7fbdb84d1536c62a6d231bebab9163bd8a9468e9665b0b4ebd1834cce0c98b31

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
Size 5.5MB
Sample240530-rd5c9scc22
SHA256 7fbdb84d1536c62a6d231bebab9163bd8a9468e9665b0b4ebd1834cce0c98b31
MD5 452d98e72fb2efdfec14eaac83ac7030
SHA1 038f82f90374e9b457c74c632e292028210ecc1d
SHA512 83fe90cd05af7f337764eb138bcce771def2a96383747594dea421ed2e6d20861588d819da5ebe78d575484e88389383c1298f3a101b08676869f026de899105
SSDEEP 49152:oEFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1Ln9tJEUxDG0BYYrLA50IHLGfy:mAI5pAdVJn9tbnR1VgBVmoqo4w
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
2400	alg.exe
1528	DiagnosticsHub.StandardCollector.Service.exe
1260	fxssvc.exe
1940	elevation_service.exe
4464	elevation_service.exe
5012	maintenanceservice.exe
2768	msdtc.exe
1736	OSE.EXE
3176	PerceptionSimulationService.exe
1036	perfhost.exe
4544	locator.exe
3900	SensorDataService.exe
3752	snmptrap.exe
2560	spectrum.exe
4332	ssh-agent.exe
1576	TieringEngineService.exe
4404	AgentService.exe
3812	vds.exe
4216	vssvc.exe
1760	wbengine.exe
4612	WmiApSrv.exe
980	SearchIndexer.exe
6016	chrmstp.exe
5172	chrmstp.exe
5432	chrmstp.exe
5520	chrmstp.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4820a8adc3136770.bin	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003419b0839ab2da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000010e176839ab2da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000774f27849ab2da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5584e839ab2da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a40dd37b9ab2da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000089a3027d9ab2da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
4764	chrome.exe
4764	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4876	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
Token: SeTakeOwnershipPrivilege	3120	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
Token: SeAuditPrivilege	1260	fxssvc.exe
Token: SeRestorePrivilege	1576	TieringEngineService.exe
Token: SeManageVolumePrivilege	1576	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4404	AgentService.exe
Token: SeBackupPrivilege	4216	vssvc.exe
Token: SeRestorePrivilege	4216	vssvc.exe
Token: SeAuditPrivilege	4216	vssvc.exe
Token: SeBackupPrivilege	1760	wbengine.exe
Token: SeRestorePrivilege	1760	wbengine.exe
Token: SeSecurityPrivilege	1760	wbengine.exe
Token: 33	980	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	980	SearchIndexer.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe
Token: SeShutdownPrivilege	4424	chrome.exe
Token: SeCreatePagefilePrivilege	4424	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4424	chrome.exe
4424	chrome.exe
4424	chrome.exe
5432	chrmstp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 3120	4876	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe	85
PID 4876 wrote to memory of 3120	4876	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe	85
PID 4876 wrote to memory of 4424	4876	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe	87
PID 4876 wrote to memory of 4424	4876	2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe	87
PID 4424 wrote to memory of 3320	4424	chrome.exe	113
PID 4424 wrote to memory of 3320	4424	chrome.exe	113
PID 980 wrote to memory of 2564	980	SearchIndexer.exe	114
PID 980 wrote to memory of 2564	980	SearchIndexer.exe	114
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 1108	4424	chrome.exe	115
PID 4424 wrote to memory of 4520	4424	chrome.exe	117
PID 4424 wrote to memory of 4520	4424	chrome.exe	117
PID 4424 wrote to memory of 3464	4424	chrome.exe	118
PID 4424 wrote to memory of 3464	4424	chrome.exe	118
PID 4424 wrote to memory of 3464	4424	chrome.exe	118
PID 4424 wrote to memory of 3464	4424	chrome.exe	118
PID 4424 wrote to memory of 3464	4424	chrome.exe	118
PID 4424 wrote to memory of 3464	4424	chrome.exe	118
PID 4424 wrote to memory of 3464	4424	chrome.exe	118
PID 4424 wrote to memory of 3464	4424	chrome.exe	118
PID 4424 wrote to memory of 3464	4424	chrome.exe	118
PID 4424 wrote to memory of 3464	4424	chrome.exe	118
PID 4424 wrote to memory of 3464	4424	chrome.exe	118
PID 4424 wrote to memory of 3464	4424	chrome.exe	118
PID 4424 wrote to memory of 3464	4424	chrome.exe	118
PID 4424 wrote to memory of 3464	4424	chrome.exe	118
PID 4424 wrote to memory of 3464	4424	chrome.exe	118
PID 4424 wrote to memory of 3464	4424	chrome.exe	118
PID 4424 wrote to memory of 3464	4424	chrome.exe	118
PID 4424 wrote to memory of 3464	4424	chrome.exe	118
PID 4424 wrote to memory of 3464	4424	chrome.exe	118
PID 4424 wrote to memory of 3464	4424	chrome.exe	118
PID 4424 wrote to memory of 3464	4424	chrome.exe	118
PID 4424 wrote to memory of 3464	4424	chrome.exe	118
PID 4424 wrote to memory of 3464	4424	chrome.exe	118

