83fdd201f38b7771ac10b0f4476433b9cce16a9a2a9a480e12dd8062218cdcf2

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 13:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
Size 5.5MB
Sample240603-qs383she23
SHA256 83fdd201f38b7771ac10b0f4476433b9cce16a9a2a9a480e12dd8062218cdcf2
MD5 e90c601ef026eae7fd4a90cbea31c22f
SHA1 c317bb92ba40f2c1a3d7bf6d93ed008693593837
SHA512 c1d7fc34f6d85e8c25087accedf1c6050d22b8ae6ae514b2a6ce29eab8845e5b123cbffdda1fdfdc4ae51a75b71f6de4d320f7446bf0d92db29100abf8be6ccf
SSDEEP 49152:OEFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1Ln9tJEUxDG0BYYrLA50IHLGfp:UAI5pAdVJn9tbnR1VgBVmGTjYvH
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

spyware stealer

Malware Config

Signatures

Detects executables containing bas64 encoded gzip files 1 IoCs

resource	yara_rule
behavioral2/memory/3456-9-0x0000000140000000-0x0000000140592000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File

Executes dropped EXE 21 IoCs

pid	Process
4720	alg.exe
1268	DiagnosticsHub.StandardCollector.Service.exe
2380	fxssvc.exe
536	elevation_service.exe
4144	maintenanceservice.exe
4280	msdtc.exe
1828	OSE.EXE
5196	PerceptionSimulationService.exe
5336	perfhost.exe
5736	locator.exe
5836	SensorDataService.exe
5956	snmptrap.exe
6048	spectrum.exe
5224	ssh-agent.exe
5440	TieringEngineService.exe
5776	AgentService.exe
836	vds.exe
6044	vssvc.exe
5248	wbengine.exe
2920	WmiApSrv.exe
452	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\46630c30b3e2edcd.bin	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{1342F81A-D5C5-42B4-A5E8-933F7759DA30}\chrome_installer.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_156609\javaws.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_156609\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000077e1a7a1bab5da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000044361ea3bab5da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000016abaca9bab5da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000891b1faabab5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a32dcaa8bab5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dedf23aabab5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b25844a3bab5da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df700ba8bab5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
2040	chrome.exe
2040	chrome.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
468	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
6728	chrome.exe
6728	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3456	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeAuditPrivilege	2380	fxssvc.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeRestorePrivilege	5440	TieringEngineService.exe
Token: SeManageVolumePrivilege	5440	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5776	AgentService.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeBackupPrivilege	6044	vssvc.exe
Token: SeRestorePrivilege	6044	vssvc.exe
Token: SeAuditPrivilege	6044	vssvc.exe
Token: SeBackupPrivilege	5248	wbengine.exe
Token: SeRestorePrivilege	5248	wbengine.exe
Token: SeSecurityPrivilege	5248	wbengine.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: SeShutdownPrivilege	2040	chrome.exe
Token: SeCreatePagefilePrivilege	2040	chrome.exe
Token: 33	452	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	452	SearchIndexer.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2040	chrome.exe
2040	chrome.exe
2040	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 468	3456	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe	91
PID 3456 wrote to memory of 468	3456	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe	91
PID 3456 wrote to memory of 2040	3456	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe	92
PID 3456 wrote to memory of 2040	3456	2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe	92
PID 2040 wrote to memory of 4544	2040	chrome.exe	93
PID 2040 wrote to memory of 4544	2040	chrome.exe	93
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2628	2040	chrome.exe	99
PID 2040 wrote to memory of 2988	2040	chrome.exe	100
PID 2040 wrote to memory of 2988	2040	chrome.exe	100
PID 2040 wrote to memory of 3544	2040	chrome.exe	101
PID 2040 wrote to memory of 3544	2040	chrome.exe	101
PID 2040 wrote to memory of 3544	2040	chrome.exe	101
PID 2040 wrote to memory of 3544	2040	chrome.exe	101
PID 2040 wrote to memory of 3544	2040	chrome.exe	101
PID 2040 wrote to memory of 3544	2040	chrome.exe	101
PID 2040 wrote to memory of 3544	2040	chrome.exe	101
PID 2040 wrote to memory of 3544	2040	chrome.exe	101
PID 2040 wrote to memory of 3544	2040	chrome.exe	101
PID 2040 wrote to memory of 3544	2040	chrome.exe	101
PID 2040 wrote to memory of 3544	2040	chrome.exe	101
PID 2040 wrote to memory of 3544	2040	chrome.exe	101
PID 2040 wrote to memory of 3544	2040	chrome.exe	101
PID 2040 wrote to memory of 3544	2040	chrome.exe	101
PID 2040 wrote to memory of 3544	2040	chrome.exe	101
PID 2040 wrote to memory of 3544	2040	chrome.exe	101
PID 2040 wrote to memory of 3544	2040	chrome.exe	101
PID 2040 wrote to memory of 3544	2040	chrome.exe	101

