cbba4414dbc3a4c0051093d2ee156d9218b44b6d14a54d204efc159c488609af

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 10:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
Size 5.5MB
Sample240531-mjpsjsfc94
SHA256 cbba4414dbc3a4c0051093d2ee156d9218b44b6d14a54d204efc159c488609af
MD5 483c50c34fbde792c6ec92d5ee011ea3
SHA1 3ca752c5a576a2539b6f83cff5b0810ee9c40b9c
SHA512 a24e6630bf9c6377686f72e2336cde6b7da50e4ba9b5a13c0142c7aa796e52ed432597778a1e83370fb885bf7fe3482bb72c4a014ac86adfe71958ef8c7ed615
SSDEEP 49152:GEFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1Ln9tJEUxDG0BYYrLA50IHLGfT:8AI5pAdVJn9tbnR1VgBVmfdt6N3u5H
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
840	alg.exe
2608	DiagnosticsHub.StandardCollector.Service.exe
4680	elevation_service.exe
3064	elevation_service.exe
1376	maintenanceservice.exe
2620	OSE.EXE
4616	chrmstp.exe
3980	chrmstp.exe
3676	chrmstp.exe
3092	chrmstp.exe
2968	fxssvc.exe
1464	msdtc.exe
2344	PerceptionSimulationService.exe
1032	perfhost.exe
812	locator.exe
4432	SensorDataService.exe
1368	snmptrap.exe
2684	spectrum.exe
2252	ssh-agent.exe
4164	TieringEngineService.exe
2976	AgentService.exe
4748	vds.exe
1652	vssvc.exe
1576	wbengine.exe
468	WmiApSrv.exe
1700	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7a718c23e703f493.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110750\java.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{4EF9C35E-DC0D-40E1-941D-AB9119298CDF}\chrome_installer.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000002a89af45b3da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000004ecacaf45b3da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000311876af45b3da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000097e628b045b3da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002cd7b8af45b3da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133616250059977317"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
1804	chrome.exe
1804	chrome.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
4456	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
6068	chrome.exe
6068	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2264	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeDebugPrivilege	840	alg.exe
Token: SeDebugPrivilege	840	alg.exe
Token: SeDebugPrivilege	840	alg.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
3676	chrmstp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 4456	2264	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe	82
PID 2264 wrote to memory of 4456	2264	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe	82
PID 2264 wrote to memory of 1804	2264	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe	84
PID 2264 wrote to memory of 1804	2264	2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe	84
PID 1804 wrote to memory of 4844	1804	chrome.exe	85
PID 1804 wrote to memory of 4844	1804	chrome.exe	85
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 4652	1804	chrome.exe	91
PID 1804 wrote to memory of 2004	1804	chrome.exe	92
PID 1804 wrote to memory of 2004	1804	chrome.exe	92
PID 1804 wrote to memory of 4656	1804	chrome.exe	93
PID 1804 wrote to memory of 4656	1804	chrome.exe	93
PID 1804 wrote to memory of 4656	1804	chrome.exe	93
PID 1804 wrote to memory of 4656	1804	chrome.exe	93
PID 1804 wrote to memory of 4656	1804	chrome.exe	93
PID 1804 wrote to memory of 4656	1804	chrome.exe	93
PID 1804 wrote to memory of 4656	1804	chrome.exe	93
PID 1804 wrote to memory of 4656	1804	chrome.exe	93
PID 1804 wrote to memory of 4656	1804	chrome.exe	93
PID 1804 wrote to memory of 4656	1804	chrome.exe	93
PID 1804 wrote to memory of 4656	1804	chrome.exe	93
PID 1804 wrote to memory of 4656	1804	chrome.exe	93
PID 1804 wrote to memory of 4656	1804	chrome.exe	93
PID 1804 wrote to memory of 4656	1804	chrome.exe	93
PID 1804 wrote to memory of 4656	1804	chrome.exe	93
PID 1804 wrote to memory of 4656	1804	chrome.exe	93
PID 1804 wrote to memory of 4656	1804	chrome.exe	93
PID 1804 wrote to memory of 4656	1804	chrome.exe	93
PID 1804 wrote to memory of 4656	1804	chrome.exe	93
PID 1804 wrote to memory of 4656	1804	chrome.exe	93
PID 1804 wrote to memory of 4656	1804	chrome.exe	93
PID 1804 wrote to memory of 4656	1804	chrome.exe	93
PID 1804 wrote to memory of 4656	1804	chrome.exe	93
PID 1804 wrote to memory of 4656	1804	chrome.exe	93
PID 1804 wrote to memory of 4656	1804	chrome.exe	93