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Users\Admin\AppData\Local\Temp\2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-05-30_452d98e72fb2efdfec14eaac83ac7030_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2c8,0x2cc,0x2d0,0x29c,0x2d4,0x140462458,0x140462468,0x140462478
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0b17ab58,0x7ffc0b17ab68,0x7ffc0b17ab78
    3⤵
    PID:3320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1948,i,6180463205683963344,6584632011643489150,131072 /prefetch:2
    3⤵
    PID:1108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1948,i,6180463205683963344,6584632011643489150,131072 /prefetch:8
    3⤵
    PID:4520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2288 --field-trial-handle=1948,i,6180463205683963344,6584632011643489150,131072 /prefetch:8
    3⤵
    PID:3464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2828 --field-trial-handle=1948,i,6180463205683963344,6584632011643489150,131072 /prefetch:1
    3⤵
    PID:1256
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2836 --field-trial-handle=1948,i,6180463205683963344,6584632011643489150,131072 /prefetch:1
    3⤵
    PID:2064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4280 --field-trial-handle=1948,i,6180463205683963344,6584632011643489150,131072 /prefetch:1
    3⤵
    PID:5220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4412 --field-trial-handle=1948,i,6180463205683963344,6584632011643489150,131072 /prefetch:8
    3⤵
    PID:5368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4584 --field-trial-handle=1948,i,6180463205683963344,6584632011643489150,131072 /prefetch:8
    3⤵
    PID:5380
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4536 --field-trial-handle=1948,i,6180463205683963344,6584632011643489150,131072 /prefetch:8
    3⤵
    PID:5880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 --field-trial-handle=1948,i,6180463205683963344,6584632011643489150,131072 /prefetch:8
    3⤵
    PID:5968
- - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    PID:6016
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
      4⤵
      Executes dropped EXE
      PID:5172
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:5432
    - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x14044ae48,0x14044ae58,0x14044ae68
        5⤵
        Executes dropped EXE
        
        PID:5520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4632 --field-trial-handle=1948,i,6180463205683963344,6584632011643489150,131072 /prefetch:8
    3⤵
    PID:6116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4468 --field-trial-handle=1948,i,6180463205683963344,6584632011643489150,131072 /prefetch:8
    3⤵
    PID:5368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4560 --field-trial-handle=1948,i,6180463205683963344,6584632011643489150,131072 /prefetch:8
    3⤵
    PID:5484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 --field-trial-handle=1948,i,6180463205683963344,6584632011643489150,131072 /prefetch:8
    3⤵
    PID:2540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1948,i,6180463205683963344,6584632011643489150,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4764

