ddaa98f7655b7e79a86c9770f2765be49ebbc732b068aca6b22963a33a7796b1

Analysis

max time kernel
153s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 07:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
Size 5.5MB
Sample240601-hypzmsec59
SHA256 ddaa98f7655b7e79a86c9770f2765be49ebbc732b068aca6b22963a33a7796b1
MD5 150b4ab35647f50419a97822f8a9d0b8
SHA1 72172ad996ca71c3639e0aec864d8bb8ca92f267
SHA512 83e2770cedf47992db4255268370e545b021e7726d32772ef6d429bebc85f5333e0a6716dde4c3307857a19236df7804040fcaaf4d6a4af817efffb90180a731
SSDEEP 49152:3EFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1cn9tJEUxDG0BYYrLA50IHLGfm:jAI5pAdVen9tbnR1VgBVm8U023W
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3228	alg.exe
5052	DiagnosticsHub.StandardCollector.Service.exe
2336	fxssvc.exe
4696	elevation_service.exe
3124	elevation_service.exe
4108	maintenanceservice.exe
2908	msdtc.exe
4336	OSE.EXE
1796	PerceptionSimulationService.exe
5208	perfhost.exe
5432	locator.exe
5532	SensorDataService.exe
5644	snmptrap.exe
5812	spectrum.exe
5924	ssh-agent.exe
1648	TieringEngineService.exe
544	AgentService.exe
5256	vds.exe
5776	vssvc.exe
5140	wbengine.exe
3920	WmiApSrv.exe
640	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\924ae3b6b3e2edcd.bin	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{1342F81A-D5C5-42B4-A5E8-933F7759DA30}\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000062ee29c6f2b3da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000014187abff2b3da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce1ab5c5f2b3da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000791ba4c0f2b3da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000009de8cc2f2b3da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b3f931c5f2b3da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000999fddbdf2b3da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
1348	chrome.exe
1348	chrome.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
404	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
6240	chrome.exe
6240	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1932	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
Token: SeAuditPrivilege	2336	fxssvc.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeRestorePrivilege	1648	TieringEngineService.exe
Token: SeManageVolumePrivilege	1648	TieringEngineService.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeAssignPrimaryTokenPrivilege	544	AgentService.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeBackupPrivilege	5776	vssvc.exe
Token: SeRestorePrivilege	5776	vssvc.exe
Token: SeAuditPrivilege	5776	vssvc.exe
Token: SeBackupPrivilege	5140	wbengine.exe
Token: SeRestorePrivilege	5140	wbengine.exe
Token: SeSecurityPrivilege	5140	wbengine.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: SeShutdownPrivilege	1348	chrome.exe
Token: SeCreatePagefilePrivilege	1348	chrome.exe
Token: 33	640	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	640	SearchIndexer.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1348	chrome.exe
1348	chrome.exe
1348	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 404	1932	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe	93
PID 1932 wrote to memory of 404	1932	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe	93
PID 1932 wrote to memory of 1348	1932	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe	94
PID 1932 wrote to memory of 1348	1932	2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe	94
PID 1348 wrote to memory of 628	1348	chrome.exe	95
PID 1348 wrote to memory of 628	1348	chrome.exe	95
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 4296	1348	chrome.exe	101
PID 1348 wrote to memory of 2040	1348	chrome.exe	102
PID 1348 wrote to memory of 2040	1348	chrome.exe	102
PID 1348 wrote to memory of 1788	1348	chrome.exe	103
PID 1348 wrote to memory of 1788	1348	chrome.exe	103
PID 1348 wrote to memory of 1788	1348	chrome.exe	103
PID 1348 wrote to memory of 1788	1348	chrome.exe	103
PID 1348 wrote to memory of 1788	1348	chrome.exe	103
PID 1348 wrote to memory of 1788	1348	chrome.exe	103
PID 1348 wrote to memory of 1788	1348	chrome.exe	103
PID 1348 wrote to memory of 1788	1348	chrome.exe	103
PID 1348 wrote to memory of 1788	1348	chrome.exe	103
PID 1348 wrote to memory of 1788	1348	chrome.exe	103
PID 1348 wrote to memory of 1788	1348	chrome.exe	103
PID 1348 wrote to memory of 1788	1348	chrome.exe	103
PID 1348 wrote to memory of 1788	1348	chrome.exe	103
PID 1348 wrote to memory of 1788	1348	chrome.exe	103
PID 1348 wrote to memory of 1788	1348	chrome.exe	103
PID 1348 wrote to memory of 1788	1348	chrome.exe	103
PID 1348 wrote to memory of 1788	1348	chrome.exe	103
PID 1348 wrote to memory of 1788	1348	chrome.exe	103