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Users\Admin\AppData\Local\Temp\2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-05-31_483c50c34fbde792c6ec92d5ee011ea3_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2d8,0x2dc,0x2e8,0x2e4,0x2ec,0x140462458,0x140462468,0x140462478
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbaa27ab58,0x7ffbaa27ab68,0x7ffbaa27ab78
    3⤵
    PID:4844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1892,i,3662298772317904065,10128120240846167290,131072 /prefetch:2
    3⤵
    PID:4652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1892,i,3662298772317904065,10128120240846167290,131072 /prefetch:8
    3⤵
    PID:2004
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2080 --field-trial-handle=1892,i,3662298772317904065,10128120240846167290,131072 /prefetch:8
    3⤵
    PID:4656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3028 --field-trial-handle=1892,i,3662298772317904065,10128120240846167290,131072 /prefetch:1
    3⤵
    PID:3616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3048 --field-trial-handle=1892,i,3662298772317904065,10128120240846167290,131072 /prefetch:1
    3⤵
    PID:3200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4292 --field-trial-handle=1892,i,3662298772317904065,10128120240846167290,131072 /prefetch:1
    3⤵
    PID:3828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4248 --field-trial-handle=1892,i,3662298772317904065,10128120240846167290,131072 /prefetch:8
    3⤵
    PID:680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4592 --field-trial-handle=1892,i,3662298772317904065,10128120240846167290,131072 /prefetch:8
    3⤵
    PID:3852
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4556 --field-trial-handle=1892,i,3662298772317904065,10128120240846167290,131072 /prefetch:8
    3⤵
    PID:3312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 --field-trial-handle=1892,i,3662298772317904065,10128120240846167290,131072 /prefetch:8
    3⤵
    PID:3664
- - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    PID:4616
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
      4⤵
      Executes dropped EXE
      PID:3980
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:3676
    - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
        5⤵
        Executes dropped EXE
        
        PID:3092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 --field-trial-handle=1892,i,3662298772317904065,10128120240846167290,131072 /prefetch:8
    3⤵
    PID:2036
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1012 --field-trial-handle=1892,i,3662298772317904065,10128120240846167290,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6068