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Users\Admin\AppData\Local\Temp\2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-06-03_e90c601ef026eae7fd4a90cbea31c22f_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2d8,0x2dc,0x2e8,0x2e4,0x2ec,0x140462458,0x140462468,0x140462478
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82e889758,0x7ff82e889768,0x7ff82e889778
    3⤵
    PID:4544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1876,i,7052096061764272630,12320560281549704106,131072 /prefetch:2
    3⤵
    PID:2628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1876,i,7052096061764272630,12320560281549704106,131072 /prefetch:8
    3⤵
    PID:2988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1876,i,7052096061764272630,12320560281549704106,131072 /prefetch:8
    3⤵
    PID:3544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3164 --field-trial-handle=1876,i,7052096061764272630,12320560281549704106,131072 /prefetch:1
    3⤵
    PID:4620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3188 --field-trial-handle=1876,i,7052096061764272630,12320560281549704106,131072 /prefetch:1
    3⤵
    PID:4012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4660 --field-trial-handle=1876,i,7052096061764272630,12320560281549704106,131072 /prefetch:8
    3⤵
    PID:452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3788 --field-trial-handle=1876,i,7052096061764272630,12320560281549704106,131072 /prefetch:8
    3⤵
    PID:1664
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5184 --field-trial-handle=1876,i,7052096061764272630,12320560281549704106,131072 /prefetch:1
    3⤵
    PID:644
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5348 --field-trial-handle=1876,i,7052096061764272630,12320560281549704106,131072 /prefetch:8
    3⤵
    PID:1880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5092 --field-trial-handle=1876,i,7052096061764272630,12320560281549704106,131072 /prefetch:8
    3⤵
    PID:3220
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    PID:5444
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x240,0x244,0x248,0x214,0x24c,0x7ff645317688,0x7ff645317698,0x7ff6453176a8
      4⤵
      PID:5512
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      PID:5556
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff645317688,0x7ff645317698,0x7ff6453176a8
        5⤵
        
        PID:5580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 --field-trial-handle=1876,i,7052096061764272630,12320560281549704106,131072 /prefetch:8
    3⤵
    PID:6056
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4928 --field-trial-handle=1876,i,7052096061764272630,12320560281549704106,131072 /prefetch:8
    3⤵
    PID:5376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5652 --field-trial-handle=1876,i,7052096061764272630,12320560281549704106,131072 /prefetch:8
    3⤵
    PID:5892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5704 --field-trial-handle=1876,i,7052096061764272630,12320560281549704106,131072 /prefetch:8
    3⤵
    PID:6124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5624 --field-trial-handle=1876,i,7052096061764272630,12320560281549704106,131072 /prefetch:8
    3⤵
    PID:5640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5836 --field-trial-handle=1876,i,7052096061764272630,12320560281549704106,131072 /prefetch:1
    3⤵
    PID:5324
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5056 --field-trial-handle=1876,i,7052096061764272630,12320560281549704106,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6728