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Users\Admin\AppData\Local\Temp\2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-06-01_150b4ab35647f50419a97822f8a9d0b8_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2dc,0x2e0,0x2ec,0x2e8,0x2f0,0x140462458,0x140462468,0x140462478
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaee4a9758,0x7ffaee4a9768,0x7ffaee4a9778
    3⤵
    PID:628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 --field-trial-handle=1888,i,2717848781026729977,8068954603650443937,131072 /prefetch:2
    3⤵
    PID:4296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1888,i,2717848781026729977,8068954603650443937,131072 /prefetch:8
    3⤵
    PID:2040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2272 --field-trial-handle=1888,i,2717848781026729977,8068954603650443937,131072 /prefetch:8
    3⤵
    PID:1788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3140 --field-trial-handle=1888,i,2717848781026729977,8068954603650443937,131072 /prefetch:1
    3⤵
    PID:3208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3148 --field-trial-handle=1888,i,2717848781026729977,8068954603650443937,131072 /prefetch:1
    3⤵
    PID:2512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4424 --field-trial-handle=1888,i,2717848781026729977,8068954603650443937,131072 /prefetch:8
    3⤵
    PID:3416
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4736 --field-trial-handle=1888,i,2717848781026729977,8068954603650443937,131072 /prefetch:1
    3⤵
    PID:4344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4892 --field-trial-handle=1888,i,2717848781026729977,8068954603650443937,131072 /prefetch:8
    3⤵
    PID:3128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4912 --field-trial-handle=1888,i,2717848781026729977,8068954603650443937,131072 /prefetch:8
    3⤵
    PID:1476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 --field-trial-handle=1888,i,2717848781026729977,8068954603650443937,131072 /prefetch:8
    3⤵
    PID:5624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5352 --field-trial-handle=1888,i,2717848781026729977,8068954603650443937,131072 /prefetch:8
    3⤵
    PID:6012
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    PID:5100
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x23c,0x240,0x244,0x238,0x248,0x7ff7c1767688,0x7ff7c1767698,0x7ff7c17676a8
      4⤵
      PID:5588
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      PID:4088
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff7c1767688,0x7ff7c1767698,0x7ff7c17676a8
        5⤵
        
        PID:5072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 --field-trial-handle=1888,i,2717848781026729977,8068954603650443937,131072 /prefetch:8
    3⤵
    PID:5404
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5664 --field-trial-handle=1888,i,2717848781026729977,8068954603650443937,131072 /prefetch:8
    3⤵
    PID:5420
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5496 --field-trial-handle=1888,i,2717848781026729977,8068954603650443937,131072 /prefetch:8
    3⤵
    PID:5844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4408 --field-trial-handle=1888,i,2717848781026729977,8068954603650443937,131072 /prefetch:8
    3⤵
    PID:5460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5644 --field-trial-handle=1888,i,2717848781026729977,8068954603650443937,131072 /prefetch:1
    3⤵
    PID:6452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1920 --field-trial-handle=1888,i,2717848781026729977,8068954603650443937,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6240

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3228

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:5052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1972