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:840

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2608

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3064

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1376

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2620

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3164

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2968

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1464

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2344

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1032

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:812

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4432

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1368

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2684

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:112

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:4164

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
PID:2976

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4748

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
PID:1652

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
PID:1576

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:468

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1700
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5268
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 e8aab142c9ed29dfc75c45ac3bc4cdaab5c351ff79aa804fcaa6579bfff03c01
MD5 384f25052a00f3bb5fd705eae0e039dc
SHA1 f91f169cfca27e248ae8cde07ba2ca41c6fe9b4f
SHA512 7dd55221a465a0c4adda27aee58b9a6395302cf355ece24a4567999658a30efe2b478fa1dd10f084cb7e45f531ab356574350dc35a47f8725c155738cca092e3
SSDEEP 49152:BuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5usdZz6N3Q6itmOH:BPfTqi90bLdt6N3u5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 cb939f7a7b59f39ab357c5c103a2260c4aadea8cf38e86b1736ac7f57c8dd52e
MD5 b38f860dee76ce5816836342accf005a
SHA1 ad5a3e9a9074194c200602a1580fd4d3b386d0d1
SHA512 edb2f8ee5a7ad86292b6a958f76ffd2fb739bb9be74d4cb2e050a821a4c49b5797e3a414d7341792629905a12755ded30d5746aa5341606218dfe49db2718f21
SSDEEP 12288:CcQiQmNJLBsunEPf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:sidnBsuEPsdZCA6N3Q6itdsOeg
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 33c10f824d40b0ef37d603f3c61b3550fe5c34e36ed3ad5a065ed40370e2fe28
MD5 4d6301ec546001b4036a59b1784d6e46
SHA1 c26d447303e9174df5e93f911127ccb7d08aacdd
SHA512 83c6eb852d6242c5aa946c6916c33a2789fb2a00269c02489c1bbe1afd4bbafe314369e9ee373538a1edd04dcb445d62185acd673c0888767c24c22e1a363044
SSDEEP 12288:77a3iwbihym2g7XO3LWUHfh4CoTf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5Qq:a+gkEVfh4CoTsdZCA6N3Q6itdsOeg
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 062b265a055ec56a22f9913985627299410770d30c0b7b0a398198b44f047076
MD5 ebe94707d458726dfba6e2e86b98db4b
SHA1 03a554925c6fba04bfe4dd44f52fdf87df377df4
SHA512 a753de17914e3679027ebccf3f577fd803521052e33fec4aae84b13b7aae67786280904f7704364cfd40a3331f1a65867146b53b4f8091884e43b986cf3d1d78
SSDEEP 24576:1BpDRmi78gkPXlyo0GxjrSsdZCA6N3Q6itdsOeg:/NRmi78gkPX4o0GxjOsdZz6N3Q6itmOH
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d03a67af4ede948f75fa5613a32b33743b9f272eefdd5e50e3b8e742c0296018
MD5 a1d83609d33f12fd46580d4787a854df
SHA1 6700e8e47ccadda781f666faf884d23fe987f0a3
SHA512 0ab11e024b23a96df9e9bcd4dbfd64bec955a4b327d870db89f6bc3f8ba5e623c4f2b021817355d07e7dd65501d530acd080347d0bea046fbac4b3abdbca46dd
SSDEEP 12288:afC6Aj+TN5uixZN+8rKhUdTC/wE1MD0Ca5ZIXVTf3SBPjZZQOcPskdzM0DZdwPCc:WLOS2oyPIXVTsdZCA6N3Q6itdsOeg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 2272789a8de90d948a3f053bb9e2761cb44ef23cc70c65afe0edcfd1abf66736
MD5 e6b8067030720c88cec07460d577ce74
SHA1 c2abd8f1e85bbd17e4e52dd01a14a72c3469bb1e
SHA512 52a95ccd809c3c89a134b4380095852769e563214dd264b26096cf1b469deb7114e89ffb1f93bcc6762b333850a99400001bbf1f47d572cb3dea5ff8064b828a
SSDEEP 12288:4fRf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:4fRsdZCA6N3Q6itdsOeg
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 8896d499e1ea729b8f5ed222e9c0aeca833b1a820e278b070a1bcbcc385c7853
MD5 37d79492f92bf50515967d9924acc366
SHA1 3ad25965abf63cce1a7cac1158947d0db074ac67
SHA512 e2eca98775a2dbe7ccd7548af0d75f2cb8144c1523f016e8e8461fcbcda6c68eba3d1cf41309f060a04f8add32f7e83da539b9ca490da94152fbcc2a7cb34fb8
SSDEEP 12288:teBNUbTVO86UYf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:tJIUYsdZCA6N3Q6itdsOeg
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 04643009d9f6012d5a96c623a5f86d5a1dbb44be687b4165fa352f4d4c8a0b17
MD5 a8e4ed21b8781ae370aa46ccb948d0e8
SHA1 bc0af39e6d07984af54e3ad81db2453118dc4eac
SHA512 e7f84eb38688187a9edf633d9426796b079b483b6085d3dd8d17fceeb13bef6444ff18c6308fba63bb7c5343af173618a1588aef7c17d10e46b7c5acd6a9ebd5
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH3:BQvGAdlCEL8c/yRNw5CMdt6N3u5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 4f01a13386bc693d6dd4340bec7b91d59d64bfb34e9be52033c17e473ef31d71