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2400

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1316

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1260

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1940

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4464

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5012

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2768

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1736

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3176

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1036

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4544

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3900

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3752

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2560

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1400

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1576

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4404

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3812

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4216

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1760

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4612

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:980
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2564
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 fbd73d2e3f893b0a66ecb7070943eb8df569ad2e56823d0d4f8a0851de382b6f
MD5 25b4378ae4863e7c08c5e2b368285668
SHA1 9257e92dba523648452797fb2ed37ac5e5c05b2d
SHA512 3dee08e854a2a8180b436a3c2b3f69d9a1645d7bcccadd133b1cb69def48e64374f4cf68922d40521425cf68443c0a00d64e5f6b8eca591788cd78a4587aff51
SSDEEP 49152:ouYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5FkQ/qoLEw:oPfTqi90bhqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 7b7350f493b7bfa6127fe11e2439c72ea3d991b05ca5f95844c1c89ace4dd0dc
MD5 bf38fd9e7d8d994d12b833ede7498b9d
SHA1 988c6a254b641bb94d0cb282df61316b0becc519
SHA512 4a38c6a806db3e50e2a8d3b891bd2515e3c81ca89c30c04c25682c8a9bf8fdfd4945aaaa32c35163bf1148230445adcd63109018f125db0b570966a05eab825b
SSDEEP 12288:IcQirmNJLBsunEYMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:yiinBsuERSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 9d4cb9e8036bbc85d8970feb8db86c123877456378bbd765813bc937949aa5db
MD5 f3010305000956d89d1f43168459eeb6
SHA1 7de271e05d8b62d8ac545c9506209b7d74f3e464
SHA512 d6b66068b56d7b36b3e2312ec43f806324a6a64bc6c42ce5f711384d150855145c5d69be30c0d977bf92def75a841808e535391e215186742cdcd560da961a3a
SSDEEP 12288:smw5HEjsChN8BFgl0WDm+CAMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:JwuxOWESkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 6414f2f7aef9d9f49387260bdba80ac7ef8c11b2e63733012b5f9f27eb1760b0
MD5 b21bc9d246019b6e9c024e5f09e545b1
SHA1 0bdb5af847beeafe121036d4aeb1d3683879dc1a
SHA512 99aaea7de250fc77900d38b9b3ac04e63aa7a4c2338175d7d82f50883a7461e222dd63887480894039aeb5dd3cac35b795062fdeffdbe0df29df8b5e38295a67
SSDEEP 49152:F0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLL:NwfhY7g/rLd7yYA3awr341gQqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 9836fe5bf2c71026be65059185b73b2ee268815f436d2a38ccf27396b5b386a6
MD5 37ecedc002858994477dd7734838f383
SHA1 408049d0c757c6c6f1a78f0416978e2247064667
SHA512 38c1aa1db099c224cde96a428b740a8e6301b4ed5344ec5628a6fba5c2104ec5e4a85714566ebfa776bfa2a428d47b7d7eeed8d7f9f25c21d1f93c1e5c022a78
SSDEEP 49152:uy7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxhkQ/qoLEw:lmYeyxHjWjMThqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

d90a7c9d-db19-4e8f-bb8b-fb49927c1836.tmp

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\d90a7c9d-db19-4e8f-bb8b-fb49927c1836.tmp
Size 488B
SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
MD5 6d971ce11af4a6a93a4311841da1a178
SHA1 cbfdbc9b184f340cbad764abc4d8a31b9c250176
SHA512 c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f
MD5 SHA1 SHA512