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2336

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4696

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3124

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4108

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2908

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4336

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1796

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5208

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5432

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5532

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5644

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5812

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:6048

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1648

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:544

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5256

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5776

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5140

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3920

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:640
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5524
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1312 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:7136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
Size 2.2MB
SHA256 be9bcf07fcbb5a968a95a06c37ae4d6ccda0ff0fc1020f6b1798ec23c1f27a36
MD5 4fd91e4a6c47f95b7e36bf22d5cc6f91
SHA1 17dcd2dfb9857c304d701416910c269e9f52a4c7
SHA512 822590718bceeb16eeccf3f6b9c2d83d6cf24fffa9088d8bc8601f06f10982f82bcdc261a5fba94e2744699fbfb23228f20bb05ddd93b8c118cacd77c6ba21b5
SSDEEP 49152:t7T3mwz0/iYlzGQMebksutsKSce30jaNf1TWbdz:t7DY/hKuzcU023W
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 781KB
SHA256 579bf1e0d6b2e3e2088638e8000144f761f1a601d287d47506553c9e92f92ab6
MD5 3fcb65a590a28da58c64a1ded92ac1f6
SHA1 70fb132fe4f7d09bc4c8ff9909b325ec2397ac24
SHA512 00ec660d53e3c2a9c14cd8c00a9af2eab1ccb75ee9aa2e673c89e48f22c7e42e79f266b8dddcaf5cfda4f8cfa972f2f705023e6c446985aacd5767ef2e0bd1bf
SSDEEP 24576:PPsJcuijgXe4i7ojhsP5Lgrk1TWb4AN5:PwcuXe30jaNf1TWbdz
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 80b9b618b479dc7d0e73bee38aede7e72bf984d1ad0e0ea0dc5a14a933869940
MD5 18c5fede751a49ab73960599fe7dd13f
SHA1 c63823a8cdd4f98b0476a9d968319b3410b46109
SHA512 5797431a6ad78883ff738599c19a182ab6e0f0d13c91ad2cb7ca125ed9a00db25c6a620a0e8f9addaecdb6f4daf84d252a38f38b698aab0cab56265f3238ee02
SSDEEP 24576:j+gkE1fh4Co3gXe4i7ojhsP5Lgrk1TWb4AN5:6gkERSoe30jaNf1TWbdz
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e5f6a5e7cbb6dcc5ae3cf0c101be46f76b429a4a11db1cae107f0271b7055b5a
MD5 0fc60cb44b81b54d3179d59ca20895e7
SHA1 c40789d0492e9f58d97604654718f2a52d829888
SHA512 2dfa206c8df6979b436ecbd39179803b97b304d2e0c3405b7142aec55372cb7fdd6ecd70091be7296a99d8d778c60fdb74e449ef9cb6f6499ef1f33fe3bca3ff
SSDEEP 24576:pBpDRmi78gkPXlyo0GPjrIgXe4i7ojhsP5Lgrk1TWb4AN5:LNRmi78gkPX4o0GPjbe30jaNf1TWbdz
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 35c95b12fa5ccc88fead25caeca90edad484315700b3a302f234af13bdf30403
MD5 0857edd46b9f24ed234b09ebf39a9b3c
SHA1 1f94b56cf897cd986dfab94bd74bc1170e633b4b
SHA512 363ed4aa86c0bfad4b44774d076b802726733267f8e8bc9d6d726151f0a9f0d85f983477468db361f48b131d20617b7e95778d395eb2ea1cd13e3317d7a39229
SSDEEP 24576:3LOS2oPPIXV3gXe4i7ojhsP5Lgrk1TWb4AN5:h/PTe30jaNf1TWbdz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 c4d8e26fedcc76f5a8b2743d2b0b3b58420782594dfaa1843a0f6ab72dacbdd2
MD5 f6459a782a291507ab11c3991bf370e1
SHA1 672a8e045acb7920e4397c54614aee21a7dc86ca
SHA512 0db9891ceb3238e59ba49f958e1965c0a8864743c15815b095cb6a0562b035be2d3ffa2aa53e9a36583e2a71668947569623c02d980423c0a57b10624909b8d7
SSDEEP 12288:bZs0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:bZNgXe4i7ojhsP5Lgrk1TWb4AN5
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 04b00e1b2356c54e64e11b1f9323ebe3a26b1a6aac6a6ee399118d6c3a8c40f2
MD5 a2178992e2889d9c1ba938d6ba513321
SHA1 643bea83e444f9ce6ad2eebbf5f6e0525557f3e4
SHA512 5edf036e0106d6d61d317b0edaec87b00b728fa2ef07d6f310146c2ff6681546a842f53fb0ac1571adc5c7c4ee09608485a30e46abd7fd1e38803f36bf85a443
SSDEEP 12288:UeBNUbTVO86Up0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:UJIU2gXe4i7ojhsP5Lgrk1TWb4AN5
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 408a5155a774e3427b8661ce03ea55efadf1ef45dfcd5fee6f7780a0a2a3ada8
MD5 912defa5d332a816cf2696007169757c
SHA1 ebf49ba60b90d21b08a7cc5fa8d1a2ee457ac804
SHA512 dbbfcb886e5c2108641d4e7fbbcf7f3828eb84e12cc13746cd725156a1c63ae3f2b442c7aefb3c31312ab16ea8256c428c283e824fb715a3009ef393ac2e4b38
SSDEEP 49152:9QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THL:9QvGAdlCEL8c/RRNw5CiU023W
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 799f72fe656f29afb40ff58e2f64454ca96f4fc15d3834cebda4cb2ae77eb525
MD5 849ddf9181d6953f24171d76310ca87c
SHA1 aa40974ce8d1fddc48a68cc2cc518b0f57f61179
SHA512 6bba10ac73da57e3ebca43616a0e9ac48bac34650d25c32650c260337c6c25ab3c21963d02e599e5e5983aa42372f28845877f27d268a0232ebecdb896d7b642
SSDEEP 24576:wSewsAjwgXe4i7ojhsP5Lgrk1TWb4AN5:jljXe30jaNf1TWbdz
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a4c9a1d28d8f4e6bdfeb4fff6c0b6cf85325bc37d68a9ceeb5931a3e5a236d54
MD5 8e6ca7372874a9be57fe081f1974ecab
SHA1 d2aa1ecd84fdcdb4e37765e594ad613f6252a61d
SHA512 d15916a980bb1b3b13562681b108a69d337b5285621129dfa92cae4d7e75317ea69b302b802088c51006c42d4a56b69b2a81a060d2e1981a978e3aec1b8057c2
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHPp4W:FUEtQevvqc2W1cpV2RI32h4W
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cb50ac3faefa943f3f677599678d4790e238cbbfa7521b3931e30253233da73a
MD5 5393135c9a47a27e1c0e93e0751623b0
SHA1 a25c657fddaddef5afb8f7c9665434c47cc73a3c
SHA512 066d4e236aa61a4ac4e8e5f157d4c331927f632f0caa33b2a32de2cf4834b219ad2cc120900724ad204e7c8c10bade9e0d7ed21d15fc1a0c49f6ecebfd86d95a
SSDEEP 49152:RCbRquA/m2yL5zifFiV+XenmE3/z3e30jaNf1TWbdzd:eoqHVjnmuU023W7
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 316a22ccf53f22e1af3eae375110842d421cc9526d0991cdb0bca47602498349
MD5 70ba2a5b92f4d859db93f172f4c82652
SHA1 39d471b771c955b754fa5bda0f6d6fd7db43c11a
SHA512 6c2f7b33505a0602b46d2c43c7c680ea675ca1ba775f237365d10b0b3376c145cdad2b5868824150412741a44d2b6342446566d9c745b263d3301b37f3bec789
SSDEEP 12288:2mw5HEjsChNSBFgl0WDm+CS0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:vwuXOW8gXe4i7ojhsP5Lgrk1TWb4AN5
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 db7b1f1b46b2ef6d06d6e9a64e77da7b7710e3812feec1d52be469eda86a83c3
MD5 67ebdbb075dae6bf802610dd4d8606f5
SHA1 6e11c921480be5358a27ec74fcdf9fbf202d3946
SHA512 7830c5f092a86ee9c76a56f4f9bdf02d6ef3d9337824694693eabdb998806a18f4252014f2f6a3a1c70df56b48565e0d400565303d27c6c7572f0d7f681214ce
SSDEEP 49152:Ca/3xXBSZ4K5MJ1LvTMxbYsYBYSgxu9+fw4Txe30jaNf1TWbdz:MZ4K5MJabYsYNKU023W
MD5 SHA1 SHA512 SSDEEP

Submit Download

8806113a-4049-4d6f-9932-5ee3388d1681.tmp

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\8806113a-4049-4d6f-9932-5ee3388d1681.tmp
Size 488B
SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
MD5 6d971ce11af4a6a93a4311841da1a178
SHA1 cbfdbc9b184f340cbad764abc4d8a31b9c250176
SHA512 c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f
MD5 SHA1 SHA512

