44fd075318bc70be05bd3cf3bc81766cf08f19da0f2c9f7fbe6d8eb216c8b3ec

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
Size 5.5MB
Sample240601-xtvrnaca9w
SHA256 44fd075318bc70be05bd3cf3bc81766cf08f19da0f2c9f7fbe6d8eb216c8b3ec
MD5 c190afec670f15aee90d22b6a5704242
SHA1 9b0b1464664764a1a8670a15f22b114b63e6c6cb
SHA512 29a3f4e972a41a8e0b54eb4366b11156bac2e9657f3ae9a0f0848d5d51b429add28246bf590f641005d8aceff653f40080b46bf229399faf518fe5016a69ab94
SSDEEP 49152:rEFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1Ln9tJEUxDG0BYYrLA50IHLGfl:3AI5pAdVJn9tbnR1VgBVmgB2Yyjl
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
1868	alg.exe
3608	DiagnosticsHub.StandardCollector.Service.exe
1652	fxssvc.exe
1316	elevation_service.exe
1728	elevation_service.exe
1616	maintenanceservice.exe
1156	msdtc.exe
760	OSE.EXE
1920	PerceptionSimulationService.exe
4668	perfhost.exe
2084	locator.exe
2656	SensorDataService.exe
2432	snmptrap.exe
4180	spectrum.exe
2440	ssh-agent.exe
3960	TieringEngineService.exe
3256	AgentService.exe
2864	vds.exe
5084	vssvc.exe
1808	wbengine.exe
3384	WmiApSrv.exe
4544	SearchIndexer.exe
6052	chrmstp.exe
6136	chrmstp.exe
5344	chrmstp.exe
5140	chrmstp.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4cd82a39c8648821.bin	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133617425673762548"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000059f2c63d57b4da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b43c8c3c57b4da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f78873c57b4da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f844783d57b4da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf0e203d57b4da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007f46593d57b4da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004dded23d57b4da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000021aa5b3d57b4da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003456233c57b4da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
2836	chrome.exe
2836	chrome.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
2836	chrome.exe
2836	chrome.exe
1180	chrome.exe
1180	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
Token: SeTakeOwnershipPrivilege	4416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
Token: SeAuditPrivilege	1652	fxssvc.exe
Token: SeRestorePrivilege	3960	TieringEngineService.exe
Token: SeManageVolumePrivilege	3960	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3256	AgentService.exe
Token: SeBackupPrivilege	5084	vssvc.exe
Token: SeRestorePrivilege	5084	vssvc.exe
Token: SeAuditPrivilege	5084	vssvc.exe
Token: SeBackupPrivilege	1808	wbengine.exe
Token: SeRestorePrivilege	1808	wbengine.exe
Token: SeSecurityPrivilege	1808	wbengine.exe
Token: 33	4544	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4544	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4544	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4544	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4544	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4544	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4544	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4544	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4544	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4544	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4544	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4544	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4544	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4544	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4544	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4544	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4544	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4544	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4544	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4544	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4544	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4544	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4544	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4544	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4544	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4544	SearchIndexer.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe
Token: SeShutdownPrivilege	2836	chrome.exe
Token: SeCreatePagefilePrivilege	2836	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2836	chrome.exe
2836	chrome.exe
2836	chrome.exe
5344	chrmstp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 4416	2416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe	83
PID 2416 wrote to memory of 4416	2416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe	83
PID 2416 wrote to memory of 2836	2416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe	84
PID 2416 wrote to memory of 2836	2416	2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe	84
PID 2836 wrote to memory of 3096	2836	chrome.exe	85
PID 2836 wrote to memory of 3096	2836	chrome.exe	85
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 4116	2836	chrome.exe	112
PID 2836 wrote to memory of 1812	2836	chrome.exe	113
PID 2836 wrote to memory of 1812	2836	chrome.exe	113
PID 2836 wrote to memory of 908	2836	chrome.exe	114
PID 2836 wrote to memory of 908	2836	chrome.exe	114
PID 2836 wrote to memory of 908	2836	chrome.exe	114
PID 2836 wrote to memory of 908	2836	chrome.exe	114
PID 2836 wrote to memory of 908	2836	chrome.exe	114
PID 2836 wrote to memory of 908	2836	chrome.exe	114
PID 2836 wrote to memory of 908	2836	chrome.exe	114
PID 2836 wrote to memory of 908	2836	chrome.exe	114
PID 2836 wrote to memory of 908	2836	chrome.exe	114
PID 2836 wrote to memory of 908	2836	chrome.exe	114
PID 2836 wrote to memory of 908	2836	chrome.exe	114
PID 2836 wrote to memory of 908	2836	chrome.exe	114
PID 2836 wrote to memory of 908	2836	chrome.exe	114
PID 2836 wrote to memory of 908	2836	chrome.exe	114
PID 2836 wrote to memory of 908	2836	chrome.exe	114
PID 2836 wrote to memory of 908	2836	chrome.exe	114
PID 2836 wrote to memory of 908	2836	chrome.exe	114
PID 2836 wrote to memory of 908	2836	chrome.exe	114
PID 2836 wrote to memory of 908	2836	chrome.exe	114
PID 2836 wrote to memory of 908	2836	chrome.exe	114
PID 2836 wrote to memory of 908	2836	chrome.exe	114
PID 2836 wrote to memory of 908	2836	chrome.exe	114
PID 2836 wrote to memory of 908	2836	chrome.exe	114
PID 2836 wrote to memory of 908	2836	chrome.exe	114
PID 2836 wrote to memory of 908	2836	chrome.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Users\Admin\AppData\Local\Temp\2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-06-01_c190afec670f15aee90d22b6a5704242_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2cc,0x2d0,0x2d4,0x2a0,0x2d8,0x140462458,0x140462468,0x140462478
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd85ddab58,0x7ffd85ddab68,0x7ffd85ddab78
    3⤵
    PID:3096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1924,i,2368336986316368383,15532191472792301072,131072 /prefetch:2
    3⤵
    PID:4116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1864 --field-trial-handle=1924,i,2368336986316368383,15532191472792301072,131072 /prefetch:8
    3⤵
    PID:1812
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2112 --field-trial-handle=1924,i,2368336986316368383,15532191472792301072,131072 /prefetch:8
    3⤵
    PID:908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3008 --field-trial-handle=1924,i,2368336986316368383,15532191472792301072,131072 /prefetch:1
    3⤵
    PID:3924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3016 --field-trial-handle=1924,i,2368336986316368383,15532191472792301072,131072 /prefetch:1
    3⤵
    PID:3472
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=1756 --field-trial-handle=1924,i,2368336986316368383,15532191472792301072,131072 /prefetch:1
    3⤵
    PID:4108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4448 --field-trial-handle=1924,i,2368336986316368383,15532191472792301072,131072 /prefetch:8
    3⤵
    PID:5164
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4592 --field-trial-handle=1924,i,2368336986316368383,15532191472792301072,131072 /prefetch:8
    3⤵
    PID:5176
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4608 --field-trial-handle=1924,i,2368336986316368383,15532191472792301072,131072 /prefetch:8
    3⤵
    PID:5204
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4444 --field-trial-handle=1924,i,2368336986316368383,15532191472792301072,131072 /prefetch:8
    3⤵
    PID:5308
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 --field-trial-handle=1924,i,2368336986316368383,15532191472792301072,131072 /prefetch:8
    3⤵
    PID:5984
- - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    PID:6052
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
      4⤵
      Executes dropped EXE
      PID:6136
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:5344
    - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
        5⤵
        Executes dropped EXE
        