MD5 8109fcb2dc035aaf19571daec2f049cc
SHA1 ee84bd3441524e1686fa8eaac711fa70de4fb3c6
SHA512 cbfc12ae7efcffc604dcca94527c12e912a54bcf9db9e21dcdb88716564887fe5e7d9b152f7ad8d43d04995138927d7d0d618bc311b4d4bde21852a414219d00
SSDEEP 12288:/AwSfxL/2Dc34DLLmt0LDQewsAjqf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5v:IdewsAjqsdZCA6N3Q6itdsOeg
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9d6063762f89de97f8b8f56ffc27c4187ad899a2de4da2973ecf0d7a1bac75f9
MD5 2a5741591eb106f783c24baffc05b66c
SHA1 7192a79607bf7dd863c8d73dff3a55c4aff0b003
SHA512 542aee290421be84dd73d76e521efe687b830bedf0fa4b479146afd4e2cd17db87c27d150be7785eb09eb5d65f608d3c56ac5db6156df61a84a25e9db889590b
SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHxtE3m:2UEtQevvqc2W1cpV2EI32k
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 58f9bc0c7e7d4621fcaa03a244089de3026f60c5a7390eaa91a92b9743d9931f
MD5 c583fcf381d2be2b7aea1c8451996bfa
SHA1 c872de8a6ebcf44cf2b13f3b21de557ec3a2ff9c
SHA512 678d5a0638afd1cfb1f92a2f1662f2e78b7de0cc46f6a6e94d87423cee4879d9605fb7d476f2351dbfbb7ee9579fca1c2a2f216f4b6eb8485babf6a0032b54f3
SSDEEP 49152:gCbRquA/m2yL5zTfFiV+XenmE3/zKsdZz6N3Q6itmOH:poquVjnmodt6N3u5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7096ffa44f08befdc38f428392acd8382cc4d372daa0bae458732ffe532e5dc3
MD5 7d266dbe558ec2016afceabd31527445
SHA1 93a6efffcf2feaf9fe442c9969247f3cd3175472
SHA512 e517c29c4deab7efb820b040f48d54a8b5c908d27731d6cee694526aae699d91e1af019c1fcbb680bd7a2ab2eaa1261c1e0dd70fce7283452fda444fda8e00ba
SSDEEP 24576:CAhGLJIFoiwtA5l7S53jsdZCA6N3Q6itdsOeg:CAMyFoiq5zsdZz6N3Q6itmOH
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 7034a1169f39bda13a788af17d5dd9f2db1df6760f53e0142a753ef70895833d
MD5 23401e3404851fbe175e774dc59ecb08
SHA1 9ede790463c73a9f75d241c40663e4895797601e
SHA512 29761955ad1367b8a63522ac599a3a0143adf80009a2676dd6b08439e1517548f5f534308680d76938ece903d3b457176d6cf78fb80bea09cfce114911574e8b
SSDEEP 12288:Xmw5HEjsChNVBFgl0WDm+C3f3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5Qitdsu:2wuoOWGsdZCA6N3Q6itdsOeg
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 adfd4cc81f765f65ea7d6c34bf4df85aa75cb5e7e1f5978fd405036dfe3e63e1
MD5 bbe52f8397962ef75ca0654bf1ce76eb
SHA1 6dd0d136097fce9ecdd4a71b07e33c7f8d825d01
SHA512 e935a9cf03c817f7436bbcda7ea74dbd0e914291e5adb76549603c0e58d9c7ee1148b23fe04bfcfd514aa9a5d2738857add92f1ee5eb4f54a633c81caa9b4a18
SSDEEP 12288:gBZ1Iyaf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:eZu1sdZCA6N3Q6itdsOeg
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 f7bb34a93ea6232b532b09dcdbc86964d15f36f21fed52fcaa8b6f974d497eeb
MD5 77950e986f712a83eab3bfcafa92c581
SHA1 1867c4b4445d9bf51a43b448d584e2def7e3be41
SHA512 c6feb18f54bceced1edd011650701a653c6d46545d1cbec7d26bc88da1acb1f936173807647d67c7f343d871b6bb94729b4124f1888a93b963d3d0022d50f80f
SSDEEP 98304:ZwfhY7g/rLd7yYA3awr341gQdt6N3u5H:778yhetE3m
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 a1aff5ea979a0f018123b17f3b4ce8089c2c0b37b2f82534e734715a3821ea21
MD5 779cf225a6e8c05e9939b01798ce1a16
SHA1 48e087d282e45f82568b0c3149f50d7b3a75269d
SHA512 ac1d7ac4c88ef074aa25f55d37dead6fc4f62da993b24bd6dc0c8f39e1a3fb89b949f278fb9ae1c07f7605b3d56cf2b950ebb766f7292697184e86821914c5ab
SSDEEP 98304:xwfhY7g/rLd7yYA3awr341gQdt6N3u5H:T78yhetE3m
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 1716a54f56bb47bc85af24ad6bc8ad9a92f19d406e711c61b59878a0615b701f
MD5 117fdd09ed0b59a214da6ff32fb81e48
SHA1 8c0d34b6910e6244a5adfbec05f0b7ea5449f7ad
SHA512 145b50150dfd593a4defb073db0a216e0be350b63053fba70774dc362ff681ce24fc8066a5699066ca664edbabd6b312db5b21eb92f91b1afe29acb959b15124
SSDEEP 24576:wcTyYv0FteQU+5I2kjgD6iQacAGsdZCA6N3Q6itdsOeg:wuXv0Ftpn5606zOGsdZz6N3Q6itmOH
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 273c3e2f194741ac89e6bae4298e2fa51141101cd00b19810714080ad8178443
MD5 b1905cb7d79d96821a40f3d8485eb2ab
SHA1 3025aa8bd1a5c408115338c59b7d35b2d571bbfb
SHA512 61c1630f4d00887ee3a9a37d8a846c694605b4b3ab7f8e249f114d424b7c9468fcdfba1d634824afc2981d63a63733ba9b5d03be039b411c7c0c27ad1fd3c759
SSDEEP 49152:8y7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxqsdZz6N3Q6itmOH:bmYeyxHjWjMTLdt6N3u5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 df0cb155bc4bd7bf22a78e1668b6a7a24a799e912da46dc4bc9aff6fb52b37ea
MD5 7dc4f628cf2ca33048a1c7a3d6a18843
SHA1 09eb0d5ec85f10b1478018b908030657e952b062
SHA512 99399a5c68cd81005d7c18851da6f32beed67b0596f6af66ede00f6d5d6da5ddf230eb8e5aaad708888a63427330bf69bc837494f810c79f872d4bff3053c091
SSDEEP 24576:N6drZn1WEci182IEUeNbJeRgUebgW816tsdZCA6N3Q6itdsOeg:NWnDci18yNNUgbYusdZz6N3Q6itmOH
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 f2a277f0b92cc9bb8f9d2a3d96e60cbd9510d1bde02f0148c58e5b7767ad965d
MD5 54d839744f7aaf7c9b4f20d03728d591
SHA1 2c9bf120b29132ef5d93e95a9da83032f39a7674
SHA512 9cc8f54781c9d50ae26994a269d5e1d5de0d399fd39e6bb0c1784761572f8d7e2c5aaec84b6328aabc67e13bfad99ae5a1474652ba157d3f06dbde1612b4f8e9