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 0cdc298a6aceb4b16aea8d70a7e77b695e1d203d1493b629f5b6d549e0648e32
MD5 eb3f5aca0ecbe9d4b276b4ab2b91ee1c
SHA1 2a7d92fbd7b01fd1b3bfac8b78f04b58966b8ec7
SHA512 157223aab5177a4f111a23ab64023ab356f2eec9c159a39ae0633b98b10b203e1b52e8ec6f212e2016d678f2b323b1514e9fec6b2fe4886cb65bb2531870d0d7
SSDEEP 24576:bcP4mcvIjkGOxhKP2l71SNKbrh/8KBZgXe4i7ojhsP5Lgrk1TWb4AN5:QP4m4IpOO67N8Kie30jaNf1TWbdz
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 bd34434d117b9572216229cb2ab703b5e98d588f5f6dfe072188bd3d6b3022f3
MD5 85cfc13b6779a099d53221876df3b9e0
SHA1 08becf601c986c2e9f979f9143bbbcb7b48540ed
SHA512 b248162930702450893a112987e96ea70569ac35e14ef5eb6973238e426428272d1c930ce30552f19dd2d8d7754dc1f7f667ecd18f2c857b165b7873f4c03a48
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\en_CA\messages.json
Size 851B
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 193KB
SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
MD5 ef36a84ad2bc23f79d171c604b56de29
SHA1 38d6569cd30d096140e752db5d98d53cf304a8fc
SHA512 dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be
SSDEEP 3072:HXm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4g2rJBXCy9enoN:HXUMCm4U6q62MEBi99g6JVCvoZhhl+No
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f1d7cce79d77bbe67cce7ed1aa5f6d122677cc2aaaa45929d5f7e4d54bf75f14
MD5 4c82f46801d9cd83550c3aa0e12befc1
SHA1 e4c15c7f785aac6d31352d66b5ebbf0352caca87
SHA512 ed615ea67fb6464345c827fa9b2f9c6e573c59621110760fe4a311dcd69bd13eef67d17d1cb6fb13e8154f83b885082f44c990ee25e14d8bbb0b0dc17bd927c9
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 efce29ab2e7a18af56ae120eecb4f2b9c9a4ee2bbdf427291c24634186f6fa49
MD5 13484387c7b57959dede8c5cba0ecf00
SHA1 4b868bcad884b1ad52c8b253f7e70a2cb0fb9460
SHA512 1ce90bb0ef3c0fc64670ef134bb639ec58743e6aeb5f5e78049178c2d4d367fb67b5385f201b1f77d46cbcc4a79bee46cd057e8f5590125166456db5a49bc07a
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 369B
SHA256 75a0cd43af4f7458f33db24a684b8d765eabdfd5e46cf9e2a7c6de2176105c03
MD5 56ac7d294fa328a5cae7d81c26d7b7a9
SHA1 f403dbdbe4c57cbf0c44983e6dac233e62f08efb
SHA512 f923ac7cadd7517b8ae20863b4460f58d4aba567fe8809ee50e69280f6cbd7fe782296d5fbccd89df9186790cd39aeb212a0a33a019dfca1aa07ae2e55799bd0
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 54e54604457ce8c7d17a68b7e3c6686d73a2ced92aaebb0fdf8d2674d3b07cc8
MD5 8b3f52b8d520d7e560b648d305359c36
SHA1 a02bf6fe6874bbb17801a162868cda374c765a5f
SHA512 404460f9da4d151af8cde307a0a35fbf8da7e27db4392c160b0a3bd843c894bd92f4444168f7a390170c89dfc3ff7a11df5559c20e882ce575fe7638a369770e
SSDEEP 96:3YnIX+ZJtOdrj8iZRy7Di+6MsmdeCO1S+jVlVup:3cIOO8syy+FN+jS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 4KB
SHA256 8243295f6ba3e262a3d6fa192c88f2be6c59456a1ff01c04cb7ab0d76f61144b
MD5 590509026de9a150853561507561c097
SHA1 9bd43229f037b858580ce5b7cf367c96906610e7
SHA512 f4cd125a3aea6deb725b5215b438de4c8c1310af300325e62a6bfe32e2717200e7bfe3721b741b3c2c286ae56987d1cc8063cb404b6e7133e0bba323ceee5561
SSDEEP 96:3YnbOdrXd8iZRy7Di+6Msmde1BOE+jVlVup:3co8syy+FEn+jS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 4KB
SHA256 4274081e3cbb0eb3c3d1f227b8f359db4cf05dde82124dd055924980f3bee10d
MD5 0ab8d1cc1e8d45e04992ff1e265defec
SHA1 c8d86b53f425c7f92df9b41e799f87638c67542e
SHA512 fcc8b231f337a2e239cf3ff00eb40708a215987c6469167ef8fccb360034477df47ba21f23fc6d0ff154b0b82bc2fea7144bbb54c95f6a6bca68b9c6b23ff1f1