        PID:5140
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4620 --field-trial-handle=1924,i,2368336986316368383,15532191472792301072,131072 /prefetch:8
    3⤵
    PID:5392
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4660 --field-trial-handle=1924,i,2368336986316368383,15532191472792301072,131072 /prefetch:8
    3⤵
    PID:5544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 --field-trial-handle=1924,i,2368336986316368383,15532191472792301072,131072 /prefetch:8
    3⤵
    PID:4104
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 --field-trial-handle=1924,i,2368336986316368383,15532191472792301072,131072 /prefetch:8
    3⤵
    PID:3760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4928 --field-trial-handle=1924,i,2368336986316368383,15532191472792301072,131072 /prefetch:8
    3⤵
    PID:5640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1868 --field-trial-handle=1924,i,2368336986316368383,15532191472792301072,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1180

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1868

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3608

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3584

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1652

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1316

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1728

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1616

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1156

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:760

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1920

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4668

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2084

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2656

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2432

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4180

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1576

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3960

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3256

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2864

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5084

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1808

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3384

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4544
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5608
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 5db333935220ceb39be74421aa5aaaf93d5d3297958485535f3c46e1fe14c059
MD5 bc28ffa4b1ecf6df6983dc0bf3dce993
SHA1 795c4b013533ee00d098e91d0c9862a01a340910
SHA512 0c5421a825f01da32c78b2e02fe3df9aba13e0d10c92831bbb7aadd7d31e2176903f2c3e1983b81679d819d377b107c531ed5494a6381487c68826cb2139a814
SSDEEP 49152:vuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z50aB0zj0yjoB2:vPfTqi90bXB2Yyjl
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 8513a9adaf303d301d191e8445aefcf4a5ad9e21caf89e0ce1b7966bc3476ed1
MD5 f8190a1cda6b2ed548382438274f1b0a
SHA1 8c317211f4ff9546132fee06bf4bce9b473ca8c3
SHA512 0a7983084ea6a1892c14e892050a8a577e110269a9f83355cafcbd1487c5d1505b9b3d92accbaac3bfe0cb492f897b7436c9b1d26676812158b13cb38164158d
SSDEEP 24576:iidnBsuEVatr0zAiX90z/F0jsFB3SQkc:xSumaB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 1beab6c70c911026036f0990fe20dcec69ae886bd4adb03476e34a8d17ae9cab
MD5 5a24c228adc2ff090fdb4fadbfba689d
SHA1 c0936bbe465951d26a205430ecee4e844a787427
SHA512 1d73af590715d9789bc6387e9f1d9fee6dc3b0dd67e6227baca5f6df675fbc0952517f676f2b766127d2e0424784b83934791dc0ae4166ff293fcbb8dc939c4a
