3a870baedf80644ddb812b253a1136b43dc2dd8f2ea5ee8a1a6d85cb320126cd

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 16:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
Size 5.5MB
Sample240603-vf595aeb67
SHA256 3a870baedf80644ddb812b253a1136b43dc2dd8f2ea5ee8a1a6d85cb320126cd
MD5 62b5be6c481a496da6207ebe90d2f188
SHA1 b624ab4f2b7a9a05bd162b95c4da605bec45274d
SHA512 13dabb4da56ca3520340ce56d127c369403264d30a91195ba244e65e76237115c92209af1482480662c0effa96da960b14072fd721829c66a47f24663da5bd8f
SSDEEP 49152:wEFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1bn9tJEUxDG0BYYrLA50IHLGf6:eAI5pAdV9n9tbnR1VgBVmawCQ+yN4
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
2884	alg.exe
4488	DiagnosticsHub.StandardCollector.Service.exe
4340	fxssvc.exe
2780	elevation_service.exe
4032	elevation_service.exe
4944	maintenanceservice.exe
1572	msdtc.exe
428	OSE.EXE
64	PerceptionSimulationService.exe
4044	perfhost.exe
4112	locator.exe
2044	SensorDataService.exe
2832	snmptrap.exe
2812	spectrum.exe
4316	ssh-agent.exe
4204	TieringEngineService.exe
3080	AgentService.exe
2040	vds.exe
4580	vssvc.exe
2728	wbengine.exe
3536	WmiApSrv.exe
812	SearchIndexer.exe
5296	chrmstp.exe
5488	chrmstp.exe
5588	chrmstp.exe
5660	chrmstp.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\442de4ec8648821.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001ca85e14d7b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000fbb3115d7b5da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000011a47b15d7b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133619074291605575"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003cf62c15d7b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e32cc514d7b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2164	chrome.exe
2164	chrome.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
4816	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
2164	chrome.exe
2164	chrome.exe
4488	DiagnosticsHub.StandardCollector.Service.exe
4488	DiagnosticsHub.StandardCollector.Service.exe
4488	DiagnosticsHub.StandardCollector.Service.exe
4488	DiagnosticsHub.StandardCollector.Service.exe
4488	DiagnosticsHub.StandardCollector.Service.exe
4488	DiagnosticsHub.StandardCollector.Service.exe
4488	DiagnosticsHub.StandardCollector.Service.exe
5836	chrome.exe
5836	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2164	chrome.exe
2164	chrome.exe
2164	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	928	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
Token: SeAuditPrivilege	4340	fxssvc.exe
Token: SeRestorePrivilege	4204	TieringEngineService.exe
Token: SeManageVolumePrivilege	4204	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3080	AgentService.exe
Token: SeBackupPrivilege	4580	vssvc.exe
Token: SeRestorePrivilege	4580	vssvc.exe
Token: SeAuditPrivilege	4580	vssvc.exe
Token: SeBackupPrivilege	2728	wbengine.exe
Token: SeRestorePrivilege	2728	wbengine.exe
Token: SeSecurityPrivilege	2728	wbengine.exe
Token: SeShutdownPrivilege	2164	chrome.exe
Token: SeCreatePagefilePrivilege	2164	chrome.exe
Token: 33	812	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	812	SearchIndexer.exe
Token: SeShutdownPrivilege	2164	chrome.exe
Token: SeCreatePagefilePrivilege	2164	chrome.exe
Token: SeShutdownPrivilege	2164	chrome.exe
Token: SeCreatePagefilePrivilege	2164	chrome.exe
Token: SeShutdownPrivilege	2164	chrome.exe
Token: SeCreatePagefilePrivilege	2164	chrome.exe
Token: SeShutdownPrivilege	2164	chrome.exe
Token: SeCreatePagefilePrivilege	2164	chrome.exe
Token: SeShutdownPrivilege	2164	chrome.exe
Token: SeCreatePagefilePrivilege	2164	chrome.exe
Token: SeShutdownPrivilege	2164	chrome.exe
Token: SeCreatePagefilePrivilege	2164	chrome.exe
Token: SeShutdownPrivilege	2164	chrome.exe
Token: SeCreatePagefilePrivilege	2164	chrome.exe
Token: SeShutdownPrivilege	2164	chrome.exe
Token: SeCreatePagefilePrivilege	2164	chrome.exe
Token: SeShutdownPrivilege	2164	chrome.exe
Token: SeCreatePagefilePrivilege	2164	chrome.exe
Token: SeShutdownPrivilege	2164	chrome.exe
Token: SeCreatePagefilePrivilege	2164	chrome.exe
Token: SeShutdownPrivilege	2164	chrome.exe
Token: SeCreatePagefilePrivilege	2164	chrome.exe
Token: SeShutdownPrivilege	2164	chrome.exe
Token: SeCreatePagefilePrivilege	2164	chrome.exe
Token: SeShutdownPrivilege	2164	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2164	chrome.exe
2164	chrome.exe
2164	chrome.exe
5588	chrmstp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 4816	928	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe	82
PID 928 wrote to memory of 4816	928	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe	82
PID 928 wrote to memory of 2164	928	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe	83
PID 928 wrote to memory of 2164	928	2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe	83
PID 2164 wrote to memory of 4836	2164	chrome.exe	85
PID 2164 wrote to memory of 4836	2164	chrome.exe	85
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 864	2164	chrome.exe	93
PID 2164 wrote to memory of 964	2164	chrome.exe	94
PID 2164 wrote to memory of 964	2164	chrome.exe	94
PID 2164 wrote to memory of 2868	2164	chrome.exe	95
PID 2164 wrote to memory of 2868	2164	chrome.exe	95
PID 2164 wrote to memory of 2868	2164	chrome.exe	95
PID 2164 wrote to memory of 2868	2164	chrome.exe	95
PID 2164 wrote to memory of 2868	2164	chrome.exe	95
PID 2164 wrote to memory of 2868	2164	chrome.exe	95
PID 2164 wrote to memory of 2868	2164	chrome.exe	95
PID 2164 wrote to memory of 2868	2164	chrome.exe	95
PID 2164 wrote to memory of 2868	2164	chrome.exe	95
PID 2164 wrote to memory of 2868	2164	chrome.exe	95
PID 2164 wrote to memory of 2868	2164	chrome.exe	95
PID 2164 wrote to memory of 2868	2164	chrome.exe	95
PID 2164 wrote to memory of 2868	2164	chrome.exe	95
PID 2164 wrote to memory of 2868	2164	chrome.exe	95
PID 2164 wrote to memory of 2868	2164	chrome.exe	95
PID 2164 wrote to memory of 2868	2164	chrome.exe	95
PID 2164 wrote to memory of 2868	2164	chrome.exe	95
PID 2164 wrote to memory of 2868	2164	chrome.exe	95
PID 2164 wrote to memory of 2868	2164	chrome.exe	95
PID 2164 wrote to memory of 2868	2164	chrome.exe	95
PID 2164 wrote to memory of 2868	2164	chrome.exe	95
PID 2164 wrote to memory of 2868	2164	chrome.exe	95
PID 2164 wrote to memory of 2868	2164	chrome.exe	95
PID 2164 wrote to memory of 2868	2164	chrome.exe	95
PID 2164 wrote to memory of 2868	2164	chrome.exe	95