SSDEEP 96:3YnIX+ZJtOdrj8iZRy7Di+6Msmde2O1S+jVlVup:3cIOO8syy+FB+jS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 4KB
SHA256 2e364156eaf526f6930b1a8d9846141796b6b4f2f16248c1156e8d82a44901e4
MD5 f77596879cf4dbb9c0a432d812631202
SHA1 4d8461c9a2fedeaed9b1269fd84a56996815f64f
SHA512 89e9c4c9bef8047e0840fdd45b6c48b939a2cb66cb8dd8dddb06fb0601d9e7cc64c187a48d69583caf40a6b4fafbd04506064cd55668cdf4c36760e375983f4d
SSDEEP 96:3YnbOdrj8iZRy7Di+6Msmde2O1S+jVlVup:3cU8syy+FB+jS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 4KB
SHA256 ec500fb984acb9ded2b2a3dff64d7a88698db3551e840f4eb7f4106566fb4b56
MD5 e5196ce03116babafb04fa5b0e3d849b
SHA1 5cc2eba685764ae5c3b7e0d9cde5f005fc838fa5
SHA512 2d9ac4ff68bdf485a1c453f6ef1619a038c6455cc09eb7fe763ebe9c0bd5cfeda995b2be6c4fb11c822ea2d312962bb170634b818620865804da7f7724ceca95
SSDEEP 96:3YnbOdrj8iZRy7Di+6Msmde1BO1S+jVlVup:3cU8syy+FEZ+jS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe58486e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe58486e.TMP
Size 2KB
SHA256 0bc76b0a74faa8d4d25cfa28127c42750e86004af7a10d590e07a33a89726b51
MD5 04695aadffdaf28b5be826d27d48721a
SHA1 ce79df7c80926a86b0e1a922a05bcab16c7620c4
SHA512 aa3438c4a09ea9c0c52dccb6cba636ac99c11b47a5b78317869823d6c39bfdfa304f40e67867b8ca9c4269efaba12431ae59a1d54c671f38acb9e4fe3d23da54
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 10KB
SHA256 8c156366a47914b7b37e946b591a3a0a522ce961358b3669736b40b5f810b117
MD5 6937e0668541fecd3a1be37038688ffb
SHA1 d91bf1ad823678290faa3c7ae861a42428adc064
SHA512 fcb9129c18736c2724d64aa0207b4b51b612ecf8134604f48f98d1164358153048109badbb593875430267406ea7bf294714a2ab2d32f314b855a3bd3943122f
SSDEEP 192:144tX+m1kXqK4I40pUZNCgVLHrKHfFyorUKKTJMkWcesBH/JzzErY9QbQa:1TXF1kXqKf/pUZNCgVLH2HfkorUfv3zg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 df4aa8684b8c7f5b3e5988b4ccb4f045aa050da73759d43bde160db274ddc3ba
MD5 2d6acbed123af7aa06d278ef9128ae95
SHA1 949aa743a059280d925006cb7a10d60a255dc4fc
SHA512 253eff82f76ba368eaf6db3e5f24c3b30b91962e4532c75a79356ba199c5d136103b77e289bb59f2ca33821201c9d1d3d745e15758d964a3b1df8ec62e5ff507
SSDEEP 384:1WLPLe0XF1kXqKf/pUZNCgVLH2HfkorUfok3zE9UI:YLPLJF1kXqKf/pUZNCgVLH2HfvrUFpI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 270KB
SHA256 4a7f67a1a7dbf53b690a1a5a57e5a73476c84220d1487d24e8193cdd8bb3583e
MD5 4c3ca00afad6e7f4c98bbf38d2fc610e
SHA1 740e3cb33f23e16b75578d6fe91581a8f0fa5ddb
SHA512 f471e34406cd40e49f9786b42ab6be8185baa703153b7e9a91da7d3e72d888e0bf60d1409f102f74b025826b90c1a96751edc0945d008a1841dd4534e231cf0a
SSDEEP 6144:ESv3XLGRQh1kLSKXq+1MVvyyASNdvXCNpbMHtCMpSC:FSRIGSKX5MRyyASNdpHtXD
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 4KB
SHA256 39dfe9e2d1554461bd04a11a77bd6e0fb17de9db34ec8c28d63b6e14677e004a
MD5 047e7e5c0e326a216f6a346298bdfe47
SHA1 1c41f0f0197d8a93580cae2ebb0d843188ad5244
SHA512 35b2adb5bbde3769fa55ea75fe21841339cd9d4fda63851d03e2135eef367e2f405db761304831805ca0e40111fe3457d8a5e7330388da820b4cdbf5e098e99e
SSDEEP 48:qiZli4qHFuO+CS2frngD1HMDOjc4OWOdquCngDtD02AngDtD028H2uOtMojdDY5p:ZW4cKRw4Ne9xK2rK2b1JzJ8Ig
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 6KB
SHA256 ad500842b4a712982670a7eefc3cb861868c9e4e083a28fb04812f133386e762
MD5 2a0c3644d35067e0d8cb79c3eaffd959
SHA1 6ddf44359316c80622b6ec97c2f42138b2e07345
SHA512 c9137f3f468c843100423cad7d3e2ca5afee7c67f6caab3bb8df4fcaa1052838aced9b8cefe343e838e1c78b441788a09467ae328b7becc89c1d4bd4f2233e16
SSDEEP 96:ZW4cKRw4Ne9xK2rK2b1JzJ8IZkNzk0k0Pz7xK3xK37:x5N4BZN8SkVk0k0b9cE
MD5 SHA1 SHA512 SSDEEP