Submit Download

97ab3f15-ff7f-45ed-987b-ebffd487932b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\97ab3f15-ff7f-45ed-987b-ebffd487932b.tmp
Size 257KB
SHA256 c9605794c9dc8792d9ae8aae4c4639c07dfcf6bad7fd4c7a768ebfdcae5cfcd9
MD5 a273678de1b0dbf80bb6a4bfebee4b46
SHA1 f78b895bcfaf92944b3f49cc9b6d841b0224f67a
SHA512 65e56f9e3fe665b5411b4e19712e097362fed1f2a3558185042f5c53e7e8b9dd850638f1e65005bcf120bfef73270427585a185bb9a0c1eb9a78e6edf524cef6
SSDEEP 6144:TrI1Qo5yzkpeXjnJFzXsWGQYRPILxZnhLMJjX0EeGzY2rLp:TEjCkpeXtFbqQ5fnReEFsLLp
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 d0c09cff1833071e93cda9a4b8141a154dba5964db2c6d773ea98625860d13ad
MD5 757f9692a70d6d6f226ba652bbcffe53
SHA1 771e76fc92d2bf676b3c8e3459ab1a2a1257ff5b
SHA512 79580dd7eb264967e0f97d0676ba2fcf0c99943681cad40e657e8e246df1b956f6daeb4585c5913ca3a93fdfd768933730a9a97a9018efa33c829ab1dea7a150
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 193KB
SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
MD5 ef36a84ad2bc23f79d171c604b56de29
SHA1 38d6569cd30d096140e752db5d98d53cf304a8fc
SHA512 dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be
SSDEEP 3072:HXm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4g2rJBXCy9enoN:HXUMCm4U6q62MEBi99g6JVCvoZhhl+No
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ca83cedd219e8c54ac54371e9c84905f9975256c589bd9aa186a08ced800db7e
MD5 d444fc0b7b32c8cc551c3bdb3fdbeb3a
SHA1 3efaf8514f028c12037c17f0ce4d2fdf23b045c1
SHA512 7aadb2c183165d6cae2914d5c9cba0f522b7e505b134a9e43c53d02a1293ff3b6d998016f9cf03cac92082ae5e2c16c14fd0a140446427a991ad6794e2e619a8
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 14c0b06f5f93cedc4c83c74bd1d43464ea502725fcb694939630a9410fd15c0c
MD5 d62e9d2a42297494b9b6da6bd8efd602
SHA1 50bf4efa113ea1852ce8e30480cb7ce33c011e93
SHA512 4a6d6721ae69267808f288db522a5103808a095c087f6255f13edfeef7b44aa9990add1206135678b6b6f6b6ba99afc14e553e10cf8e7c602060983a8ead3ade
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 344084632c64b26118da148459712538193852d475cc27a82d793c9d9ffefb8a
MD5 1b1765f6b91e97ab6f6dc719d39bc7ce
SHA1 6645bffea5bbff4de92c1c22e2f4650bae087769
SHA512 77a95fcfb399b51a9886d2481fae66e02776e64dcbc583e8b313f349b1fa10743b7a1a17f574ae812bc09ff684a0f377ccdc4617c32a1f1a559d9bd0a1bb8b05
SSDEEP 96:hygmfaXUDMtciFkJJ1aZ8iZRy7Dx+6MSmueqBODZEUM2MEVMup:hxia4MtcjJvaZ8syh+F6oEUMPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe578db9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe578db9.TMP
Size 2KB
SHA256 d5bb9e1c53b6d6dd67dcfdf3963d7d8b0dd3094ce6a86851e8b8ab7d3d6f235a
MD5 6c38709f2b92b4197d45f6df3df81cb9
SHA1 92d1adb3512f085dba8c03ea68d926704ebbbda3
SHA512 3cc01f22a75c283dd55a4fc9b02211776bc1246ae7787ffeee21a25d0ea8ddaafbb70cbe8d0976356fcff59c9be8e9c178c15264d2a44df3653bb1e03fe41bf9
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 d378f12d59a82496bf070a79ed6719a3d90a4b64fe9d431a476b6679c4844709
MD5 3a17a8125a5f7cc4bef8d2b566bf1a7d