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:928
- C:\Users\Admin\AppData\Local\Temp\2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-06-03_62b5be6c481a496da6207ebe90d2f188_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2dc,0x2e8,0x29c,0x2d8,0x2e4,0x140462458,0x140462468,0x140462478
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff952ab58,0x7ffff952ab68,0x7ffff952ab78
    3⤵
    PID:4836
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1932,i,10942824046154916151,10383418044359745060,131072 /prefetch:2
    3⤵
    PID:864
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1932,i,10942824046154916151,10383418044359745060,131072 /prefetch:8
    3⤵
    PID:964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2140 --field-trial-handle=1932,i,10942824046154916151,10383418044359745060,131072 /prefetch:8
    3⤵
    PID:2868
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1932,i,10942824046154916151,10383418044359745060,131072 /prefetch:1
    3⤵
    PID:4256
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3064 --field-trial-handle=1932,i,10942824046154916151,10383418044359745060,131072 /prefetch:1
    3⤵
    PID:632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4368 --field-trial-handle=1932,i,10942824046154916151,10383418044359745060,131072 /prefetch:1
    3⤵
    PID:4924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4512 --field-trial-handle=1932,i,10942824046154916151,10383418044359745060,131072 /prefetch:8
    3⤵
    PID:3900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4648 --field-trial-handle=1932,i,10942824046154916151,10383418044359745060,131072 /prefetch:8
    3⤵
    PID:3684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4884 --field-trial-handle=1932,i,10942824046154916151,10383418044359745060,131072 /prefetch:8
    3⤵
    PID:5128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 --field-trial-handle=1932,i,10942824046154916151,10383418044359745060,131072 /prefetch:8
    3⤵
    PID:5176
- - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    PID:5296
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
      4⤵
      Executes dropped EXE
      PID:5488
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:5588
    - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
        5⤵
        Executes dropped EXE
        