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1348_1006138871\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
MD5 SHA1 SHA512

Submit Download

a7612265-8257-401f-beb5-de475ca653f5.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1348_1006138871\a7612265-8257-401f-beb5-de475ca653f5.tmp
Size 88KB
SHA256 d412fbbeb84e2a6882b2f0267b058f2ceb97f501e440fe3f9f70fac5c2277b9c
MD5 2cc86b681f2cd1d9f095584fd3153a61
SHA1 2a0ac7262fb88908a453bc125c5c3fc72b8d490e
SHA512 14ba32c3cd5b1faf100d06f78981deebbbb673299a355b6eaec88e6cb5543725242c850235a541afa8abba4a609bb2ec26e4a0526c6b198016b08d8af868b986
SSDEEP 1536:bCwdkDMb+jCnnSGIdfT9zcbF6gNoLNdN4XhCJQS1pOn5IJ1pD:uwyAbvShdf5CkgN6nmkOup2oLD
MD5 SHA1 SHA512 SSDEEP

Submit Download

924ae3b6b3e2edcd.bin

Path C:\Users\Admin\AppData\Roaming\924ae3b6b3e2edcd.bin
Size 12KB
SHA256 19d708886a5d1844cc75f09fc83fd73f0065df1478a62a6232a3e45e8422847e
MD5 2f164131aebe38513399660eafd5f529
SHA1 758190b71f4d29ae4c51b74f90a02ef477052283
SHA512 8bca088ed4a817bd977fbe2c0501c7d3691fb57fdc7a29de47bbe400fae9e8a84b07e0460d8829ab6e041bb2650cc1f7b4cc59b12b0ad5cfa942cab03da08e98
SSDEEP 384:6jT6iypWOZ4LFhm1NV/Y92A1QolKk64EAiec/Zk9h4e:6jT6iypWV0qCLk6a6ih4e
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 077e76a52174b00de18c6a86947d27ace8bae6ca2d6faf33c06dfa61d90a2e00
MD5 1c0b72eae39148428bdcbd4d8d4aef92
SHA1 0f633744ffea9d81eb94fa06b7d79d0bf96a3616
SHA512 26ba089fbaf62c79a5bb6956edd81883946537ac30bcf6a9d7e9e20274099d5a3352eb80d9dafc4b1e51d5c3385f7a8b53eff0f0834c6b8058959aa00e50466b
SSDEEP 12288:cg0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:chgXe4i7ojhsP5Lgrk1TWb4AN5
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 8092f6185e8513b9f54a68f894c539ea21eb34051adb22923ec5847f76165ff2
MD5 4b476410c2bc0d47b81ea41bc4f7f9ac
SHA1 0d26984f3a649a716b27c98cf6206db3b8f098bc
SHA512 3f91f85c12c64f83fce8cbcdaa5525b94dfcda47a26406f4b9416d155239f1cecc764c27e6e1eaf04050428357bccc750a27a1ef319751a88d2ff42399bd5b79
SSDEEP 49152:la0h2GEkuAe73q3pp46zwwQme30jaNf1TWbdz:la0hNYG4JwPU023W
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 ee2075ba6886cfa12e886749b8174f90aa0f8b7c547387b44d3648aa19753449
MD5 1cd7fbc83c13112edf7a9e36b4dd7ff6
SHA1 88b7676987bc07a7531925400dea825b26cbb99e
SHA512 f042b0d3cd421047695255ca179e48871ede7d3e5a4b6f7f83d3a9b243b607ac1866749081b6c74b3d7b0dca67280dc9bcda952a2d60f7f8ab5b6ce7ce738d6a
SSDEEP 12288:uhbHjfXn0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:uhbHjP0gXe4i7ojhsP5Lgrk1TWb4AN5
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 97b4ea3d2beff606e4811843e7a64901022c4ae1b59ac730d1831b02d890eae3
MD5 7f7a94e30c34251998147c7dd3b6c54c
SHA1 4c15d3c9f1f2550776eae21871d9daf36203ed28
SHA512 a7a1f4aef03c189b424ebf3328cc988254871e8c2e6c4b1d5a141d08767c8df08cd4bc99c6895ace82f2742391f4d93bd28cbd4a4afb9fdec5a108a01585bbbc
SSDEEP 24576:H3YgnJcRTk4yti+R5dpR/8gXe4i7ojhsP5Lgrk1TWb4AN5:HIgnaTk46ppR/Te30jaNf1TWbdz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 059b6192636c7a46603dda600669594e5ca12b8adcdbbed5a62b93f1df8462e6
MD5 238294a463e0e6ac28342132fd788356
SHA1 f3879d26cbbff3ec00f06a086f40dac65e56f69a
SHA512 ac88a2b01e726152827027848fc1a6d48998cb65be9a32f683c5d3c4094d7b9841393fa18ab2ba3bf5f923f0849567a75229b2000c5d3b4975acfda35f1b6758
SSDEEP 12288:AM0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:AtgXe4i7ojhsP5Lgrk1TWb4AN5
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 f137c1486df46ee369723aa32319a8ec0758b9363d83a59592f499aadc155d65
MD5 d5a2a68a57e83442d5e49780dd094175
SHA1 7899213193f45d5de121bbe7d2d23e5d0a19786f
SHA512 88fe2c9a06d54f1092c87691a4c03d0f6dfc89d1a17143c234a4e1bec317e108818bdb694193523c587b61b60243fc2ea450c3a8a894e8839ddf72a6f4ecbb2e
SSDEEP 12288:pObvA4LWOsvAYFT90DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAf:erL3UTqgXe4i7ojhsP5Lgrk1TWb4AN5
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 240bc0c594b8eb0469b0c31ce00d26350d503da51b8abd031ffaabe1b61b8e56
MD5 5eff12a806082e9c7ec676d66613e824
SHA1 feb16e36b2456435128d8fe307b6aefe6c768255
SHA512 40070a54176ef331688a45b8995ab840fbe4e1c1da7790bb19a3645eb193456165290cd4f151af5e5df49efccb8f91ad84eb929ae052292307e5dec17cbd5b2e
SSDEEP 12288:zpFtYOJ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:GOWgXe4i7ojhsP5Lgrk1TWb4AN5
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d9aa7b5daa381f19ed293a6130bfffd5203ec97182dcad2ce8582f7d478915b7
MD5 4f607239d42f7d3729b2e4a4b5007dd6
SHA1 b2b0b1b39529e568a369cf22ca1c2cf357fc07d9
SHA512 b452b8d5d9a125a28e820b9442fa32663e110c080c75be095403d8065449a8c940a359a6b4b3b33a656b5156e231b814ea220c3af839d11189355b82d3078e3b
SSDEEP 24576:47NM9YmZqmWMUkPjZM48Mv6bEhsRgXe4i7ojhsP5Lgrk1TWb4AN5:47cBWMpPjN8DbEhbe30jaNf1TWbdz