SHA1 2ca35fd969d4ac237e1567fcdb7f38a0d8fad25e
SHA512 8f740b478f654431e08f5b1dd0993b1c73b70dc4d821b8b54ce15557b947c369613075dd05c69adc252d8ee0db6c5eb3c137c800392dd44c281023701d3276ae
SSDEEP 384:O2TBLPLeR/X9f1kXqKf/pUZNCgVLH2Hf9kFrUisHGiznyo8k:O0BLPLIv9f1kXqKf/pUZNCgVLH2HfqFG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 5f7f469538cece141903b87a3ccc185ac9b331d6139dcc2e61a57b7565992d7c
MD5 12be17a045d69a2c9f31009ff6976dda
SHA1 903bae0db4d78afe1f714f2bcd644f0c4a96b886
SHA512 e80013634378657afad3d1eb5ff62e39c5080ec5dc865adb8aaa247e3b2960a1e2ed94ae383d161baabbf6d1d3894eaad985c4a97dbe9438871fd34cfa6fe23f
SSDEEP 6144:bEjqROURUDz68XPsuwH29mrI1Qo5yzkpeXjnJFzXsWN:bEOTUhXncEjCkpeXtFbR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 1f941d197f1c93070a9c8a826b6a5664f05eb9f0db86f0fb9d09abd409826a63
MD5 77d6cfbb85d0b4185fd2332c90125637
SHA1 4def217495eb8aeada21a9e78bab9b5dd96a4bc9
SHA512 46f5d00aed4719996b52e6aaaa50bf0e6b064e54e7555d2cf932f973295568630418e84d7cdcc8b73ee5b37c0730299f5f5036709579eb8b31de858c5e74a1d0
SSDEEP 6144:kdNEjqROURUDz68XPsuwH29mrI1Qo5yzkpeXjnJFzXsWN:AEOTUhXncEjCkpeXtFbR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 91KB
SHA256 63da5b07dd51cad1e2c2bdefaf35959d184b0e0ec3e32be76312d19b550f7544
MD5 8bd374ed66e68b2806cae02db39e8e44
SHA1 13e941e1c19b856779dc38fa8f0543aaf5a50e09
SHA512 995ecba6f0b776615ccec5b787e1c6098e80e39ad8811eeee31d068a64d9ca6e41cfb2205d8c30daa60eba3fed3181fd72c2af5a7633525244ffc9fcc8301302
SSDEEP 384:EU70xEQfQwgwaEjlFzxuHOsLpMcpb0EeG2b6xGGsKTN5bdkCsn3Z4eKgzJZXagoR:WiQm1Y41IrW5rI7uKPO5z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe5802f9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5802f9.TMP
Size 88KB
SHA256 1afd27a84955df1873180bffeeee8b1a6c005b70109f32a4eb7587dc58d0c686
MD5 9032cbb2210ceea74ff558ea0cbcba0d
SHA1 bf6fc6633605e0477ae140f5064759677a4dbad7
SHA512 a471a166fd27d0c599241d5a3f7ce1f65214d49635f958ed6d816c54ba6ac39521f2d106b0e067a05192efb6b7cc17f4b48d5807f96effb61400017b85e1b829
SSDEEP 384:KU70xEQfQwgwaEjlFzxuHOsLpMcpb0Eejb6xGGsKTN5bdkCsnL4eKgzJZXagoqSp:giQm1Yq1IrW5rI7uKPO5L
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 8KB
SHA256 ccbfe3274b6b732a327fbb51fa0b288752cdc5a929fac9cb91e47492fc692877
MD5 b30f214e38855d719951ba6455e4a97c
SHA1 9d13dba3c23f2254171b0a9f186077713c877c4b
SHA512 04e9fe2f18bf714f12375193a6bd82a240402838559d727ec4f5a27ef07813d1f839c1d07cf322b643aed544f4421ece9ef6a5f46ed272cb51416f000b74e93f
SSDEEP 96:X04v+feybLGNAwK3yK35EIU4UTR8nsXwK2wbK2Wl+Syfn16EPDp0f+wK3S:IbGn/gU98nET6G0rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 8KB
SHA256 7259e9d3916879b21117554ae0d5d1b111292344991660f6f0591ea64b44821c
MD5 eaefafa17afebbc7ae3893ffc31886da
SHA1 1a17ababbc43973d7d92ce9de3110d2538b0407f
SHA512 6a338f832ed657c488b8a29893a3f0d115b70a64a0a7008dbf2e009d98039bc768991ac9e27068d4490d9c3bbfa9e00558a6cb17a6d5aa86cd1b11e090e8737c
SSDEEP 96:X04v+feybLGNAwK3yK35EIU4UTR8nsXwK2wbK2Wl+Syfn16EPDp0f+wK3xK3rT:IbGn/gU98nET6G0rUg
MD5 SHA1 SHA512 SSDEEP