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4720

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1268

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2196

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2380

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4432

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:536

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4144

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4280

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1828

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5196

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5336

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5736

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5836

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5956

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:6048

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5224

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5296

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5776

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:836

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6044

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5248

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2920

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:452
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5680
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4456 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:5788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
Size 2.2MB
SHA256 2e0a40c269812ae0f6a9b11400f3c190e0664c18371b398cc786ee25b7dec615
MD5 ae679dd1fc3458638956c981162490e7
SHA1 ed453af25c896004fed0befb1291802a359b6f0e
SHA512 490b1d0ce2b8ab9d9612989737cc4422fbf2e1b7ae8e945f694021bbb0ae88732bc61e311a202b4b5395b79c6772208e401251179ce615e9736ccaca4d1bc950
SSDEEP 49152:Z7T3mwzb/iYlzGQMebksutsKSMMdFrIe78vH/:Z7Df/hKuzHTjYvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 508638bb4dd46913c80be14eb79a5e6f4db71916ff3658437c6c6978943ac47a
MD5 2dfc8c518bcfd0cc2e25f81aa6f80595
SHA1 1f553225130d811f97113a0765e1c6fca110b206
SHA512 77ad2efde6cec47b4b6ddda42da0c8279e7f24df9c64c8917d09880dc19492b3b8420144b303eeea4a0aa480fc804a8b5a93cea5bfb8acb6b6f23307b7083040
SSDEEP 12288:lC0P9Q/JcuiJ+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:DPsJcuiqMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 e473c97da6059f302553603ffccec79389969a6033739d61d10484b7d8fd453c
MD5 e51eed28a09b40ec445488b0c8aae71b
SHA1 260075f47c53a52525e78c3f0abeaa4609de36e9
SHA512 5c13d504e75be1e3dc3edd288901055a9902bb15326a38fbc3a1bb392e6f93fe0dc1e20b8696ae65fdb1b264b0b043b6f4e1d571c8852bd65500e020a7d84221
SSDEEP 12288:r7a3iwbihym2g7XO3LWUHfh4Co1+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByInp:q+gkEVfh4CoOMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8279ad10ee0668621f8db9e8d6cc9076a265947282a3e5ec6c8fec0dab49a9c8
MD5 1c00a1712d301ca8deda30881734f21c
SHA1 9ae3e454cffd443f7158c5a75e3cca3cb52ad89b
SHA512 3562095c5e03f19a72c4bb495785320696af08ec692111dc778163633657a8d28fd13f1de0fdaca38553786ec8672044150e1693177ddfc2d984bfc85dcab2aa
SSDEEP 24576:7BpDRmi78gkPXlyo0GxjrBMdIuwe3zfIe7xmvH/:NNRmi78gkPX4o0GxjdMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8de78d1bcc3af970952a8e9b35d6edd4005b77abe5138e9ed8c539751ba99eb9
MD5 75e04365fa1c6ea4c1878f0e266427f1
SHA1 446304d438089df762bd7beb2b447abcab2be508
SHA512 e1c4751051ebd66cdd73d5b53ec9b71d4c93ed131afca629052320de2b0a4666d74aaeb7153f3190540f02a14ec2a9221bb498c7b30a4d79f1ae6ef50cf2fd37
SSDEEP 12288:4fC6Aj+TN5uixZN+8rKhUdTC/wE1MD0Ca5ZIXV1+Xq1gYgR+8DAoczI2ZfnwlQTa:kLOS2oyPIXVOMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 3fc33d641477c5763695544175b919b09b58d02d455f6c5551f745fdb513039b
MD5 f8d8d4522ca2856917f5812465410a5a
SHA1 7b572502a9366bdc47ca514a2309eda98d134595
SHA512 838e9b855a96c00947c4412b38cb1fb2f469d332c4e52d1ce0ccbe154d874c839d08e037baf4c32cce341c2072d1d087080ca5a58c7435004f40965c4d7fbbad
SSDEEP 12288:3f3+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:3f4MdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 83a88e2f9665ca93e0bfd65b74c954703333c69465c58af3e37390e5e067ae60
MD5 19a0095ba147ef165b931b4df3b0c066
SHA1 7fa066b1065f6831e35f23a4d582d6b867742dbf
SHA512 8bc746819bebe46c5b225b3388e63efe5fa5154b08c184692e94d3aaf254cd8b202a3dd8d0593ba6fcd307e5bed97c34c931f77628e74faaef52cab5be4e175a
SSDEEP 12288:5eBNUbTVO86Ui+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0t:5JIUDMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6dac10b01773d4743b79fe59ce2ad88647f79c7beb52e4458a622ef1e80ac77f
MD5 cffe2a55c63b35621193635005fa6891
SHA1 412e1c6ee67650160a5e79cb9bc07bc0c25a8f8e
SHA512 9fc5714490580c813c9d3581cd94190d36326e0027e13a3dc1ab2f16242ac4b2fc66337a28d23b244226c5aee8f96a09683be26e39d8b6698e696a5d922e4d5f
SSDEEP 49152:1QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH5:1QvGAdlCEL8c/yRNw5CRTjYvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 e8fe8d5465c71940d8f17d4ef76b8d1e45df2d23585a4c95511f3695b7753b24
MD5 84e93d3ff727edb25ff30c0812ca7904
SHA1 76494c6768b59568f92294abe9fda7aee1067cc7
SHA512 9ad65595edecb63fbfa5028e42e28655a38eaf743ca04bb50f623c05cd38914ff860d3ca9e81e7539f6908dc8dd5ecda0bbca2344a2f0291fedad5d225488c4e
SSDEEP 12288:AAwSfxL/2Dc34DLLmt0LDQewsAjQ+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIp:VdewsAjpMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f308e6038d9364946164d361626de8298414d739855b54fb71d1fffbcddab0c1
MD5 0156b73bad0c9ad1d8e407c06137caad
SHA1 b1fc773a7d9f1c31ce99878e4078e8721bad1cbc
SHA512 d06e8f71aca291c98abd2476a787f1cd5972facbd07e9a473b5d1cf43629f5b40fcb40e0dfcdd7eb8815dae99cd7cfc40ac93e5f9dcc344bd2b5ada458bf02bd
SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHyv:NUEtQevvqc2W1cpV2EI32S
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cfdc4b509272b846a49e997921fa830de4f8254de7096effc9c513ce7938d8de
MD5 a59ac4733736376d3003234306232f34
SHA1 9714433e0591989813ba4251782b5f6b6610ae59
SHA512 e87f9d7caa1b623d47524a5a4a1d71bda56291090a0bfd36a94e6e272048b5c01e2e0db22616846db8ab403caa05b475e2c689f38e3b4871a0c3e66828635ecc
SSDEEP 49152:dCbRquA/m2yL5zTfFiV+XenmE3/zJMdFrIe78vH/:aoquVjnm9TjYvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 b1aa6ef511532f4361682d4020a409608e6884fe38cb6b3f4b7348e5f40fd3ee
MD5 957f765b9b1c537b9d5112ac760b55ea
SHA1 03cfef3426ee9ae3cff5e51edc5b0c1e9f4f9277
SHA512 a679c6e70822982eea0338cac07e26bac21188a1376abf9e1b5673d97b6cd319ce60ff845d4f52f89bf8a9e4e797dedf2d3efab8212e94f32b0af5ae09ea1cb9
SSDEEP 12288:vmw5HEjsChNVBFgl0WDm+Cx+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xml:OwuoOWlMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 a6556cac79e11fece84d749dcd4113322fc7148f87f966f7c91662a8e2a52e4c
MD5 2edabe1d5de1809c114d16446d29906e
SHA1 bf6f040cd1f95d8000a2eb06d7ad169629790dd1
SHA512 e592b371e54ca5707d67a8f08d2e969dc5e72ab9a9e131b20730d0febeeeefbd0d22b53b0103f10b92a0c0707160bfe848f30752e5f4a3ddd46ebb1cf573fc65
SSDEEP 49152:ia/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4TLMdFrIe78vH/:sZ4K5MJabfsYNpTjYvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

