448-0-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/876-608-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/876-850-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1048-408-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1048-73-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1048-76-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1048-67-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1084-607-0x0000000000400000-0x0000000000578000-memory.dmp

Download

memory/1084-491-0x0000000000400000-0x0000000000578000-memory.dmp

Download

memory/1488-632-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1488-844-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1488-512-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1604-382-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/1604-321-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/2072-47-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2072-63-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/2072-41-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2072-202-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/2604-464-0x0000000140000000-0x000000014019A000-memory.dmp

Download

memory/2604-583-0x0000000140000000-0x000000014019A000-memory.dmp

Download

memory/2764-12-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2764-388-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/2764-31-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/2764-18-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2880-93-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2880-101-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/2880-420-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/2896-628-0x0000000140000000-0x00000001401A7000-memory.dmp

Download

memory/2896-851-0x0000000140000000-0x00000001401A7000-memory.dmp

Download

memory/3296-729-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/3296-532-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/3480-59-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3480-53-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3480-61-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/3516-852-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3516-639-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3812-450-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3812-465-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3836-501-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3836-619-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3876-845-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/3876-564-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/3912-596-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3912-849-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4072-584-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4072-848-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4228-361-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/4228-422-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/4464-421-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/4464-333-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/4480-350-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/4480-371-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/4508-555-0x0000000140000000-0x00000001401E3000-memory.dmp

Download

memory/4508-841-0x0000000140000000-0x00000001401E3000-memory.dmp

Download

memory/4544-78-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4544-91-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/4544-84-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/4544-85-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4544-89-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4608-595-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/4608-477-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/4612-20-0x0000000001FF0000-0x0000000002050000-memory.dmp

Download

memory/4612-28-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/4612-346-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/4612-29-0x0000000001FF0000-0x0000000002050000-memory.dmp

Download

memory/4668-840-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4668-535-0x0000000140000000-0x0000000140169000-memory.dmp

Download