Submit Download

4820a8adc3136770.bin

Path C:\Users\Admin\AppData\Roaming\4820a8adc3136770.bin
Size 12KB
SHA256 be81caadc351ceea038824904ed5a8a0ea2304d8a83311832e3459a5f99b8451
MD5 b38f5b4add47539ec0a6351fd3984afd
SHA1 e0bde59ac6a676020d3d0eb62ed01cac68e69c75
SHA512 9119fbbd007f4b7c7e2616cf2562d75f0f81eb4c58dc6ac8747cc08f2db799d05c5b654aca263c9d36da83ad7bf5c9e94d85bb1b2d8c0ee770fba1f9c0ef1332
SSDEEP 192:f7Eqbpty4rX5DEqqNV4m7dFNtwGbecihIB/AF9NRnsAJRdPQP:fVplpDEqqNWEFNtwDdI1AF9X1ZPQP
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 44881821280434b4e336e2419cb1178b31685af5e45746622e936024cd2a2f03
MD5 c43ded434172ffda42bdb18cbee72190
SHA1 b441806f2babd3227ca222141fdfe9fea2523ccf
SHA512 9768144dc862ea598852fc413cb4eb2ea57ff8d3763255b4523aa6a40c7b72068106aa6a50038db9b188e79369a8b59034cc33c3aec14382ef25ff23e9f9c0c8
SSDEEP 12288:haMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:hPSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 05a885d52639e78843d89e3715c59bc6189183718dfa01f19fdfb85f46f811d2
MD5 e763834d24cbde4a0c6a21de4a68592e
SHA1 aa64c593b12e20aa2e9bada2c8449156330c39b2
SHA512 fea1f6118ff16493d28c8ddd7721e943285e735788f49a8720215b4f23edcd5f872609cd4224c8e644a3f1b1c099a584017c741a1f6c2b69c0e7ab55b88068dd
SSDEEP 49152:Va0h2GEkuAe73q3pp46zwwQAkQ/qoLEw:Va0hNYG4Jwpqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.2MB
SHA256 822aed7b2b3361815cd36c6cc555ab3858681c20c5fc07178b2c610eae21bc6d
MD5 17603ca8774870b4bbaf26ea05ca91aa
SHA1 745e3f9e3929d19971bac1a32b10ec526ad41dfd
SHA512 69cb2f5488800624a21699c70dcda75a0ff6f403a014aa84f9994d52941e98d8302fd807e96809fad75a090182678068fa378d523cc590d91190ca1eb70bc27d
SSDEEP 12288:ihbHjfX3MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:ihbHjPcSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 b96fc4551f4427ead5d72ad7e12511c3f49cd9426e171c17880f382345d5762d
MD5 0d8beeeeee4974e8993d50d4ba684754
SHA1 9d5b5dfdcddd655c145fa0f842f13f347992cb2f
SHA512 dc8a4839c6fd37dbe97f7905109e74ec2454ed2a2b44021bb5d1679db2e59fb283cf0c581f64b802474559082e0adfb74d8d88876ff33c450cbe92f930b3515e
SSDEEP 24576:R3YgnJcRTk4yti+R5dpR/ESkQ/7Gb8NLEbeZ:RIgnaTk46ppR/9kQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 b0736adf3c7d99c30e04fb0f55a0c4e25550e4fb7d74a3682cadd0084064f80b
MD5 fd0fb73a1cd00d1a840740208bcce22a
SHA1 b2dd41dd1b9b53877af0d5e4ab83d202898570f9
SHA512 17bbaf1302930cbe53260a0a034cfdfcf9adee34a220949c813f907bb696ac1a5ee3029e4d24323c8eb594c4801a74f82b1a3c4718f45f939b23018acabc3103
SSDEEP 12288:BuMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:BLSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 5f72b3dfb42d5bc65a257d67184f02e052e63851e19f19fbb420e40c7305a7a9
MD5 5ee92049491edb156e1e27456c80bc2d
SHA1 2655246f27820c36b0edec04fae1bec1665b87d5
SHA512 7c3cd670fac25c3524fdda7a613d2d37cefa0bcc0222e1f41e11f7ed5316514c0c7a5131f84189d9323559b52e7dd443d3c32cc1ddeaf1388875380fe9c33509
SSDEEP 12288:LOb3A4LWOsvAYFTJMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:UTL3UTySkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.2MB
SHA256 a9233f544d4e0c3803ddbcc78999d7b6e3c9e8b069842f2fc49208a538326a7a
MD5 60f2cc2f89328789f691552c445f4531
SHA1 77dccca4371f1be1be07cc8ba9cce23ef648031e
SHA512 67ed4aab13ea50aef3de6721e1a54bd2deb80f50719c91485c738b5a7b8d5d2978464f7b0910e60b4285d39781d9314b4fb2c691523981d7d25115d40d357ac4
SSDEEP 12288:ypFtIONMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:xOuSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 511b39c2c9982105fcd8c62348a190db9d81b3491e8eeb6d11086af1f7614e33
MD5 f090f8c8e872957154b63a0578fe05fe
SHA1 5ef9f4ddb6657193ca892b4c977e35da17cfd510
SHA512 cadde31129fb002e255c9e650de29c9279b684516fb2071489672fad5cdbbe51364fd5bf9786570378f91d862084072eb6f4d7b2b17372b7cb3c423172b55073
SSDEEP 24576:f7NM9YmZqmWMUkPjZM48Mv6bEhsfSkQ/7Gb8NLEbeZ:f7cBWMpPjN8DbEhlkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 cd7bc65c9859ee0cd31b43e8ac4e782241c31fbcef69eebec5f621af929a2d46
MD5 5e8e04e1657f27fa8b63472fd64a4037
SHA1 cf12ce7512e783ce01fab078d128e5c01a8180b5
SHA512 278669631b9926f0fe96055dd325e422ea208b3a9aeaeb91f059e0d56704355f03f4ac31a0454071b749f51dc118cf14a795fbd0d209a0e418e62eb729aab54f