SSDEEP 24576:Rk5lHW5EzMZupO80G2reD+melRgTTv/1ny8sdZCA6N3Q6itdsOeg:dizMZm0GhamSo1sdZz6N3Q6itmOH
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 28d47ef41a9da446bf4b590d63406982b0b68559e9e559ad9c010ebb816e2a58
MD5 d0d894fd11efcbf606f88837651f493a
SHA1 5c989a347a60f1f83ce96457701a6915de3d3618
SHA512 1afda761926528cd54c60bd5c0ea31d381b45c36d0d9c4c550c086193a1e320e58d7e17d33fb09428364194390dced4544e55b2a476e3128ca598d53c630558b
SSDEEP 12288:f5f3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:f5sdZCA6N3Q6itdsOeg
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 90a900b23a03a6b04f5a2aa864078b8674f8e3a3a702decf8171111c5193f736
MD5 414fef96c57cc3c2e547c385c556d9d6
SHA1 2abae4f02e76939912b12b3b04066d2fe514f7b1
SHA512 281f54529d80ae2be8133f2848b8e008078cc56e2d622563d86bcbd257de1ed48591dcd36377f33d1ddde91cf881693ce9b8bbe59f08eafa5ba4d50b76d5d816
SSDEEP 12288:EUFmDDLkf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:2ksdZCA6N3Q6itdsOeg
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 4e5ceefae11a45c397cde5c6b725c18d8c63d80d2ce851fa94df1644169eafc9
MD5 d0df793c4e281659228b2837846ace2d
SHA1 ece0a5b1581f86b175ccbc7822483448ec728077
SHA512 400a81d676e5c1e8e64655536b23dbae0a0dd47dc1e87e202e065903396e6a106770cec238093d748b9c71b5859edf097ffff2e088b5b79d6a449754140a52ad
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 193KB
SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
MD5 ef36a84ad2bc23f79d171c604b56de29
SHA1 38d6569cd30d096140e752db5d98d53cf304a8fc
SHA512 dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be
SSDEEP 3072:HXm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4g2rJBXCy9enoN:HXUMCm4U6q62MEBi99g6JVCvoZhhl+No
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 04f997d43457b0367a842160f028e8dad78f2c10988e99de28bd88b09923bad2
MD5 5f87a6a7f34fad275a746489c256a0fe
SHA1 68be33d2fbecbf5a39c18409bf534234a8c65873
SHA512 50c0a2847a6c26f8337376f255cdb342769537aec7099da4bd5a481f7e02181d2418275baa8abf7257646fd065ee8595d9578b90cd9c6087e399d6ae96123967
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 352B
SHA256 c334513053d0e4d1fb755084c06060dee54e5457c762288db842eb8e55d6f634
MD5 f5989bc3bd69dda58657c0c2213729c6
SHA1 3048b079c4f4eac9c7e3eccbd405ed2aebbd99ad
SHA512 bfe2141d746e6cd46287b3ad573d4f2272264faeb0ba4bf069670794a08f7864ff283ba820091a105832277f59e727e6e30008530003e4a8cfe49fcf162af835
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 706ff485e8e3145ce4c7c9322d6637a350e19c747d5ada430e801e16e946bee7
MD5 4303cfa7375c48e8f7154af3869eff28
SHA1 8c9f19a0a6fb2f7db78ca1d44b5e91a724a334c9
SHA512 f287b28c9d93be0d77daf5256576bccb3b7c82c96957b6d38cf63ba2642720e1ec41f044d9c952459626d1d652f7174b0284824dfc9583dca49c5d98c3b73e97
SSDEEP 96:3+0gSqVXE1IxkJy4hOf+M8iZRy7Dx+6MSmuepBOznq2MEVMup:3+rrV0VJds78syh+F5WqPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe57824f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe57824f.TMP
Size 2KB
SHA256 b9d8f68c1f5aeadb1748f8efa21c33a4235cca822bfdf19951d296b2f29944f6
MD5 1d0245a0816fd932b1963600bab98460
SHA1 82d188a3a5fd107ed83000e16e41e0d67eed941b
SHA512 febc999100ab08b73d52fa2a08f7c09cf2281c420762d121150da6cecc922372a9591619163881a5d2956cc20a7bd6d1b5017b6f0575b55ca6baeeaa604632f6
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 fba0b3852821d5574366dd429e847f7aa2d809b6c5f12c11f865923943486235
MD5 71bb6095ce807083555ac995b857c363
SHA1 56624e9497a14e7653b51ed9253c1057624dd90c
SHA512 d22e69131003250af33b391c8411f77c45a508ab91273dfc8ada92cdcd2c80234f42187fda255454074a464718363de52c61889743777030594a022134ad6ca2
SSDEEP 384:Kqo87pLhLcEvh7Xb11kXqKf/pUZNCgVLH2Hf9irrUiEHGm/cW3h:Kz87pLhLZJjb11kXqKf/pUZNCgVLH2Hr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 8d6c1edb5a2b95648559ad5c0859e65e3dd8ffe2f8b1aebe0c25f681c038fbad
MD5 69eede66dff6d4303c0b7bcb059aa403
SHA1 46c08683e1fb9a9d48e01f8f2ed780af225a962e
SHA512 258534bf2f0f68d0e4d30af5c29c41768f6b1ef49c8b527517f5f54752dbde411caea795278454a083b36af3056a21850f91229f61ee4ed261254a85666d0c80
SSDEEP 6144:yXvkOENfkYrkyaqJ1GvF9te35nfC5mgMatpz:KNYAk1GvFu35tgMypz
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 7KB
SHA256 2097ddd205aac6f40b63c41eb57d4d193f4cbd831936c051db25396cd3829fb4
MD5 8cd9aa1684abb73c4975ecf0286a7b6a
SHA1 eb564d54a5c6ca364a10dbe582fd97514031eea9
SHA512 e1431606cfd010f9fe50d1400422652d356c8c680ff7f79a0c7648d80750cb8767e199789c448048398c0941aed8dadc349f8fea2e4ce19003621e6c7c73b926
SSDEEP 96:hOevOJb8A+hDjgFWbwK3erK38DucbE49vwFWrwK20K2luyEmLXYJ:4VFzdrBD3IhFrK/XY
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 9KB
SHA256 86445c0bcbd53822861d02c45d36f5602d40a7d5065ffb914e3e891f68259858
MD5 116ae997bd7ba4019dbb301461854fb7
SHA1 2ab4d044d93d5e0ebe0fe13b4894bcf119f92d92
SHA512 47a7f543f1c8759bf400b0830c8911c0ebacdeb9138b41270f9db50b7d33df3f763d9ef03bd44be08d227c9d8f43e8be1428b875a30277b018192272e02a8e6c
SSDEEP 96:hOevOJb8A+hDjgFWbwK3erK38DucbE49vwFWrwK20K2luyEmLXYSTZEvuwK33K3A:4VFzdrBD3IhFrK/XHELOB
MD5 SHA1 SHA512 SSDEEP