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 54b71c5e7bdf80cd05a697526cb4e83c9e1b133db4dfcb1e8574747f41bffa89
MD5 1369731e0d1e2e0a73f764d12d315f5f
SHA1 c534ec870c70f0f0c8c56d52f4084f9d7c55c10d
SHA512 20348f7b34d068e486ed69a79b0f6bde0735fed4731c5c1eab6c10e69addded8f628ea1ffffe04bea3dff6dc11245c026133d828d8ab4c935e768df5c5e0d049
SSDEEP 49152:KF2YuHNETovcvNYf8kmMe30jaNf1TWbdz:D6tCf8k5U023W
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 1ad7788e8a32e25547a007c73f470f3f64e871e6bd8747a1c6c89c924aaa4be4
MD5 76e6caa6db461751e1f90746bf7e4818
SHA1 84446294e9f5f131d51644a48d4a0b1d756de452
SHA512 81b91f1b537094f8f95d701a3110f9f84aea6c2b498904420b3403746f6c6fef532013165aa9c269ab70df5e4e135a8f83ebf0cafd1106fba24c82f0a5135f45
SSDEEP 24576:aAFs06+OmlfQNXEbToCgXe4i7ojhsP5Lgrk1TWb4AN5:jFs060lcXuGe30jaNf1TWbdz
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 82854e1df282676589d6ef7bf72e5e02aa8cdf06bea2935c24429fa39cb3c464
MD5 fc1cd25f63b8965430c1da950db9e269
SHA1 a0bb2fd56ffc305c5f240bf7c4d5fae5e450680b
SHA512 65501ac61232e411eb612ae3ad10b9d3571ff7b1fc6bbbca9e5494947031bcc911e6126f23b16951eae02898e4cd722632e0725f5f84d5f71dd7b4a69b2176b2
SSDEEP 24576:tJnJ5D3WtPgXe4i7ojhsP5Lgrk1TWb4AN5:tJnJ5DGtGe30jaNf1TWbdz
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 e932310d8bbda4aa7b9db4b68230b8836e910cf07bc86e656a35a0aecd903a97
MD5 e6bdc3feb7a33aafce8fdd6a77f301a0
SHA1 40ba0a522013e502fd8ad30e2ca6e0520870b504
SHA512 f0fe9af3b61126cb7742cb90084d4d682e90fb751fa011a5918b74001d426b9277d3edb1f71332011702864ba994c4acd4e49c43c728351f78398eafbc3266f8
SSDEEP 49152:ko06DIKdwc+eQnSt65aVQe30jaNf1TWbdz:5KU023W
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 d3bdaa87fa12ee9526bdaadef8ecf9902075784fc5508dc3c61d0cd240c74a25
MD5 1a3e978a76d2fce3b0603c2d9aa47255
SHA1 5eeadd4e7868e269eecddab372ccdb8d15fa5aa0
SHA512 2dd5bf3d9e98232ee9f96da1afe7cc0e95f7654d53328eae89a841a8cce05b83887f0774a6c7c879df1cf1344015e4ea48c4b866d6ffaf5224f490d3b5cb50bd
SSDEEP 12288:EEP3Rrh0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:/rOgXe4i7ojhsP5Lgrk1TWb4AN5
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 b3e5470f391afcb78cd58d8851c172d1dd5fcaea3e6d37b27851ccacc2fdc45f
MD5 3dfb46d645605596bf615e76d038f682
SHA1 bb9e20679fc615bdb954795c31f182cde7eb3326
SHA512 7a15f0fd2501b41e6df284e444d3ae13ea97a83d04822d0d3bec1530a0d864fc2d2853362205f56e32f0634adad5dae93417dd64bcabe87de48f12dff00f9ca7
SSDEEP 12288:UjkyX0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:UIyEgXe4i7ojhsP5Lgrk1TWb4AN5
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 0ce49888288a6b002025d32608d544d105d2244b1348383a91fb34484a7dc15a
MD5 a53cff86c702b70beda880c1877b4cda
SHA1 a36fe1d6b2e647e268b49f95423ce50a2411e4f8
SHA512 96c3466a97e403ad8eb78205e35c972039e9e79000284d799f87f8aa1c1f26f0a54d37434ccb51d6b94fbfebc785bd11de1bbe5e20823cde59b42173892d2662
SSDEEP 12288:xF50DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3mgXe4i7ojhsP5Lgrk1TWb4AN5
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 6a80356d794993173cdaa85382984b9376563674e3ac2936a570f1a75cc1241f
MD5 554fe3f4f3b4ec3eee0fc65b699ed414
SHA1 3c740b77cb61b4f356916a751ce42bdcc3006d38
SHA512 69b32129127986206bd827730432604cd5d91b1e64a17a80d5233c0213863361d5d99b03b2c9b650fe93890d4bd59a058c2389eba68439d5b9378999bc0eceb4
SSDEEP 24576:FQ9MxZKdcz97w3JgXe4i7ojhsP5Lgrk1TWb4AN5:FVKX0e30jaNf1TWbdz
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 7bb744e0f2c823d7e954a497e32c86d1a6cf2193afdc6955145cc2460a85ee91
MD5 c592a9e20e7cf62ef4a1a37c370b89ae
SHA1 2ad6df235bdcdd8a578efcd3f087f32a7081c7e3
SHA512 9d30212732c4fce87d76dbab28f7dbd61acd5d8ef2f5f148d029dec4471e87ae5561b815a9364d4f0cd2d58e2027651d8141db1fd493ec5375d7d6b04e212fea
SSDEEP 24576:EyocxApwgXe4i7ojhsP5Lgrk1TWb4AN5:5ocxApXe30jaNf1TWbdz
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 69a073a76e45a72fe446b7fd9878ed27e7ce3272c2114618c78525a6faa8480a
MD5 43330464525721f3a1f48ec74911f346
SHA1 43db7abccf7987ecded656106d08d6e60e3be20d
SHA512 11f17d69d7559c5b23fe4e6f248eda8ca24e4499276c1af06f40ea96f403d3aae3c268c44dabdb404506b364d4d227ff4f0296bef72cea27a19c3c00c1ea4d96
SSDEEP 49152:DWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKXe30jaNf1TWbdz:D0zuNIDU023W
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Windows\TEMP\Crashpad\settings.dat
Size 40B
SHA256 169bdddd028372b9c8dc1bbc8bc1a48dce9089467cf7c3b5967ebc20713b1bb7
MD5 0e1a0df5323f02fa141b11070035f203
SHA1 4662c48107aebe02429f78dc0ab4328f88ea9e8f
SHA512 5ef418e1f48b459f21f15f8462fceebbe5da2e16ff4cd02a614a6a508c1a9e28527c0d0778840600c85ba60d412de91e754b3aa0173ac4db70460367a2abc6e5
MD5 SHA1 SHA512