        PID:5660
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4236 --field-trial-handle=1932,i,10942824046154916151,10383418044359745060,131072 /prefetch:8
    3⤵
    PID:5364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 --field-trial-handle=1932,i,10942824046154916151,10383418044359745060,131072 /prefetch:8
    3⤵
    PID:5980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4236 --field-trial-handle=1932,i,10942824046154916151,10383418044359745060,131072 /prefetch:8
    3⤵
    PID:5092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 --field-trial-handle=1932,i,10942824046154916151,10383418044359745060,131072 /prefetch:8
    3⤵
    PID:5592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1564 --field-trial-handle=1932,i,10942824046154916151,10383418044359745060,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5836

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2884

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4488

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:448

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4340

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2780

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4032

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4944

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1572

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:428

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:64

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4044

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4112

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2044

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2832

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2812

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4316

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3352

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3080

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2040

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4580

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3536

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:812
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5080
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 3a1478d2b3441f6e7ce247507c8bb734433d7a22fb705b2bd95515d0879a1ca4
MD5 2e2e7d6aed46d2b05ed89c5fe554e2b6
SHA1 c592e28da15a5d6356cdfca49a0bf9316a4f0ba0
SHA512 28b4615256ef512915dbfc9d5056d6ec0094d6265cc291e51c33b0543e3a61a5e101f230397c6a1c21da55032e7e2570a89200fa67635afc4eec5a7e1d75aefc
SSDEEP 49152:GuYk3H5koUzfTqkkYLO/W2buywzMbOX+T7z5PDwCmTPc/lZfuN4:G7fTqi90b3wCQ+yN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 84849cc15d49468beb91e23734b7b21a82d4a9323e9776824564112ec44fca50
MD5 a3aad0009c28c56bba6bb6edbb494cd2
SHA1 dcd03addbcbf1facbc940ae9fa245849222a7916
SHA512 1e52bebfc357b8ec7737e3b2277d5a56f1a2723c3921a025778e6892995a2bcae8f5ab2ed27120e9787641c8d00041c0e747222ddbaf8fc41ec7bb3b1cf3985f
SSDEEP 24576:ziPnBsuELjzWDwCmTPPk/z5Zf5hz0dNUX:8SupDwCmTPc/lZfuN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 30e8c87b2cb4c97067eb453c37edd1cc8f7d14990e03f88c0502a85ab7587f28
MD5 c08876b99a8baa86ff80c4525fe32884
SHA1 24c9142da412d290554e4004e995cf65022fe567
SHA512 e0b7388a1d269ff36e24018cc42e8af41cb8d32de15586c5a12def59bbe8c28dcb792a5886b597d827aea4490342b9818a99c916d6a7ff4b40f393fd213ae263
SSDEEP 24576:N+gkEHfh4CoPjzWDwCmTPPk/z5Zf5hz0dNUX:0gkE/S4DwCmTPc/lZfuN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 745a8495129dfa97d11475ebedb332c20ea55f39c82bf9f6862512aef768a649
MD5 561242d206da3fb0b9ce4a9ded406398
SHA1 692fba7254655cddbcc7f604166913af8b0886a5
SHA512 148e7e3544e2cdd48290366d85d75b13fbe2d09ad5c5004b02eff0057f48b38418ec2e8a6a77b019a51e1963a2e0c72c901e422487f5f25bf71b5286e67d3e6d
SSDEEP 24576:XBpDRmi78gkPXlyo0GtjrQjzWDwCmTPPk/z5Zf5hz0dNUX:RNRmi78gkPX4o0GtjvDwCmTPc/lZfuN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5809224df63ba62dd16d272e97d992de464d2d18ce350280feaafa14a15c8a6e