Submit Download

7a718c23e703f493.bin

Path C:\Users\Admin\AppData\Roaming\7a718c23e703f493.bin
Size 12KB
SHA256 6aa98180284e3315fec4c33929c7dc846c5f9429ff5b9728ce2a0f9c358cfcda
MD5 0051f86b4efcca915af80164131c6766
SHA1 17a9cf6879cadfc5d79c721703e1f369e2683ed4
SHA512 38a83077f814ff42941b8f9adfe4296c2bad8b319ec9f651e80e3d3bfabf3dc6a1eb6b15574e670afd158b770ad8f1d0b258d253e567b3da661b3f427a4e1434
SSDEEP 192:98SWErfnTzdcdM7A7CiMK4s0ISkNR8cRy3U18DhmoZZeE90xBqrnOiS9pullV:9ZXT5cO7+lUuR8rUKDU8gsbaTuvV
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 d9670b9665ff1a8c2583c33451590b80f88bb029a3726b0599eecc2f6a031219
MD5 5d0ce4dcccb86c59d9e5ca1ffd9ba850
SHA1 206d63e5265408dea1922a6b1ea707834d03d795
SHA512 f544c9b9dcbcaab17128f6f1824b58b7fe6abb7b94a8b98333deca7f119f4bf5d7372948d40c848757f6f59fed3a0ac6bd6adc791b15dc4883298bfac463ec44
SSDEEP 12288:7Kf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:7KsdZCA6N3Q6itdsOeg
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 17ab626d5afbad823f94a373dd5f2e6f87aebc0ca468ee32f99959807dddf151
MD5 f2437e661e323485a8eca3f6691e5855
SHA1 8bf62f5741c6074a1732c12661ecd3c64f969a45
SHA512 be11e138b5178e413e0fa8974688f9fd37bea29e2184f2289621c035486c2a168013d37e39faf3bf254c4bfd90a19addf807c931aa1d23e59aeffe5c9a561c40
SSDEEP 49152:ia0h2GEkuAe73q3pp46zwwQ8sdZz6N3Q6itmOH:ia0hNYG4Jwmdt6N3u5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 f781ff0055c50f363ff201e70e42c5b0f48445f6d6bc6e4d5bb4409eccd30ed6
MD5 7f0ed0afafa6081932de2057f1dc2dc9
SHA1 6e7910807c4b919aa5b5b5489d496fe588e56846
SHA512 11b2c26498bb91892ca1735505d6d12bc8d03ff68f7ed214950fcd964692a8cd7bdbee2006db126cd6a9956b948c673c8c1e817c0ef14a3f75c6e9a1b1576e1d
SSDEEP 12288:ehbHjfXhf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:ehbHjPhsdZCA6N3Q6itdsOeg
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 2aedd3d3a5b874b290e026145c625ee248c4308aa3cc26ae5745ed2d054f2ae5
MD5 542dff4e4b821e6e227ad98fc08629ad
SHA1 dba8e489142188fb5e46bdef944c47798e074eb2
SHA512 5a432cb59384aef89cc942e6aab2583c0a9ec150b1a5cb1672779f168c7c17cf7ee09527e258016d17bc1a80677ebac8c30464897fdc79fa39a1f2aa15dc926a
SSDEEP 24576:n3YgnJcRTk4yti+R5dpR/5sdZCA6N3Q6itdsOeg:nIgnaTk46ppR/5sdZz6N3Q6itmOH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 cf1a7dca03407d8120ea7876bbf21379e867a61c223a008806dc360eeacf6c8f
MD5 8210bb97e9f2b3660e9754b764302f89
SHA1 3cd9654ce6612675b8bd7bd8c4ad721425381002
SHA512 865a0df42fd52ba8c7923f96d74a04be0a0e12025cedc31ed382d8acf836787ca6892f0f970cbb17b3726f3a3b26b862578791ca0fc6128853ac6b082a815428
SSDEEP 12288:JGf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:JGsdZCA6N3Q6itdsOeg
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 a043d0d069d5c79e27bf3e2216c05dbb9e4e2ef879d15172b2280d7618c3deca
MD5 e323f6d62c933e7d00e7575a1905a004
SHA1 4f554ae634101158ae5103c93a4dd6573a5b386e
SHA512 e73648d1af6d6e1deda111d9bcfa440e1bcab64e97ea572e74e484fd584797cc247e6f17b3ce4e06492a8cbe35c705e09f956edb5a57369d9d00594374f2f2b7
SSDEEP 12288:ZOb9A4LWOsvAYFTjf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:OpL3UTjsdZCA6N3Q6itdsOeg
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 3a79093f3fa67ce58df73a640baabec595e0e6783b7d92d5febc48b3d6be175d
MD5 a75207490b9f72f241ce519ef906d6e0
SHA1 bb840592442e04f1a62fd0f3df3d5c421119ed11
SHA512 4624ee8c3daab4faba375a7b6537eed3ac4c8fa4d4e50f325263678af5ce892fa7d926b76a02f07d84656fe3dbc87cd97536e6d03681c653b63b6de7aeb70754
SSDEEP 12288:fpFtpOPf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:zOPsdZCA6N3Q6itdsOeg
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 82de0b4e6a6371c5ca8afa788d337c9fe8c6ab43142103c77aae7e169a4cb205
MD5 73eec9db024869e985231789bf224420
SHA1 ccef7e5d2d4bda0eb32e678bafddce4128dac838
SHA512 c24dfc77b04781e6070183d5d26cd0e9006b3f9137d14ff49f2ba2fd16e7ca43d45aaf083d1c84454d5749afb6238f5f042ec89f4edc8aa8bcc7575214f755eb
SSDEEP 24576:p7NM9YmZqmWMUkPjZM48Mv6bEhs6sdZCA6N3Q6itdsOeg:p7cBWMpPjN8DbEhxsdZz6N3Q6itmOH
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 0ac878afe915438c3a71fe2bb285cb2c616ac5101558f3542ad7eaaa62e27a97
MD5 d039dc4cec12737a137177eb2effd38d
SHA1 f9c59d78a5ba17e2d562b54e87c85035ca68848b
SHA512 91089b381266f3c81777c4c4deffebc561113ce21a81ccfbe811ae9ec02ee4720c4238935557d27564b4c7b7ad05859044eb2b6ec0a1bbfaff385b5d1a1cfa03