SSDEEP 24576:CW6BApg2YuyuNDYTabvcRvNYf8km1xSkQ/7Gb8NLEbeZ:CF2YuHNETovcvNYf8km6kQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 3a65b0b20fba35233b7235a4eca284d45e415d3564c4c057b0ee3c3f82ea42be
MD5 b9f96965d29eb84e5344d51b8a523dd9
SHA1 573c6c6c1de8c7c1a52d1fed10570120f3ba355d
SHA512 123e7477ac28088bc15029eefa553e43120c38cd341826c0dfa5c7f5f6f854110a2400601cf8c99d308e7bb937bf95d99713b2cf1d1437e0efcc86848070262f
SSDEEP 24576:1AFs06+Omlf3NXEbToKSkQ/7Gb8NLEbeZ:6Fs060lVXugkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 b6568adc94ed8c4874033c56676231e5ac22c7abd7ddcb922c86a57e8fe1d7f9
MD5 84a54451f8d53a2363fe2aed3a0822ce
SHA1 e44ad8c88c9c107d5b91d7062bea7d18d80db4dc
SHA512 635141f58e09b3d77c173f3271f988e1171a743cbfe26662ab9f4b0ce1f4b6a97dfea0363bdae73fdc066190d390414b54c95fec4ea479acdc88bc429e9f23d5
SSDEEP 12288:uCJnJ5D3VkrzzxKMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:/JnJ5D3WHtSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 e7e6ca319954034944888c34ae22fa0af7da0406d2895010550625fb600be4a9
MD5 b84004d9d5106bd868fab86f3d605079
SHA1 9cb2448b4c4d25cd0f1811d6ac79c0e3f885f0cf
SHA512 2155fe40958448218af63377ab141b1d6e9414d8e9372fa23775123d2d0af9fa3e0b7c4c891567e4abe68ec6592227e3885142485dd7e9d5ab6770927b3aea00
SSDEEP 24576:dEPohm6/7IIXdwcXrif7qQncjlP65i3VuESkQ/7Gb8NLEbeZ:qo06DIKdwc+eQnSt65aV+kQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.2MB
SHA256 fc32e3d1dc08e7d3e6134eac7072ff3e326eaebbc6199e5a5f77f230e663b8e7
MD5 4b09b14da5650081d6f2386bf7a5beb5
SHA1 faa71bc9d89277e963e6ac00314bf9e6c1947402
SHA512 c2cd28929acd9ba12957dffad6d769343cd108df508fb9c16903a7ed34591001a19b422c210da38b199fc6323066ac64604cc8f40c1c1d5654944988bc4a01de
SSDEEP 12288:qEP3R1fMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:J10SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 ba8c781e742bda0bc8041afedf0905725159d89f8aab1f239e0f0857a3150c9d
MD5 3a7dd18e0462dbfd0651a80bed61d098
SHA1 ef535b228daa8eea57ca9397345bc7dbedee7d3a
SHA512 fa983908b404bcad21cc87d113c6fa22f360f7b972526977b335a3e851d6e872efab199bd53cb479cb389a3ccea10ffe0b0057dbf9ac58516069ab90b60b9501
SSDEEP 12288:AjkynMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:AIyMSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 a635cf4313b8066308a1ca3871be50a888d79bd7d6d7c3e1a1426bbc375492b8
MD5 5c699808978e0ebdf8a2d41d0cf75422
SHA1 6c1087c38af2139dc539e101ecb91dd73ac71acc
SHA512 75db9d265364344c5008646904ad7a073657bb1459797d35a69908999bcbacb0c9b020c949a2b4a142e3b4a2f263911e76c749e0bd31d1e133e56e93f14c3eb4
SSDEEP 12288:1K9MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:EeSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 aea7191c33f5660ae641e641cc78daa60831d124cc6e24ec33dd32d9d3749a7e
MD5 ea68f1f9e572206e2a07aed942609dd9
SHA1 624ba6b6bbf13fa5f10ca31f8ef5069d98ad76ec
SHA512 dbe4de3501bbf1f81609d0592b0c7f6fa7c00e0345f999716d4a59ea5c4c8681c68b7c83cba6ee0a8dfe98d87a2f0e55bd88e54f0ca0df48b9f51e4d361f0cdc
SSDEEP 12288:1LQZb3C97GYnZMv5zBcKY97MD3yMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:lQ9MxZKdcz97w33SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.3MB
SHA256 6e4a0959e91901483178db21a37fb9d02a021ed825ea6bc3af35c796edacdb51
MD5 0e100ee428e03fb4f9664c82728163d8
SHA1 164814a01e281cdac89d00992d2f0e29052ef7fb
SHA512 1267da7155d59be61962e7ed2cacb507195b8c944bad3b4ea92fef0f1741a62f1b7af9aae84fef821e7a1560d961970bed4505e01b57eb4e7ce62fc4a46732c9
SSDEEP 12288:UyoKo2tRple9p7MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:UyocvApISkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 da348697a400b0dcb83a247cc83a33f90d0db4b0b9128658d704ebfadce15bea
MD5 432a52c45d8b374731cdd53f5b22cd48
SHA1 3dbd74a392ea5b59cbc74e58b9a56e821b2b4730
SHA512 76e1343fc8732622375dd99adba6a66abe84ca085783d1304300c04f05cbdacca6748be54fef1d3b3ac65d567d9686fdb7ba4c262b886251d71d78715c7dfc14
SSDEEP 49152:yWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKhkQ/qoLEw:k0zuNItqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Windows\TEMP\Crashpad\settings.dat
Size 40B
SHA256 b04e4a8229ad76f418899a184586a34f1da04653efdd8f0386b76fe7282bd7c4
MD5 8323eb783d4b3475bc1107f7b22fe30a
SHA1 8b61ba2d4ceddcce64913e45b0b3aaedba641153
SHA512 a6e5fa59549dd9f848741b7c5e0e99e3efd1ac639e61a1a430fe7a62e6f13bf625fc22d619b29e9319f0bddd46eda6bd61057d4afcde7c846a72bf6e4ef79972
MD5 SHA1 SHA512