SSDEEP 24576:l+gkEVfh4Coxatr0zAiX90z/F0jsFB3SQki:MgkExSjaB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2d0f195919f88a47448da42e21dc0572b52d5124bd52e4e2d5186df8d51ee06b
MD5 35001f701ccccd2b0d1e81bac5f9cd8f
SHA1 c541c0af54e7288cce8ceeb87f8c14250f9f5a5a
SHA512 ea4ae8d09cdeea64e0299c03fd55e7f1e2d28f1704c041d75698e44632283a191bfb19aacf7bc6960576438c2ba3c8f9e7ef789d1b69f5b57d83173bf9e670a6
SSDEEP 24576:iBpDRmi78gkPXlyo0GxjrAatr0zAiX90z/F0jsFB3SQka:WNRmi78gkPX4o0GxjUaB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c522a5571674ebb83bf651e3d1ad9c7465bcc50cc30d879da542d38836898be9
MD5 7dcfd532f026e8d749b06dd2fbfd96a8
SHA1 48ef7b2a2376b5e9f267c6b38de0b8312a7db9b8
SHA512 3d8c8b4af7fff11671534b835680656e0dbaeaca5050a5275a7aef6042168bc79eeb1751b1fe53a1a415b43552f58031862202da5d3e9bd5b04b9294ef6fdfcf
SSDEEP 24576:NLOS2oyPIXVxatr0zAiX90z/F0jsFB3SQkQ:n/yMaB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 f171ee6b7c3191ee039721596a756463834dd29db94f993155bb9586701782dd
MD5 56b3496f13cf0c478d05b5ffbe8e5b83
SHA1 2263131f27bf85b1c3c72481f7aca55588633090
SHA512 6cdef7bde5b56f37f2137f68363245672c8f5456e16007c40fa710f3abe0244cba3e37430b2b421c852c32fc451cbd90a47b2e99dde3814a2100573948adde1d
SSDEEP 12288:GfDUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8t:GfDatr0zAiX90z/F0jsFB3SQky
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 2e0166e8f6a8cc63ef45c608344e92578dcb6defa18a54458262bc7f82efc4bf
MD5 60a41a570b78826f6a7af2a1f30cd4c4
SHA1 4c6f58b8f2e9ba0e71a16ca33d05855b85574825
SHA512 2e4f8508ef424197ce54ef55655ed158978f16bcf304dfab621305014eaf51d6fdb4e77fcc0fafe66241c7766070867090fc67e6a8bbb76a20d992585ad16393
SSDEEP 12288:feBNUbTVO86UKUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8B:fJIUKatr0zAiX90z/F0jsFB3SQkm
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 bc667308f50f8b61ea5cea7c217c406e0cf865e8cfecee98270a698d3af40a8c
MD5 7993f9dc5e3679804af93d8ad766bfab
SHA1 6684534afc888074dfbcc69910f9f4099106ef49
SHA512 c31086da1021770a95e29ac4d0b272d9e2f6e1d5d0b25b870ad83a0f1556172dfa42e4ba8f36f510db462e36e7c40b6797254e103054a5173caae6a5447ea012
SSDEEP 49152:pCbRquA/m2yL5zTfFiV+XenmE3/z4aB0zj0yjoB2:moquVjnmoB2Yyjl
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 a555e6686ce204b08bf4d7315e389b28c77035867b294cebed2c32da2bc3ae13
MD5 48506f0cb22cae6c17d321e2084d1d9f
SHA1 7d327d64b58f3c17ab6a4ae4e51bb9ee8140805c
SHA512 81deb8a945cb014b8cd4ef322d8a2c434abc18297d65550e4ddebff9b72830f69a132a8eeb0a3f8af3543bf93a1baaa6d7ff09ff5d32aa9a2f40be317cb475a3
SSDEEP 12288:smw5HEjsChNVBFgl0WDm+CdUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8J:JwuoOWMatr0zAiX90z/F0jsFB3SQkW
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 1f64e5cdfbed12594e1d0231a7b9febed3b6692885ff0ce81aa8d1672c99c11b
MD5 3050481e85b5517e9e2f31073bb2c965
SHA1 488053281bb17baf089c2907e8926e5fd82c563a
SHA512 387640d0b6c55ed904d2dab9e8a7a66d18781a20f3d4ab3c12bc62ec2a5275d2334131ebea0bfb4125c3278e020eb93bef9182d4517e4f213ed973f7bfb1bddd
SSDEEP 49152:Y0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLM:ewfhY7g/rLd7yYA3awr341gwB2Yyjl
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 9143915b8b0e4398a29f5023ac46108d98e9488fcf4a764abd93471b438b9c91
MD5 4e2fcd59eabb593759a9a5c91559e0ad
SHA1 502605b24a03da4ec839d363d36bf248943bbdf3
SHA512 d519b897cd045aad08fa244b3e9bacff925274b82c2dbcc29291b597293a6e8d0546855c7113c6a9fdb239699a912086cdf1d8dc18efc7d8c26e84a437f2eb9a
SSDEEP 49152:ly7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxYaB0zj0yjoB2:AmYeyxHjWjMTXB2Yyjl
MD5 SHA1 SHA512 SSDEEP