9f0c0e12-6b46-435b-80d9-fb80f2109d50.tmp

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\9f0c0e12-6b46-435b-80d9-fb80f2109d50.tmp
Size 488B
SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
MD5 6d971ce11af4a6a93a4311841da1a178
SHA1 cbfdbc9b184f340cbad764abc4d8a31b9c250176
SHA512 c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f
MD5 SHA1 SHA512

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 f1f7cf02f5c98134f39ed65899845d23e5d9acbac5de90c4c4a994498afed688
MD5 59e14339e13bc7d1012e1461b51c97ac
SHA1 04b5937082abb8852a1286863710ea2725879bb5
SHA512 7523b9d3bad1ccf67fb987287c4647aed209ca6527eba7b498b297c5562e7099728c628f4f073a3c78335f70ef74b44b070c9f0da7c771c103c53d3b22c580aa
SSDEEP 24576:6cP4mcvIjkGOxhKP2l71SNKbrh/8KBkMdIuwe3zfIe7xmvH/:lP4m4IpOO67N8KCMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 bd34434d117b9572216229cb2ab703b5e98d588f5f6dfe072188bd3d6b3022f3
MD5 85cfc13b6779a099d53221876df3b9e0
SHA1 08becf601c986c2e9f979f9143bbbcb7b48540ed
SHA512 b248162930702450893a112987e96ea70569ac35e14ef5eb6973238e426428272d1c930ce30552f19dd2d8d7754dc1f7f667ecd18f2c857b165b7873f4c03a48
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\en_CA\messages.json
Size 851B
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 193KB
SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
MD5 ef36a84ad2bc23f79d171c604b56de29
SHA1 38d6569cd30d096140e752db5d98d53cf304a8fc
SHA512 dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be
SSDEEP 3072:HXm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4g2rJBXCy9enoN:HXUMCm4U6q62MEBi99g6JVCvoZhhl+No
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