Submit Download

memory/980-404-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/980-661-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1036-377-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/1260-72-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/1260-59-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/1260-74-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1260-53-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/1528-43-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1528-49-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1528-370-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/1576-392-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1736-375-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/1760-399-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1940-69-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1940-63-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1940-372-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/1940-474-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/2400-39-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2400-23-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2400-29-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2400-642-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2560-386-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2768-373-0x0000000140000000-0x0000000140150000-memory.dmp

Download

memory/3120-10-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/3120-19-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/3120-21-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/3120-639-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/3176-376-0x0000000140000000-0x0000000140142000-memory.dmp

Download

memory/3752-385-0x0000000140000000-0x000000014012D000-memory.dmp

Download

memory/3812-397-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3900-608-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3900-384-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4216-398-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4332-391-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/4404-216-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4464-659-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4464-82-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4464-371-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4464-76-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4544-379-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/4612-403-0x0000000140000000-0x000000014015D000-memory.dmp

Download

memory/4612-660-0x0000000140000000-0x000000014015D000-memory.dmp

Download

memory/4876-6-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4876-12-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/4876-36-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4876-37-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/4876-0-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/5012-98-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/5012-86-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/5172-555-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5172-779-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5432-568-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5432-592-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5520-785-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5520-570-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/6016-534-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/6016-603-0x0000000140000000-0x000000014057B000-memory.dmp

Download