Submit Download

8e0772cc-d3f6-4e51-83b4-4415449116e6.tmp

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\8e0772cc-d3f6-4e51-83b4-4415449116e6.tmp
Size 488B
SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
MD5 6d971ce11af4a6a93a4311841da1a178
SHA1 cbfdbc9b184f340cbad764abc4d8a31b9c250176
SHA512 c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f
MD5 SHA1 SHA512

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 09142ec1cc236b567d78e66e9e7cebe344b6d3ff247e5d2873aac37524af4832
MD5 33ba131ad0cee646dc48001927c9944f
SHA1 f701972f1709d6761be996c01f1a81490eb57325
SHA512 4e3b0cefbf9a05fb3edc03c77aa15d4bd9a2420ba407da5b894af66e520f369dedfeb8176f3c23c9619d0959d5658cbb098ec8bcff0ab259b46490f80eaa3e39
SSDEEP 24576:DcP4mcvIjkGOxhKP2l71SNKbrh/8KBXatr0zAiX90z/F0jsFB3SQkw:4P4m4IpOO67N8KNaB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 f36101d056932eba1217b54d3ee1c54e0c6c4120087bf1e1e0781625d2be6fc9
MD5 89f55681cd116518c116754e0407b2c8
SHA1 f5d4aeb85e94ba181091d6a1ebca93915919c9c6
SHA512 8db0dc249a77703508e63c8314af4bddcf54ac4f887b26409f743b344b94f9afe762d266cbac8b8097ffb28870d40841c7f64ed60acd087dbc1768db15b1c0cf
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 193KB
SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
MD5 ef36a84ad2bc23f79d171c604b56de29
SHA1 38d6569cd30d096140e752db5d98d53cf304a8fc
SHA512 dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be
SSDEEP 3072:HXm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4g2rJBXCy9enoN:HXUMCm4U6q62MEBi99g6JVCvoZhhl+No
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5573c273a52c580b5d06336b54fc0adbcc7abf97f2f28cbca7fe3cd441d941d4
MD5 fb0f7cfb8e8dd7f436506b029cd90259
SHA1 087053dbc049767ea8233df692bad3b9450a311e
SHA512 764842b0372b747bee747fb2251b21291255093a3e8045b7522dd7e475ff3d5fa85f10a7b221b7cb1e1d5f94b944fb650b1b4a23d85e3e086c997a81dc99d2ad
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 e2fb31753e18e6b111405d425a61693f37e74a80cffc69bdb3c71a1df0a64e18
MD5 e1456cbb58ceed92b1d8bb8416d52482
SHA1 754c62b271006ef25c3195a7378fc917a6abdd87
SHA512 3bd4815c287c9c98070fedc7e6c49e8473849bbd7cfc882ad043743ab38ac23737c170fa70e18f11335ddc85792d82def4feae1bc05edfca870f0a4f139e552a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 4b91ff862a5947d7ae8a3e143ec35ef75bd354a0cd1032c8e7278efcecf81f17
MD5 fb101ebde6d17c925c07bbc27a81fade
SHA1 a3b7ccb85fb57e7584f5faedbedeb83968b5f16f
SHA512 9913458ba570ce6425c6371ae178e04f07a3c34f8866d5bc081473ada520155f3f806f6d271e6fef75a8abae717e2ebf37d1253e9f2b046641898197c6437d11
SSDEEP 96:PplgrlIXxCJoJkJ6pS8iZRy7Dx+6MSmueyBOQZ+D2MEVMup:PpuRI8oeJV8syh+FCL+DPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe578e07.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe578e07.TMP
Size 2KB
SHA256 88575950e262396bd009db3c75b18b3a1cd44b7b869b90f9b2c961ce9b74c1ad
MD5 8e5632bb5baca5f24f88c9e2a8eb2b6d
SHA1 71f7dee86640b602595b40c6a65d7ed4498cf00d
SHA512 def476d83ba944f2fe83839108072677672a230218192751dd5e37305d42816e2db59b6f368fe8d3ca8848542ac3e3732dea3a58187c1e14f372ff2f721dffcc
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 580b842b2d27e1bf5ae8295a458c3f540502cc5923c0278c58e13a6f591339b6
MD5 c1c8826cd3b20d88d005e6ebc38fcc64
SHA1 bf5ae7d87f68c46cfe44e5100ec0e6777d66b3b3
SHA512 8f4846a41c336c06a50022c0c0c854da55e3acb7a9a20cd5097bc30a82ae273ea29fc041e0b72d75a7828a74c34dbbf29ea0827fcd55ccc5ff274bfc56f62c28
SSDEEP 384:Vx1ZLPLeCAXlj1kXqKf/pUZNCgVLH2Hf94hrU80HGNyjHQe:VrZLPLXqlj1kXqKf/pUZNCgVLH2HfGhM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 257KB