SSDEEP 49152:jF2YuHNETovcvNYf8kmasdZz6N3Q6itmOH:S6tCf8k0dt6N3u5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 b297b38def441475a3fb45cca4e66eb48bf45feabcb48bc29dfd468dcf46be3a
MD5 adcdf40f3cacce1831f9ccaa9e913a1a
SHA1 50e92a23c0ad22f9c0c18fdb8e6c2208a0eb687f
SHA512 2c3255dbcd8663db57a69410803663c2f5f14b1d0a16ac3cecd145d6af5399d10880608a60b2282c25580caadaadec1d003a115b817fd4bed30a3274b829f63b
SSDEEP 24576:JAFs06+Omlf3NXEbTo7sdZCA6N3Q6itdsOeg:OFs060lVXucsdZz6N3Q6itmOH
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 1ba1d90e1ed7d1fd2c1e3abe61dc5a058c2e10b2c265b887c2f1ae677794eb78
MD5 0b6e0439edafd3762848121f8f0322f6
SHA1 3f65913342f650c939d532cbdf8986bbde55ba4a
SHA512 369271cfccdab027facb873357c768857137a00dd9c351411f21528ff8f5c36dc618fc02f74fb739be4f97fc992ea1ccb2850cc9013c20bac9a36d67f0be7056
SSDEEP 12288:lCJnJ5D3Vkrlzxaf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:cJnJ5D3WtcsdZCA6N3Q6itdsOeg
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 18575f886dffc57703c9159ef399cc7a2daf30d8cbc8012af66c607e8aac4e49
MD5 dad173e7d05b9b1ccb3479d672cc25ee
SHA1 c619ee516163634e71b134a06c535217a7e4bec8
SHA512 9d27cc31f4b77cc52012bf6719feef942c68132022d6871f60b5877258b1487ad84b8f5b548a1d9b3f0e79298d84ea356dd9d9349df74aa8f94cc5c8d6e41f28
SSDEEP 49152:so06DIKdwc+eQnSt65aV+sdZz6N3Q6itmOH:htdt6N3u5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 e23516ed9ab88b061c121b1a86ea87f33392ec925f820fa241943a652eaaee9d
MD5 639d9ba41ca05f90a2f2c91478d10f1b
SHA1 b41862fee96463c0a4f1b0ab0bd9af0e9faf215c
SHA512 6d3f95c8b5524381f34144e2c78fa7fdc678493ce998cad2a2a1e949ae714a7c7a7f231b89e5d4afcdb1c3d6b82a420f675b7501ee4ccec42765d431538583bd
SSDEEP 12288:jEP3Rrof3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:orosdZCA6N3Q6itdsOeg
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 8c86d01bca749bd84f85631adbb058e07c43bb8beef0a7d6f7a1d1bf83f40bca
MD5 688a7d0346693cf3967b1b9484ab7ce4
SHA1 3f507b74cf590504a74cafae50e906819aa443ed
SHA512 50a84f432b63c2096326651d80add71e730b85990b06f9624ee1b95c5f4621c56333fc93d21c99e539b57aa2beb25cc367a02011f36ba3a20619bc59af364234
SSDEEP 12288:jjkyhf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:jIyhsdZCA6N3Q6itdsOeg
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 35c12f97482c75309dd55db8ca95032154bf1d7e6bae4808119699f3678db571
MD5 4ee96d64323c6ce63c9fa18d7f43b031
SHA1 964993985a0222c0cb162d878107fe092685e12c
SHA512 2e79b5348836892ae3ef73dae5e839fcdc9708d55c9d164422e2625180d5c2c20daf1cad269c21732b623ac5db4d83594865c2b70f4fcb269d4e0c9946ffec86
SSDEEP 12288:EFff3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:CfsdZCA6N3Q6itdsOeg
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 a9502b9851727f39a15e99e9510c2e77af150dfb5aa1fed78f61738151f6ee64
MD5 b579d731188314082af1a169d190dcfe
SHA1 9ac898fb35af75b1ee59631bacc5d5a410ef2663
SHA512 f85421359d44e55d52493cd65a3c829dca1c42883a2cdce6e0cf657845364bc64d316f217575bec18f3b7c8b9409c0d05c2dfb482b74ad5dbb2f7a393167ab23
SSDEEP 24576:dQ9MxZKdcz97w3ysdZCA6N3Q6itdsOeg:dVKXysdZz6N3Q6itmOH
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 699895bcd018e4add873fcff9f959303d251204e516c04a89d6e6eedea65b092
MD5 cc71014960a526a36ac8b3f11b7e0ff3
SHA1 a2cb495bf2a19b6501f6889310eef74773303fa5
SHA512 ce23f2774279b6be487593bdddd21d8811074db28525b7ac6c81bf447822ae86bc2c93647b785a93f75a215973cb070b66e8458e12b4179e006aa1cb80a9db25
SSDEEP 12288:+yoKo2HRple9pNf3SBPjZZQOcPskdzM0DZdwPCrUQaoGFU3Q5QitdsOeg:+yocxApNsdZCA6N3Q6itdsOeg
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 20dd2189d0a49c40ed7f5fbe1d504bafcf82381d1bd5f607775c8f873093fed9
MD5 2b7f98ac6bc622370f62e096e5c2e956
SHA1 e59d17e46bb9dd81592222a18e233cf35880a02e
SHA512 4d030a2f7b8b7d5aacdc2375845437d774ea8298fcfdc81790e7f41c60e72a6abbcb969cd1365b4d9c95626c8306b44040498b6e43f105e7272bdb46d0942967
SSDEEP 49152:uWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKNsdZz6N3Q6itmOH:I0zuNI6dt6N3u5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Windows\TEMP\Crashpad\settings.dat
Size 40B
SHA256 b918a44d48859b4ed705a9a7a23d4a816a368aa2161ad495a7a6d1c6992b61a0
MD5 dd7a044bb22136e85285d21163fdef66
SHA1 1fcea0d904998de1bdea9cfa654a50c20b3dcc5b
SHA512 67afbad0468b8d5b405186c63a0960f5fcda15b2ab73767c292863e221265758001b2e110a3296f5d2ba1463863d556a535850a65a107344ade40a79c33bf358
MD5 SHA1 SHA512