MD5 64255810f4ed1260a5b09dca6e9e871c
SHA1 1cffd3b4c96a8d01ad6d172a3d52002c80bb4e80
SHA512 58aff61e7e1821d858d58d839de01852936311a7538b028f0b504f49c8e4be6d89be3054f668cc95a232387aa580cb47649f80e98e826bdc5d2f6e2fd2b73f80
SSDEEP 24576:hLOS2oTPIXVPjzWDwCmTPPk/z5Zf5hz0dNUX:7/THDwCmTPc/lZfuN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7177b98969f83feaa38ad46154357f37a63fed07451d108ca4b8ced3f363a816
MD5 ead662c1f3e883a8ad42aa7712990927
SHA1 993ebe056a2f6f172bce506d97501011a1f9af2a
SHA512 ab64491d28ebc3f636d446037e6be04a7a08558c69f91069d0dd5db7af500b960353e1b58efdd50c1f58dd877f5b5baadf09666214692d8834b70abb9954ed34
SSDEEP 12288:4tFjf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:4tFjzWDwCmTPPk/z5Zf5hz0dNUX
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 886c50fc337f130fdd598f8cbf0bd75471fd52412f789d7c556fbcf3ac8681b4
MD5 15e1136062dec5e6a39cfcdcc3e9e034
SHA1 f45313ecab8f734f38c46c4e528e1e3666f0caff
SHA512 68b8ca8b7689fad115921b40d5b926a094dce9af0617e844eff00a4f7c6198b0a399d29b7394941e50adc2bf90520cc687addb516a26060ca1fa2a9b9f04c60a
SSDEEP 12288:beBNUbTVO86Umjf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:bJIUmjzWDwCmTPPk/z5Zf5hz0dNUX
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3359b92f13645f22356a17dea2d2cc165106a092df4bb4dd9c7c520ba43d5d3b
MD5 1a9dd8a683472e5d76e67897669e2273
SHA1 66331e065c0b5d37effdb73ecc9b3bfa5358f61b
SHA512 515999ac0be238b3595738d3c1f591cb804355c3bce36c28b8c88fc52d835cddc4185731423ec2dbfdba4edb59d3849e0153cd7f1d025c153ff4859bf5f53a5c
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THv:tQvGAdlCEL8c/DRNw5CEwCQ+yN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 ace074c821ee50c8022bd481c9384dc9185d7af96329b37069e724cc664b49e2
MD5 7e040a19ff16a381fc3d5a8f61a3b871
SHA1 164901ed34d547c26a63eb112ba54011db2e4f53
SHA512 a3b2885bfe24d9875db78005043a33d77fc987beb0c016f2fc257fa9b0a178d2b0808f59e67084070cc65e089b1843c21b995cc8b5edb42741688fab70d99641
SSDEEP 24576:O0ewsAjYjzWDwCmTPPk/z5Zf5hz0dNUX:vljbDwCmTPc/lZfuN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 311beb7238c192b40aa4a78c64f06fd4dec02ec9e34571148886b89e4571a1bd
MD5 f42d63e6d2789483e88ab4322aa89350
SHA1 e96884e4f6cfcb513831c8f496472232fd8a877e
SHA512 b0312cb320bd65f294a8ff0cb9920cac2a38c23f6dbcb1f82c4bd1552368375445045256cfb636e9e3358d43e8a41ccb2380e36d0913ca1eb8270b29be46d9cb
SSDEEP 49152:dCbRquA/m2yL5zLfFiV+XenmE3/z7DwCmTPc/lZfuN4:aoq2VjnmwwCQ+yN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 b7b79c7c85670df7455173f9e90bee1593fd28cdd2403c29bd733433b7eb06c8
MD5 e5bafc8eb5a3de5096adb14c4d107094
SHA1 2a5e46ac40cd5c0feee001c1e490f66714fcc54d
SHA512 04fb2923fa2064b90970745a574921dd8ca320554bc5fde5e205429bff5bb080f2b62f0f921364189979be9c33caa6559ade38666e72d740f90b18748cc8d10c
SSDEEP 12288:Emw5HEjsChNVBFgl0WDm+CDjf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIs:hwu4OWkjzWDwCmTPPk/z5Zf5hz0dNUX
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 0aa23e1d4501424fdbd413da1756bbb9aa5678c9f40b5fc7017bd4d1073214f6
MD5 cbf57e89c301b26d130aa389567ee6d9
SHA1 9783f3794be04c9bbafad3dfc1676f070f84cb8a
SHA512 3dc33a4b28d04f3e4cf0bc02304355396f1330d36fbf390d80d1bfde3708bc326a3b8cf7cb3e0d985dd4874f710f1f865998789ee87963ffcd56385200496826
SSDEEP 49152:R0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjy7yY7BHi3u7L/gBUUWL/:hwfhY7g/rLO7yYA3awr341gYwCQ+yN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 9a182724d2f845fa54f6ac7cfd7152e5be483eaff627d725015d006d8cc3b188
MD5 12e51d16d304d1643cc2be15c1e84c1b
SHA1 3e853bc5e9e98ee4e9ba0221e9db476ec9daf4de
SHA512 6c8d5a5aacdc1ad326e3caffc49b7eba2911a96b5926dab0cf57615d22fe166bf36567bf1d9970ee07e03c0b0096274ff205dc00c888296e420f1f8daf69f03f
SSDEEP 49152:oy7mTd0GxN8jyyncHjXKUyn4GVcbDSKrNTxbDwCmTPc/lZfuN4:XmYeycHjWjMT3wCQ+yN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