SHA256 0ba5c3d6741d14404375fbe390ab5d060d2f1280b25c4760496e838781bd8ed8
MD5 eeb28202f27fee3292db93e75a94b2d0
SHA1 885e3c893678d6b65d248c1bb4a548ed8571febf
SHA512 cff5b8bc466cbf2638f41a82150dc587fde0fcda29f9eba1439fca39bfb4e00c3636aace3fb6f64da79b1aef0d7c6345c24d1a532c0cc3b9f3d78bacd563dc95
SSDEEP 6144:u7Z5IZXqXHjTdCP3y/DQYRPILxZnhLMJjX0EeGzY2rLj:asqlGSDQ5fnReEFsLLj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 263KB
SHA256 4085d36960d50b5a294433700a4c2b45b687282c161fdb66d0644bbef505975f
MD5 340892fd36c2e730501acbaef1a95240
SHA1 2e611e10e4e383151f2cc0ad33a92d82b280a67d
SHA512 06e4d476e1bcfc2a06d8a559d9d48c97e8c08e0ff9c655e4f0964e01b2de35b0c1f8ed288b150e62d306bfc22cbd5e6916bffe67b692532b940f0863a1f70af1
SSDEEP 6144:mv+Zo0UgrZJqMU4x5iUt0/7supT5Z5IZXqXHjTdCP3y/3:FcTo5E/7supT1sqlGS3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 282KB
SHA256 4e1fe13283972928eef75bef16e7223e8397008ad019b4bece5c6774691b2a06
MD5 b1d993a6941a5e7c303ab369c01143b8
SHA1 da047d6e97b768f128e5d8c70f82d8bc53430a6f
SHA512 5c8015eaf2ebb4f97f6a5bfe44ef4c4d66210f1c1f1e039a784a4ce15d44ad322552203063a36e1b8760e5585ca0e82983813fe4566b0beb87509bee6ccfaadf
SSDEEP 6144:m2ARoGZ+Zo0UgrZJqMU4x5iUt0/7supT5Z5IZXqXHjTdCP3y/3:tUoRcTo5E/7supT1sqlGS3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 3d4bc3b420c6adb3063e2507b89f283fc3dcaddaa95bf5f443602a2a8ec47383
MD5 30fc90760805ec08a0a09dc5a8e7ef19
SHA1 3b8138811a2fd3c3b459287840110e736342a5fa
SHA512 2162a19ae43cea95532c6076295e76708714df8e7d82087b2c3a4ddef49ea12e4fd94c724c90e27b3dd101dfa38560802a2bf489bdc7072b311b7a659eaa1c98
SSDEEP 6144:m+W+Zo0UgrZJqMU4x5iUt0/7supT5Z5IZXqXHjTdCP3y/3:1cTo5E/7supT1sqlGS3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 91KB
SHA256 690c3c0e677873b1c72b57f938a51e0fd57c18d21b3aa6cb2f849d10a0d13e04
MD5 fd43a04d27941658a7cb5bb30dd68a08
SHA1 b3568d857095621ccac2e07280ab86bc95ade1c9
SHA512 c399953d620ce0b35da2a4f6d0c8372f2fdf8b38f8f8e01cfacc665e2a90c4a962cffd56ac108adb79aeb06b3e5be5a1dd53de96a09f4f7a0646ef9765fc07f1
SSDEEP 384:jFSvxEQvPHr3xfoWeIWTH9XGpTzmw/Ep9NI5SJRPZAWQbW3x7QMuXJ9xz+KXd7LM:iiQC4/zKxMVY7RAmKeix+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe580356.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe580356.TMP
Size 88KB
SHA256 155ae24f86fa90b0b105cfaaf346f05a4def1ea8a37361a79ea0922e9371b272
MD5 801b144b3de1c242cce8479ba8f80ae5
SHA1 2fef1c8fcb1e59cf7d57e35a20b75bdde9b67349
SHA512 4305e63e16add93f3a2a616d58468c46cabd942460350f7b72291bb5fe519036b558638259bafa85188a0420df8b3aad3f7db571741551be0e83862ef6e21a3a
SSDEEP 384:JFSvxEQvPHr3xfoWeIWTH9XGpTzmw/Ep8I5SJRPZAWQbW3x7QAXJ9xz+KXd7Lp5s:EiQC4/9KxMVY7RAmKeixy
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 7KB
SHA256 7c95a50a201e853858452e6099ee224929101287a4120c90a14d4b669effe709
MD5 1b9da6342487ced0c83f1696597046ca
SHA1 fc49244516db9a17601a6626a97b46633da9cb88
SHA512 bc058c404e8c1971167873dc7537de4ac1721f6409e20f2a809a23da23f8f3fccdf21790203a8b5f75741693c3e2ce8ff467a6a62b953243b8d15ad1d59e0f84
SSDEEP 96:vHUbPM3kIHS/0dwK3jK33m7P2cvmT45wK2pKK2D9fH/4z2AOBCB4X:93q/ni3zUTvOmB+
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 8KB
SHA256 d7d225ed3251bd1e5c93c5aa8b084efb143a106b0b464416f98aab27e6023e43
MD5 24a2a1724b4ed494ad40937d8217100c
SHA1 bf592856d86d5c2fea60d4be61b51b7fa0bcc76f
SHA512 62561322b4919ce79f2ec70aa830ab3329e3a8c9136a6068242f39f699fc455ac51274041f1981ce86b843d4a6bce8b855e3303481a826802b4caed8377e63b1
SSDEEP 96:vHUbPM3kIHS/0dwK3jK33m7P2cvmT45wK2pKK2D9fH/4z2AOBCB4nHyPE9wK3YKr:93q/ni3zUTvOmBBPHpE
MD5 SHA1 SHA512 SSDEEP