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 77155db16f781573a8af85553b6b98fad6e454337e68d65177a5603a12db0bc6
MD5 21af6f9319b6864444b857935aef3399
SHA1 4b2688c340155a55da2a53de717e4f6a5b08b150
SHA512 3d678c669b61da25e659db593b9f2d2f962006e786e99de48b697497a07d5f9c2e3d184d713368e2962d33b68fdaad9966ef031fcf05667b363ee3a5605a865d
SSDEEP 24576:H1QT7EcpfxR+N5AWAz3ooiYtjMqbosdZCA6N3Q6itdsOeg:6TDxR+N5YzTfjM3sdZz6N3Q6itmOH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/468-727-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/468-605-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/812-604-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/812-486-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/840-399-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/840-25-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/840-30-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/840-19-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/1032-592-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1032-483-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1368-713-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1368-509-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1376-85-0x0000000001690000-0x00000000016F0000-memory.dmp

Download

memory/1376-100-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1376-79-0x0000000001690000-0x00000000016F0000-memory.dmp

Download

memory/1464-576-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1464-457-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1576-593-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1576-726-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1652-581-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1652-725-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1700-728-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1700-618-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2252-720-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2252-532-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2264-36-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/2264-41-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/2264-9-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/2264-8-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/2264-0-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/2344-580-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2344-469-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2608-53-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2608-411-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2608-55-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2608-52-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2608-45-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2620-116-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2620-90-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2684-714-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2684-520-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2968-456-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2968-442-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2976-566-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2976-554-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3064-75-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3064-412-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3064-115-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3064-69-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3092-414-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/3092-365-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/3676-353-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/3676-366-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/3980-413-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/3980-330-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/4164-721-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4164-543-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4432-719-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4432-617-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4432-497-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4456-29-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/4456-31-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/4456-13-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/4456-393-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/4616-309-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/4616-373-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/4680-238-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4680-54-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4680-63-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4680-57-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4748-724-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4748-577-0x0000000140000000-0x0000000140147000-memory.dmp

Download