11731e26-f12e-4bd7-a3ab-590e0ebfb900.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\11731e26-f12e-4bd7-a3ab-590e0ebfb900.tmp
Size 1KB
SHA256 37ba1affc19df088621e7ba942bbf89e7f9c27fc29dfd66753772632e9ec32bb
MD5 2e0a11fa99f55f4d0c68f69ac372b74b
SHA1 4e7950185934a5fb20f033fd41ad5dbeada1c462
SHA512 cfcff34cfbf9a756f74f75d786ac626e806706b7af5cd020da5951fdecf7edab5ad1a9517546d6ff2a226a8a14745d4f69b4a956225f350db804671c6f6de839
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 369B
SHA256 ace5d52168cb52906a6f75a1dab2f45f2fed06c2d03431822c10b5209c5757f1
MD5 edc764e959f5e2ecfbcb4b169dd20829
SHA1 4b905dfc508aa049bee372e5859bc39c0b99866c
SHA512 95d310101e8a1980be7d0519c22cfc7dd26bdf761b8752ba0eb2526bdd1786525aa91993df1392de0f8a7a144611bdbc0e1476ca4f72a46d13923f5df3ae1dba
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 4KB
SHA256 2dae77fcf1f781c20054642dccbf9d6641a4802a05078d929a5e305470717525
MD5 74552610abda89c639f611765545f1a2
SHA1 5b38b5bc6e573db0920024e43f084def338a4fca
SHA512 8bbc7b21e6dc65cd7674afb75cc09b14aeebb30ae50900f837d7acc84d193620f0cb91935c0db12c7f2cb1b6ac6998c3d7218ecb266d4fd1ce6bb743744eb7c9
SSDEEP 96:G7ob0dk8iZRy7Di+6MsmderODX4jVlVup:Gcwy8syy+FZ4jS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 4KB
SHA256 23f93c0914ee0b565e6598e7e714872ab76df2a76efc79667f302f6facdd5053
MD5 0cf580f79f6bfdac6d0aa874fc73fb6d
SHA1 8ca2de3cd9741e7d8ed35a0fd1ce929c102de749
SHA512 c29112c993bf37d8106a790afa46bfb00c91ff8f93905a8112479d97f163e28a6aafe61357b320afbc1d58d23dc50233e6297dad58f1aa0316f46dd572e73aa2
SSDEEP 96:G7ob0dk8iZRy7Di+6Msmde1BODX4jVlVup:Gcwy8syy+FEm4jS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 9892e299adaacd7e55d2d055e416b6b7df8efd2b9d7ef282443b1bec7e485809
MD5 cd35efb3e843249368bce41d83b975a1
SHA1 7bcdee846426e45a750dae02034f5256f89041f6
SHA512 fd5c42d46d5e1c593c17070745e34c80596c01ac8c6269c090be342709689f8a4fcb40bf4d807944003ff2cbd344586e92ab8f0d075a1b9501402d79ca525f5b
SSDEEP 96:G7oxsXHuD85iZ+30dk8iZRy7Di+6Msmde7ODX4jVlVup:GcxsXc85cy8syy+Fd4jS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 4KB
SHA256 8f6dfa7676f4fa87849ed7ab84fd1ab2de9230cd1bea72bf0923b1979192219a
MD5 cfd55dc41ba6c4d447f6cb1192ad3a2f
SHA1 9b1403fb9f2c0c0bd5317721c9d05169c414f529
SHA512 b1baec4a3a2a825b06556a5d025b04671c854fd0311f038c9eac2bf39645ba76420d233b6e511e2eb35ca96d42f43423779971f47b1ddad3bb9c9d109c412395
SSDEEP 96:G7ob0dmd8iZRy7Di+6Msmde1BOxjVlVup:GcwS8syy+FE2jS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe5823a0.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe5823a0.TMP
Size 2KB
SHA256 0bc76b0a74faa8d4d25cfa28127c42750e86004af7a10d590e07a33a89726b51
MD5 04695aadffdaf28b5be826d27d48721a
SHA1 ce79df7c80926a86b0e1a922a05bcab16c7620c4
SHA512 aa3438c4a09ea9c0c52dccb6cba636ac99c11b47a5b78317869823d6c39bfdfa304f40e67867b8ca9c4269efaba12431ae59a1d54c671f38acb9e4fe3d23da54
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 10KB
SHA256 8283818fca84eeff3f67375a94b847e7767e5b3c8deb4823cf6c4fa76301d49c
MD5 b81b7521ec9a1d84cfe302eb1d20e1aa
SHA1 a76742d26d0acee7eea856698fa18f4b7ecdf676
SHA512 c7c384aa8cb78fa4298adb868b44ac03ba81bb38f919b3457abc5cfc7a37942c090a663b407054a9aebfc7626def0a769df46fc99369adc0b9902bdf5272a7b6
SSDEEP 192:144dX+m1kXqK4I40pUZNCgVLHrKHfFyorUKKTJMkccesBH/JzzErY9QbQE:1rXF1kXqKf/pUZNCgVLH2HfkorUfV3zC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 6a77ec0e1cca25bba07df08383189b40873a97466fec3b163eebd06209bccf54
MD5 6498369aea200f4e8f198d6aa5b6bef6
SHA1 17134e790198c4ae17f9da82fe57d108117fde21
SHA512 74f1a4ffed5124dad77398bc2e0062f7b9ff6aed10fa2eb541eb58beb85c1d271a8404a02ee472c391a482124d67a1e5e953318323650c48c43251bbc8533f31
SSDEEP 384:1DLPLe0XF1kXqKf/pUZNCgVLH2HfkorUfD3zE9Ur:xLPLJF1kXqKf/pUZNCgVLH2HfvrUTpr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 269KB
SHA256 c00ffff650a0cfadaf1e38cae4a0eb08c9bbd61d2bf5eb89e29f23c43596b2da
MD5 86b8fdaeccf13dbc42eda6957c20855a
SHA1 e228671f9f0121e4ac286a0ba72e9735a94465bd
SHA512 3027f2e70f95178ada86635e51fc0a20405c91c7106010f6dba73f6fecf7b44e3f94cfed1631f30e2f664902aa156b5e27f5a9ab4565ee9aca93a9126a5b32f8
SSDEEP 6144:B4axdKfbQ2S67nxEm1h6O0ASNdvXCNpbMHtCMpS8:BPxgkIChASNdpHtXd
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 4KB
SHA256 c2e42bbec301220101bf3195b08d7eb6ae7de5fa0d0088100416b0758f5cac3a
MD5 a55f2ae388a713fad452a9010207cd4a
SHA1 5caff2a1e251ed40076eda470ef7420d6086022d
SHA512 39ed7a38fefee12114b0837837952dbcffe6e122748c40a333be8ad6962bb8540a7368e8b1dc1f0ddc6cea2c08ec913d8bfeacc17a48799ab21c066ea6da044d
SSDEEP 48:qiZli4qHFuO+CS2frngD1HMDOjc4OWOdquCngDtD02AngDtD028H2uOtMojdDY5t:ZW4cKRw4Ne9xK2rK2b1JzMnTNF8gj
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 6KB
SHA256 1ea3ab66d04a189048986402d40806bdad9d9487e989115203aa3d687e43cf5e
MD5 6b3e0a9af2a14c6db9cb76d4fb70bda6
SHA1 a05e26be36b1c1de0379c1e24abc827a334e464c
SHA512 2ea0678108e05294f200d19a12c22da9e76e3b4d127b7de026943c9d04615c7843b9f48ef29daa4821a08a6f17e738d4b57a0632a5cf96536e428478ab25b831
SSDEEP 96:ZW4cKRw4Ne9xK2rK2b1JzMnTNF8gM8o95qoWxK3IbK3k:x5N4BZYTNg95r2Xb3
MD5 SHA1 SHA512 SSDEEP

Submit Download

8a5d1142-2cb9-4ec3-9840-060314444141.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2040_243042739\8a5d1142-2cb9-4ec3-9840-060314444141.tmp
Size 88KB
SHA256 d412fbbeb84e2a6882b2f0267b058f2ceb97f501e440fe3f9f70fac5c2277b9c
MD5 2cc86b681f2cd1d9f095584fd3153a61
SHA1 2a0ac7262fb88908a453bc125c5c3fc72b8d490e
SHA512 14ba32c3cd5b1faf100d06f78981deebbbb673299a355b6eaec88e6cb5543725242c850235a541afa8abba4a609bb2ec26e4a0526c6b198016b08d8af868b986
SSDEEP 1536:bCwdkDMb+jCnnSGIdfT9zcbF6gNoLNdN4XhCJQS1pOn5IJ1pD:uwyAbvShdf5CkgN6nmkOup2oLD
MD5 SHA1 SHA512 SSDEEP