Submit Download

4cd82a39c8648821.bin

Path C:\Users\Admin\AppData\Roaming\4cd82a39c8648821.bin
Size 12KB
SHA256 dd3c5fa32cca009a082fb02ddeac4511015f43bab996327da4b1d237c772fe9c
MD5 34a66519b172b9b36bb698de66b65bc1
SHA1 06415290c15aeb573dc835d44a582f05089b108c
SHA512 88adc5c477e96d7fb270c1c93fde039ce784dee505b256c015bafaca2e0d74416717669afbc12e8b753f559cc75440131ad67e92557473e2e7cfe67c6e2536ce
SSDEEP 384:SY9lNQaoCniUEdz82A05gOwm7tZT0lnp+e:SWQao6iUEm2uOwm7bTsp+e
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 3304138d9a8d8f8b371e1c9fac804b67e0ca59087c795162812f74f8a55b701b
MD5 ca75e9822ebfd135a9f42d0ea582aaab
SHA1 208bbb7e42ae28c728f22be410a315e84e9ef6c9
SHA512 71aaee788b961cc34b7556bb6c81fb051ce102372d5564b2e0eb12584196813342ab3d53046c5a97bda4a9bcaabb93bd39971767af7a3795ad70d03a2ed9f27d
SSDEEP 12288:LPUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8P:LPatr0zAiX90z/F0jsFB3SQkg
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 069963739e5c8f5d8dd6bbceb0f649bd2f12153eb0a2730b9cff05aa816765ae
MD5 e3e47fbb902909ad3032e3ba09ad931e
SHA1 5a064c840cfe8689de11890b66748833296b76ae
SHA512 3f26e5a54ad21252a07d19a172d49fdc7f067f9e03f47d138677fa570416b2d07d24f4bb8ff459e266ce02c651eab3fcf56f18ca1d215d5c45c7033f61b10005
SSDEEP 49152:Ca0h2GEkuAe73q3pp46zwwQZaB0zj0yjoB2:Ca0hNYG4JwPB2Yyjl
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 0d847c842f259e8d511f693f5d34d115530423d44f1f80bbee9027b086f3b261
MD5 fccb68ec4c785e83783de2aa1dbecd31
SHA1 00a480e934558def8708e34171d7151553e8a688
SHA512 bbd8a7651d6fe1d75e59ac91984b3bd98cb58360d91042833a4ac3d09d45a4ebd4e0a9306e83a41e8c512a39c1ca4a1f96471075965005a78800cf83ed7cc4ec
SSDEEP 12288:lhbHjfX0UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8P:lhbHjP0atr0zAiX90z/F0jsFB3SQkA
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 21e6a7530f0f617aa65833a6a56c258d093e7e759b8109fb5480774ccf08eb1d
MD5 ba390624d33803918d70fe64bc11554c
SHA1 027771d6fbf8f166862f53b05fce348af11335ec
SHA512 c5113636ad8e597268afaec917bee6834232116346221ff55b60ad59fbb417d2242dad7c7be63c4967d77f1f63337f5bda52c7883a918ac7d4082f0e87e2059c
SSDEEP 24576:+3YgnJcRTk4yti+R5dpR/Matr0zAiX90z/F0jsFB3SQks:+IgnaTk46ppR/MaB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 4870a83def5d407e2e9a28cf01e9eeebdd68cd891894b9edd580abd735fcd924
MD5 3115b0bcce0c2667874c9719479bb993
SHA1 a380e8d21a841597c894500a75bd27d838ffe249
SHA512 190277743402d7cef2bf2133a1cab9087519fcc8f718fcd536623acd7e8327f461668ab1f1ea5adfe666147a3334b1641e87c4c66d233ad3c7153383b2c9d983
SSDEEP 12288:xjUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8N:xjatr0zAiX90z/F0jsFB3SQkS
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 80648965eb4f1d3c399176cee29887cc17ff1145e554fe5fa5c5cf368ae1fe50
MD5 c20531c5ca00e73582c3fc6792d322e8
SHA1 7095b6312ba266bf847515c66bff5f783d7efddf
SHA512 5ff38a52af7aba4917fd8076a97ad87e19ee8b5cecfe226fa1a33ffba5c40034bcaedc0b0d8b0e8d958b97753629e979987d95b1a634a0b0927ae4fce95f89a3
SSDEEP 12288:5Ob9A4LWOsvAYFT2UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8U:upL3UT2atr0zAiX90z/F0jsFB3SQkL
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 b851f192c0baca962b2e47a4d9c7c435338d6107d65a5a6ec0ec33e01307250d
MD5 a3d1cc394f40bb9a7ac07f64479c9a26
SHA1 82ba279acd8c35e8ec228f3c488d1a592aa8c88e
SHA512 fcd22d506aa2cf32f153e4dd01c1882fc5eb79ad71b5c941aaefc1c6b484bdc9ecf9bb57beb767b971c56cb225c08ebf8dcc4ddfaecb4b47b40fd0920f1c0991
SSDEEP 12288:upFtpOqUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8m:EOqatr0zAiX90z/F0jsFB3SQkJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 af56d691b2c1c7ee4a3a41334dccff867d31be930a7e9dc9fa20f37d420d2b8e
MD5 e1716a4000f3539037a60c550f02f817
SHA1 e517a2ed958886ddf3683b149cbc0cb968cd97a3
SHA512 1dbb8ea0ffe4ab970d6a815f30bd9da6b2bdd532cb05dad2cfed11071f582bbcea0c3baef1f3b7ef81bf1c63df85f3e98a5356657773a11dd9fb30a803427716
SSDEEP 24576:X7NM9YmZqmWMUkPjZM48Mv6bEhs/atr0zAiX90z/F0jsFB3SQkF:X7cBWMpPjN8DbEhUaB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 0ce1fc8a90bde5bf5586ef7ee3f9717d3060cee82c7277f1b77c80d4099bb2c3
MD5 33e1abfdeadc7831b780d01d3146ae67
SHA1 23f69d59191749ba9d15f9f9bd6c0f1865af613b
SHA512 4f937347587f3c91f6bde6dd50d4c7aa055160f9302edd34e0403dd7e031d0cda2b05048e3cc318c367a9803b8b9b070533daaad7cb7b79ecbacac71c4dad230