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 16b83e50ddd3f1b44963e05503a6dfb4b80ae81eb41b09e941e2fe1b09508992
MD5 9d0fab084b3bc0cba887bd74a77aeb9f
SHA1 1885d9432849c7804c38a26ef41b62ac30e7ad77
SHA512 c1df899146b7e939bf94a52d1215ac6b056ff99ebb6e85834267a44aa9985f31729d8a5d46e402da8aa6cd10052f8add2eaa7b8037fe3c63faebccb7a887f990
SSDEEP 24576:O1QT7EcpfxR+N5AWAz3ooiYsjMqbLgXe4i7ojhsP5Lgrk1TWb4AN5:DTDxR+N5YzTujMZe30jaNf1TWbdz
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 37855ebc7f06cc88d177062e7d815726634d3d95d1ebe19fe8d9271585a1ab23
MD5 6ab5093f5c0df7818ba6abca98ec29d7
SHA1 d34c172ee22ec747aef371a3d4aa3262124b0ee0
SHA512 2c79ae6dd55b55eeec16ce309134651593d495fb65686b9a55940b3533d58502d2046df0176d9bb94d7dd502a958ae00b9b11ab3237bbd66f27c85f6cf4e769a
SSDEEP 24576:YTMdOz0FFS+hmSLHgXe4i7ojhsP5Lgrk1TWb4AN5:w0K+hmSLue30jaNf1TWbdz
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 cac23211ebe746cfaa8743a0051ace9b1b16ad5c353a5f99fe00691e5460aa3e
MD5 96eb93622d53cb6ed3a50f6e331ed27a
SHA1 e97744e200bba73e00dcc878426eccac832218ae
SHA512 6d93fc0407933e96706f8adb56694d596b4bb708df98f8c1d0166debedf1b3bef529b1a6c50e2b69dd5c0d929ad27399a6c78db065fa6f336aaf857a0becf561
SSDEEP 12288:J4790DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:8qgXe4i7ojhsP5Lgrk1TWb4AN5
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 ddc92397a1ed1c0199af58ca8eeff21385b0741d87da30f9734ac89489eb7c37
MD5 1429c97149b256c13b422134daa0e29a
SHA1 64e5ddee49853e16b40b2019ec5f435e3a185e93
SHA512 8d101ac7a0c7e92917722e04fb8b51359f4cff34fed31e03efc18506fc60cedf92eec104b0e0241f6d065d305496cb74965fdc7225f5ad266419c359ced481e6
SSDEEP 98304:M7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gG4/QmvD/cTwY2h3FzU023W:GM7pTXexZPGzURnBh6gG4F+W3Jp4W
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/404-20-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/404-16-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/404-10-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/404-117-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/544-291-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/544-303-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/640-982-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/640-472-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1648-658-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1648-282-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1796-161-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1796-325-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1932-21-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/1932-29-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/1932-0-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/1932-9-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/1932-6-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/2336-58-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2336-59-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/2336-65-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/2336-94-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/2336-95-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2908-290-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/2908-131-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3124-108-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3124-242-0x0000000140000000-0x0000000140245000-memory.dmp

Download

memory/3124-110-0x0000000140000000-0x0000000140245000-memory.dmp

Download

memory/3124-102-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3228-42-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3228-39-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3228-33-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3228-151-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3920-444-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3920-838-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4108-113-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4108-118-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/4108-127-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/4336-305-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4336-152-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4696-97-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4696-99-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/4696-83-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4696-89-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4696-91-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/5052-46-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/5052-52-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/5052-45-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/5052-189-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/5140-370-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5140-836-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5208-369-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5208-171-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5256-312-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5256-827-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5432-434-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/5432-198-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/5532-201-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5532-599-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5532-461-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5644-572-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/5644-213-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/5776-326-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5776-834-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5812-617-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5812-230-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5924-243-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/5924-646-0x0000000140000000-0x0000000140102000-memory.dmp

Download