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2040_243042739\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
MD5 SHA1 SHA512

Submit Download

46630c30b3e2edcd.bin

Path C:\Users\Admin\AppData\Roaming\46630c30b3e2edcd.bin
Size 12KB
SHA256 0d17259c2090fd3c1dd9d79aff901c744c0fa66a98dc95c2cc7366c4cdd2907f
MD5 d0ec17962ffa9471bc800d49b32a94b6
SHA1 3e16b7c43caecd27e3765d9131d656fae259849c
SHA512 f6f5c11783f0cf7ee4822d9fe815430eaccbb985754a8d03beb3726083254d2a7b53b89e90193045a50c06c4dfc7471ac6aa01bf5009e684665b02fc22709400
SSDEEP 384:xo2ZkBwKnecUrHWOBLfTmYE2pZ5J372gQyV80:KheHrHWyxE2f5l7JQyV80
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 ec1190c06f7a25e7d808bc1fb02866ee74d3f75d6498fa909e44aeebd7f1a1c8
MD5 f272fd8f1c4d5de07ed687b799bde500
SHA1 d5cfd05d74206fa884be04931d3f8680d814aa1b
SHA512 b92cf72eaf133b36a47fdf88b6512e3fea84e1539a3e9cc977190c2c6b653de530312d79300c874f9415be4ba4929cf7989b3de01d471aa3ac2e359f4308ab81
SSDEEP 12288:ST+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:SMMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 f4002a6983e1099282d19286c911061a86250f03793d26618065afb3585b17f0
MD5 9cd1dda8d40bb4993d7425e615ed6937
SHA1 c3e05f5f1c509c9eac181169e5b6f0e099b26211
SHA512 288c18e3cb3d2e0c06a9e1fa09e356e0c2b21a98a672ff87be8aa8401b4a9cf80d55d10cb1409ebc6c64dc840814391ab3f6cbeb1407f1b964335ef21c59df27
SSDEEP 49152:Pa0h2GEkuAe73q3pp46zwwQGMdFrIe78vH/:Pa0hNYG4JwyTjYvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 b86471cdea463f2588c8b7d34fabb0ccc05d4067e8644c6083e75810d6289a85
MD5 5d602882938fecd2dad241f35ec37b69
SHA1 92f3f8a6c8da2575df319d649224839037fcc42c
SHA512 c238b768dda53722a2623f73b87aad861ba3ae42cc5a572cb6111b41e2a66a9761a58a6e33cf983c3b5fde0e8b5621b74b39752d9c8c34b78489a45a253f7195
SSDEEP 12288:8hbHjfX8+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:8hbHjP9MdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 89efc4e5066f320362e93242d0819c1ca0b590c99e66039ef349e94d040e5497
MD5 e520b82536c98ea16da9ef3dac874771
SHA1 f9ab8b81bd78373399137555e3078eb3325b22d4
SHA512 a38ea294677360ffcf53fb28736805bddecefe6daffe667b8c8bb49d2e8c0c9737383221918d45ec7a3ed107973153dd1c2be1bbf3b6d791691d1ff1be92b8d8
SSDEEP 24576:x3YgnJcRTk4yti+R5dpR/lMdIuwe3zfIe7xmvH/:xIgnaTk46ppR/lMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 41f6cb9731c940216a1dd774c93daa25da05cf5f258bc6df7772ab8085f386c9
MD5 f061c846648ef524b90de3c799af98a0
SHA1 75d3ede0f12df9f557269ce832bf4eb43fdb188b
SHA512 5506aed57f19e5009fa131cc01fad0ab8ff35e7d1a6a97d128db6d2641c795c6f4702ade46671a16531e0a590114202af4581dd078560c1baf9fa1b709d56635
SSDEEP 12288:0X+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:0YMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 8f361842548e2718914c6ae0ca837dd816981d6ef5c23778107445a907dea8ef
MD5 ca676e93090704875c5eba25c6f8ee34
SHA1 43328057b35cfdde69e54bfb5e1cd8a1bc32bfe2
SHA512 5273ee7e31e9b35894b7a9047798e38c823cdc2950bdd5caa00051e626ff472f6b406ee4a9e2776a6ef9a4c63e13c078c39512e1f8bf39d45de70702c3c3fed4
SSDEEP 12288:oOb9A4LWOsvAYFTu+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSN:FpL3UTXMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 ac9a2db92afac4114d98eb79ddc75e9c349107638e69396f5d784e724a9073f1
MD5 7e19afd8df24a6493f8db6e00ab83fa0
SHA1 66f0caf0ba63a032c9a2ae27730a691f4bd333e6
SHA512 603a453d01323bb897e8c792a9d8875a02f8c71526afaebbf5cc2c936aeaac9b818f3cc197f6d12446822bdbfff0b2fbaa4af0a164c50ea7d3d2ea42b24779f4
SSDEEP 12288:dpFtpOC+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:1OjMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 cdd720ce17275fc27bd59940d3c19aa1a434f7eedeec7fd5d88b6da68be7ad29
MD5 a440ac578c85d0166fa99d6daa1c84f8
SHA1 e6796d4918b47809562133bb13175b066e3ed9e0
SHA512 90103e57ffb88e8892eaadd248feaf92a70480703e9b55bc0fa0aae7cc3112aba54112d902b3ffcbc4eed7555c261e463324b00e5f3009c70e67e7fa36765ca1
SSDEEP 24576:37NM9YmZqmWMUkPjZM48Mv6bEhs8MdIuwe3zfIe7xmvH/:37cBWMpPjN8DbEhdMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 98b2704677549d0871bc8eeced6e730e97627174bd00d2ea274f258ab4713da6
MD5 53064622bf85ea40cb8778ea7218070f
SHA1 1faa52e3aa033ef1a2238bc3006a1aaf91c2c88e
SHA512 9ee5192f0fab1497261a018da8d6efacc5792dcbed4a86d57c885d2bb9b2db1eed256eb900345bf5627326aed3a7a93abfb30d0e61ca79361f624c38904320f0