SSDEEP 24576:RW6BApg2YuyuNDYTabvcRvNYf8km11atr0zAiX90z/F0jsFB3SQkS:RF2YuHNETovcvNYf8kmfaB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 346446c063492a30dc29adb1ee6b56a600818779637053a28f6b91384e291c7d
MD5 a0f4ce755b8a084a96152ef9a5da8dc8
SHA1 a3a1e2251249e836d5a25d38dde902fee37be5e5
SHA512 4098705c823e4087c880eeaeeb330fdbf4010ba026e9dde6b48873a924d2ce4a9e40e656c98429a737312544a5734b05b4e5809d040d5eee66fda146e909b9ce
SSDEEP 24576:cAFs06+Omlf3NXEbToeatr0zAiX90z/F0jsFB3SQkB:xFs060lVXu5aB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 56eda9e02ca226ace08b71c12d796f839883d4eb9ac59c1ab14a5c79cb3104df
MD5 4b4542b6f54dc0992911b8c0e15e7932
SHA1 067efdba15c2d47cd24bcb44938f8b71f246e04c
SHA512 dffd323b932b01b3cc0f2a6ffd5e26f0a5d97b1ae4dbf1faaf13fa603014cdb3ddc6fd553e0e8f24d98dc6ef6b498bb5a998d6d39603a1078bf579553a3f91f1
SSDEEP 24576:BJnJ5D3Wt5atr0zAiX90z/F0jsFB3SQkz:BJnJ5DGt5aB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 7ee8985dee204ad0e17f1243ada45c8dabef0830aeb938902b5407c98d6e179d
MD5 cc02205141bb7b9871f0cc4bc1db2b0f
SHA1 1a42e7d70ac5c5c08d6d2bac60a9110e0d07387b
SHA512 dbb195190febbf0994c1e8ee939323aabad44b7a8db21b4f967cb3e9ebc19f89feb71fbdd8f18816e6a7d00119c95655b8586e8264b53420fa4fc655fe3d262a
SSDEEP 49152:lo06DIKdwc+eQnSt65aVraB0zj0yjoB2:yEB2Yyjl
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 ab72f3b0bc8585ab15f0cca1a2e5191ba56334932e92ce4013e1a91e0346166e
MD5 1eabc08afce8268564b7af59c6d14d5c
SHA1 0a6a6709a5cc859bb8993dc60e9528079acacd48
SHA512 10e06928db2a686a5e8222f08030c539ec7fea82153a738d9266d410d838424e65ad631e36eeb990b49ce4b7fb8b5f79c48ede906e5684eb4bf8469e7abb0d15
SSDEEP 12288:iEP3RrGUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8O:hrGatr0zAiX90z/F0jsFB3SQkt
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 d94f771a969cb1bfe3ae94408a87b177deafe8acaec3d97a31c97f47d2d0a5ec
MD5 39d950c884b8c5d85b4561f590a0c884
SHA1 39b24922126d837bd76b8bd5804fc4ad1f5f1bf6
SHA512 80fdc9edc1abc280853299176f991020cbe5c44cc2f1916a9f3d705e8a6d2d2724156e803dc80476e819f780b1dd2519c3c0b58f9404fe4ef45ccd1973f5b81f
SSDEEP 12288:RjkyEUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik80:RIyEatr0zAiX90z/F0jsFB3SQkn
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 430576ad341f843e62be0d77f89f1f4cd4c3621b06a4e66a444bbfdacb6f2c96
MD5 74c7863a177a51686f4605a9ca8ef828
SHA1 e9684f5dc592d325240abaeaedd08d56f598f049
SHA512 da86ce93d4854ad4fb12a37620f56a3053704f0ebb4dbe772083f79d096b024687edb77517fcc905f8490786e7e9e5af10edb342cd0123ad23554e9cc55742e6
SSDEEP 12288:IF6UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8o:G6atr0zAiX90z/F0jsFB3SQkX
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 00d3f0497e27f976747bc529275d0b14b83ac07861216a9ffdebec9d8f5300c7
MD5 4deb8b4dd0270d4f2869ee661077be5d
SHA1 d4943e80d8b000a6413cca7bd1b7bf28078c7e8b
SHA512 375c83258ef14cadf2cad941ab76c602f1777f3d9fbcad7a121acb9b91f10257532ce8bdcd09604d632189645e74cb615b8af34785863ab27b0c9dc0cfeeb51b
SSDEEP 24576:OQ9MxZKdcz97w3Hatr0zAiX90z/F0jsFB3SQkR:OVKXHaB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 7d6a7541c87aafa0e5973c8fe92fe23a135bd3e9f5fc35c7d267ad9a9ae64efa
MD5 082195d9c51989d011668a49354c805b
SHA1 b97b3b945ac8c90ba2f0a066ec08c8ec7fbe0cb4
SHA512 94eb7a1f97e9ef40abdfc73d80907d98d306c0cabcda19f0acdaddc59c77e4127d0f0067f9bf87bcf22debdef12d0c0005d91c40f9986357df32a7c799bf2e39
SSDEEP 12288:MyoKo2HRple9pYUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8l:MyocxApYatr0zAiX90z/F0jsFB3SQkm
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 03e2d7fba9552664e2d2d27bd3ee639850dd06ad11ffcf218963f24c7e40d3a2
MD5 4200383cbe61e7dba3fcded6dde599be
SHA1 bc7f15cffd343f19c4efa7659f2ea8adb075dfc6
SHA512 532cb3bf7bc7c08b9b5df3aacf9c8b833cfa22662d4b353a4e486f6c204ec67f7ea02cbfab959bb966f2cdaae0f3b67ed32f346d9cf124bb5ab105c9474b7464
SSDEEP 49152:2WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKYaB0zj0yjoB2:A0zuNITB2Yyjl
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Windows\TEMP\Crashpad\settings.dat
Size 40B
SHA256 5928caa89b1d2b710b06e2032deeeb129c5844abc95bb506a96a2181663fdb20
MD5 63c24fafa38c1b0109d7b33c1be0d22e
SHA1 9b3ae6d17378fa094069f9aef62df034089e3083
SHA512 1387ef7a3e1e729ec2d22463f44463c5645c772a8336127bbbc7532923abb04b62bbfadf10c12c2f6b50d1ffb567ae4059efe192f3fc0ffdd90ff0cafaacb6b0
MD5 SHA1 SHA512