SSDEEP 24576:qW6BApg2YuyuNDYTabvcRvNYf8km1aMdIuwe3zfIe7xmvH/:qF2YuHNETovcvNYf8kmcMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 2f1f1e8a17d98ffa8f681c09007d7a4dfacfbca489d9908fdf4454214ab4cbd3
MD5 7365f49789c7112d899eb980aea104d6
SHA1 32d542dac140d01535e0699291bbca0eddf8e486
SHA512 0c64333106970ad7291659d94472baee20132b9e101f6d2cb8676cd17406c5c55527f4cb878c7f3ef29917b3ff8c308fb61bb1da588feb248550f438dc1c42ec
SSDEEP 24576:VAFs06+Omlf3NXEbTovMdIuwe3zfIe7xmvH/:aFs060lVXumMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 5f6a7b3d6f70b35f790607b03f000eb14a13f8c73b9c5d1fdfe459a0fc5dbc56
MD5 3cadb288c57ef973e4f2c00056698861
SHA1 198a7e9ae2149c90fa70b43defc098b9ee14c7c5
SHA512 de6fb3f0a9f56f91c4217d8d9442480bad80dd2bf8e4a15b0fa659d7d3b6dca01ce60b00ab399a8d9adad939af00370ad626ce4ee663d96d7f4b91c9940de738
SSDEEP 12288:pCJnJ5D3VkrlzxD+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSlb:AJnJ5D3WtmMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 9df261b3a30af8cfd60a213275a43c536a73786c870a2097bc21aae524fbfbea
MD5 6d5094dff047c4dece4039ea3c9c0ad5
SHA1 a4637bcb54ab92ddccc1c5bf5645973ab5e1cfc1
SHA512 a41f1bb5455cf5fec931ba08ee637e0c9c443b03679e19f994b738cef6c8a9f2e14fae3cb1552bb0a5042d13770950a1d9e9bb437d59258ea2b0721b4c99e2fc
SSDEEP 49152:ao06DIKdwc+eQnSt65aVwMdFrIe78vH/:bpTjYvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 cc634abf46893a46bac3b1290d9487b600af1ebfdf6c3535c136350253c96e24
MD5 43f2ab48712a0a584691793a8e32be97
SHA1 094c5222c0df733c84a4feac2524cafab5177f42
SHA512 810072f7b24cfa3f82e520c95e1704376a9e6a97ef4222baa03aeb1d5dafa61c98f062183971c9291b91e4b74b307ce7a21bc299f5524f6f1d48b92bb59bf49c
SSDEEP 12288:FEP3RrO+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:Gr3MdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 189540270aec27bdfe9e619068e60ab61dc118ec3e8774525c3b1c9de4537112
MD5 c876c7dbc7b406475632cdc383737700
SHA1 dd13a07f5d1bccca5bf244d7888e1a1bcaab9e4d
SHA512 f74b33a160555277ba74d94f1c6651b662c2e98a3ebdd197db6f49891d36ae309c944c986eab848e98ca83f99a0de62d0db8dedae11be3a7abbd5375ea89c6a6
SSDEEP 12288:6jkys+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:6IyNMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 e2ccdf630bc54f36c90a8c6be469ed3fa15b0654af571eba48208fbe6f675740
MD5 57421926412d1b2797eafd6990e3d77f
SHA1 e220442d05c444142bb3b8002f47f2499596dc2b
SHA512 776db7b58704e824acbfac6a5ce0ad7a0084e7b5522c401348358c358767feba5eccfb6cb67efbb93e9a3284715b5ebff5376f566eea5b9655169083ca5262cb
SSDEEP 12288:HFy+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:lzMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 22d8eb0d147a8ce604de78425843bde2c4076dc4b963128bd80c8ee348ab8297
MD5 ffa47c68e24753884099cdb5e61d9a9c
SHA1 c5174d8943a7e8232471c281369a5f8301d48b07
SHA512 8af7e896aa51c33ff84c09268d24dc146afc4d1c862f8e67be4b3c8144c20886f7c74ecc545666bed3f4b220095e8259d1514848c1fcdefd8c42b7717032dd2e
SSDEEP 24576:fQ9MxZKdcz97w3UMdIuwe3zfIe7xmvH/:fVKXUMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 99ecc1d83948b79319751b9f13cca24229d06dadbb8d7a7c3f38a9a912d9d8bd
MD5 b176b78c5a18ff48748451d579a2463d
SHA1 a4875126670a00f3c2fda529d42048670a29060e
SHA512 3721bc24c9ea2aba3607c84c04d96b36278ef0ce2f9dd3cdded55860764a006858f9a668f290f12c96590c6cbc1ee7fc6fa521a2bed503568dc80f992edfdb9a
SSDEEP 12288:5yoKo2HRple9pQ+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl++:5yocxAppMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 1f7e6fcf79889f93b60ff56f1f48ce48d64267ef62c2b98cb50abb690bc8c844
MD5 839c3a4daefa234490d29562e2ae088c
SHA1 4802b30673dff79267e812518a83c49b42dfee23
SHA512 9d00c60f61506b4dc2c7b0b1d88905159165a0eaf48657248d7c63fdaaa00b84e7363d2a03aa80c8fdab9d6946ae963f8de270a40ac9bccde9ba95ec5c13c8e1
SSDEEP 49152:eWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKpMdFrIe78vH/:40zuNI2TjYvH
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Windows\TEMP\Crashpad\settings.dat
Size 40B
SHA256 169bdddd028372b9c8dc1bbc8bc1a48dce9089467cf7c3b5967ebc20713b1bb7
MD5 0e1a0df5323f02fa141b11070035f203
SHA1 4662c48107aebe02429f78dc0ab4328f88ea9e8f
SHA512 5ef418e1f48b459f21f15f8462fceebbe5da2e16ff4cd02a614a6a508c1a9e28527c0d0778840600c85ba60d412de91e754b3aa0173ac4db70460367a2abc6e5
MD5 SHA1 SHA512