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e226f244c3294c867e4933a8f7ffd4178319c10ae04d04bd1e17e8635bd0f692
MD5 55727ab80dcd2c6327634090cf6d71ff
SHA1 25c7d594a9bbd651d9b26d0bb20f2cb09703bde1
SHA512 37c0f7b1f7ede3f859eec85c02d83b833df6a484dcb59ce990dbf056cd445bd0707f5ddcc23139143f389be3ace1ba2fe6393855d4b544f27b5b543d5824886a
SSDEEP 24576:w1QT7EcpfxR+N5AWAz3ooiYtjMqbdatr0zAiX90z/F0jsFB3SQky:NTDxR+N5YzTfjMKaB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 0c6879db2363a0eef2c4bfe3d1c5ba24eeea498c5dc1b5a4a1d0f25e07a6aae0
MD5 a1ac4d31af4c3c1e1ede92d428c62c46
SHA1 cf8ceffab6ad3a8454bfeccd55e081255c31635d
SHA512 f60c5eb8378757410535810918de8ed5bb09e5a6f808665d76f806d5a7499b4370424099c9b3ee63ddc33b92145e9eac057bbd4a8c8a6c66e09a09679d4b3d13
SSDEEP 24576:wTMdOz0FFS+imSLBatr0zAiX90z/F0jsFB3SQkK:40K+imSLBaB0zj0yjoB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 ab8ea1607456767780cfbd81a980f612c160308cabc5dec33578c1b9a669ecfb
MD5 49cfac58275e4d559699289391b0efbc
SHA1 1f4a24c4cabb0300ef8b4a95fd39bb88729ed275
SHA512 107a4a45ec5f64fe3e10935ec467563a9e664e84ec06bcd0fa3e190899ebc3678aa139769be09502c491334d7a82cab730f22ffd9cb39f9ab235819bb3f3178d
SSDEEP 12288:g472UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8a:n2atr0zAiX90z/F0jsFB3SQkR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/760-336-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1156-335-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1316-75-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/1316-72-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1316-445-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/1316-66-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1616-91-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/1616-103-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1652-62-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/1652-56-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/1652-77-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/1652-74-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1652-79-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1728-87-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1728-81-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1728-334-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1728-782-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1808-347-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1868-30-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1868-37-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/1868-653-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1868-31-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/1920-337-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2084-339-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2416-5-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/2416-21-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/2416-6-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/2416-9-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/2416-28-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/2432-341-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2440-343-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2656-340-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2656-614-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2864-345-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3256-214-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3384-348-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3384-783-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3608-52-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3608-51-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3608-43-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3960-344-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4180-342-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4416-559-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/4416-10-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4416-16-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4416-20-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/4544-784-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4544-349-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4668-338-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5084-346-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5140-582-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5140-790-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5344-593-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5344-577-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/6052-604-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/6052-543-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/6136-785-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/6136-555-0x0000000140000000-0x000000014057B000-memory.dmp

Download