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 dad565c7dc9490ece5bd2c7d34c825e9959f90af1cab747478379497881f9bad
MD5 1b82ccb01f95342f16cef2dbb441904b
SHA1 a719eaad7d06ce29a5ca58b78e45f6fef36061a8
SHA512 e26b79193369311ccb78dc36c62d3729b47aa076bb9dfca7d4b740487cb635c698c2d8b6b53823e4873bfcf9a677cb68cb2135dd23790cd274c2a50cfcee14b0
SSDEEP 24576:s1QT7EcpfxR+N5AWAz3ooiYtjMqbSMdIuwe3zfIe7xmvH/:xTDxR+N5YzTfjMDMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 2b178ced70d75d5ebebebafc6cb02c37ab6da15931c0d5a2c7eebedc971f3236
MD5 0027e514776ec3773fd17c53094cfe28
SHA1 7eb2acc369c77740d51e30bccb8bf014ad0857b2
SHA512 df379850536360b454a9874b059b229d8bb2e9be601423d5050c01433e29da4ff15b1381e3dcdd5bef37cc7ac4f23b2cea828101c0dc7aefa4cd08d1df5410b2
SSDEEP 24576:TTMdOz0FFS+imSLeMdIuwe3zfIe7xmvH/:R0K+imSLeMdFrIe78vH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 fb15aad99495f04c8c299488f61f178c9960bdb82f09c71459ed6dc670b7bebc
MD5 8f372a61a6b2487661909272afd109fa
SHA1 6a99756fa769fc24890e3d09e0d177a749e1b0f0
SHA512 370ecea70131bedc5bd60121c8913e08f1ef91c0e70f91c01df28d44274c25b84bfbb46e7fc3e476791361375b2927dd1310c8614b528f105f552eb8dcc4603f
SSDEEP 12288:S47u+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:RXMdIuwe3zfIe7xmvH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 751d43eaa202521abb9adc04d64f825b8312df28d411d1f7ffca396560087710
MD5 dfc264fa87c99db0e410d2bfa11f92ba
SHA1 57e281aa5615e36e996bd6bbc3543e467c0a276b
SHA512 4ff68641c89466ceb3459a4b27fa57bae6f0b649eb3269f99a1e7cb0324ed9eadf2566f59366f5dd1ecb24e782c169aebe727826288b486d3a775818f426fa06
SSDEEP 98304:77M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGL/QmvD/cTwY2h3FmTjYvH:vM7pTXexZPGzURnBh6gGLF+W3Yv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/452-448-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/452-822-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/468-20-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/468-17-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/468-11-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/468-94-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/536-262-0x0000000140000000-0x0000000140245000-memory.dmp

Download

memory/536-95-0x0000000140000000-0x0000000140245000-memory.dmp

Download

memory/536-92-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/536-86-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/836-619-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/836-317-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1268-44-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/1268-51-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/1268-172-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/1268-50-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/1828-151-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1828-316-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2380-64-0x0000000000A30000-0x0000000000A90000-memory.dmp

Download

memory/2380-57-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2380-81-0x0000000000A30000-0x0000000000A90000-memory.dmp

Download

memory/2380-58-0x0000000000A30000-0x0000000000A90000-memory.dmp

Download

memory/2380-83-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2920-792-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2920-390-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3456-9-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/3456-25-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/3456-0-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/3456-6-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/3456-21-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/4144-99-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4144-114-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4144-112-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/4144-117-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/4144-105-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4280-130-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4280-292-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4280-129-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4720-38-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4720-128-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4720-41-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/4720-32-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/5196-320-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/5196-157-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/5224-552-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/5224-263-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/5248-776-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5248-341-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5336-173-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5336-339-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5440-274-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5440-585-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5736-364-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/5736-212-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/5776-301-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5776-306-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5836-526-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5836-439-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5836-223-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5956-512-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/5956-231-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/6044-640-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/6044-321-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/6048-531-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/6048-250-0x0000000140000000-0x0000000140169000-memory.dmp

Download