20240603165711.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\20240603165711.pma
Size 488B
SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
MD5 6d971ce11af4a6a93a4311841da1a178
SHA1 cbfdbc9b184f340cbad764abc4d8a31b9c250176
SHA512 c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f
MD5 SHA1 SHA512

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 d25922099f95ab50eff91be1cd3c2cf1889aadd22e6e53f705d599476b83df36
MD5 88c0f019bd9d1e8a224e710e4a9ebbec
SHA1 427c75424455693d33f1c9518046e61499f47bb1
SHA512 d33699b4eceac5fbece4de78d3c2ade242964a3c1fbd424d6f7e8798799756a786ea88183abcc875dcec6cee4726b82054c8d0258c9e41453c864d147c656e56
SSDEEP 24576:OcP4mcvIjkGOxhKP2l71nNKbrh/8KBxjzWDwCmTPPk/z5Zf5hz0dNUX:pP4m4IpOO67W8KKDwCmTPc/lZfuN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 f36101d056932eba1217b54d3ee1c54e0c6c4120087bf1e1e0781625d2be6fc9
MD5 89f55681cd116518c116754e0407b2c8
SHA1 f5d4aeb85e94ba181091d6a1ebca93915919c9c6
SHA512 8db0dc249a77703508e63c8314af4bddcf54ac4f887b26409f743b344b94f9afe762d266cbac8b8097ffb28870d40841c7f64ed60acd087dbc1768db15b1c0cf
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 193KB
SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
MD5 ef36a84ad2bc23f79d171c604b56de29
SHA1 38d6569cd30d096140e752db5d98d53cf304a8fc
SHA512 dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be
SSDEEP 3072:HXm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4g2rJBXCy9enoN:HXUMCm4U6q62MEBi99g6JVCvoZhhl+No
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 675eb1c1aacaba753ced46479ac1d332c1aebc882c01676a25474748cac20726
MD5 3a930392ad38d282f6ac00263c24268d
SHA1 4521a03eb0ffa87ff80a4aa28b4d83cd1ed5243c
SHA512 4543b765f91ca5bd371623ed58cdcd19eca7fc71119c13888bbfd17b3b872f6e96f0fd25b5fb5b47f6c813b4eb6655c5a8a2bf2bc82314bf9806ebaac59cc688
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 b132366d35b1944fc2defe6cf04a4624fcb1e396af5355b474dd6bb65b0d2217
MD5 73a4516a9a84c88bcf3895bf4463a5e4
SHA1 8ccdc811c503798cbae8da78304cc8ac2611acd6
SHA512 629fe7eb55f5b2b59bfa65e814070b7b07e4ebf5011e3586165d54ea8dca0165384a6e9870629c7f05d3fefd0547d115205d8a1e0d3184e4decf80f90f7f6a97
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 783e45a3f2e969e84dcf7628c30bec075083232bd5fc9aa68347f4a7e12df995
MD5 db9c08479ae42064926cb2a5b88b4d74
SHA1 3ba2f466014f7fe8d5b6aaefa24c36c5c79c1f26
SHA512 17cddd86bcddfed114845accb9c03966ca3ab2a8c6d28b1b7fbd53a3c59a814b5f0b464f36f806f981992da72b53c5b822de5101b1543ff8b48bbdb6ce5e50bf
SSDEEP 96:t3YYgWOtxsXynIYwkJjo4c8iZRy7Dx+6MSmueyBOdZNG2MEVMup:tIvNxsCIGJjq8syh+FC+0PU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe5776a7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe5776a7.TMP
Size 2KB
SHA256 88575950e262396bd009db3c75b18b3a1cd44b7b869b90f9b2c961ce9b74c1ad
MD5 8e5632bb5baca5f24f88c9e2a8eb2b6d
SHA1 71f7dee86640b602595b40c6a65d7ed4498cf00d
SHA512 def476d83ba944f2fe83839108072677672a230218192751dd5e37305d42816e2db59b6f368fe8d3ca8848542ac3e3732dea3a58187c1e14f372ff2f721dffcc
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 6d85c060ce87db2302167bc82a41f94eff0070a3bdeac3f3e153432e168b432e
MD5 80e0f1267a08efef7eb4cf866c1c6739
SHA1 2b5d132b9fecf531022e94c37b9aaa8e60290b53
SHA512 b3c2987dda93c0d9e6c7e06b40422de6c3bb38d5735b50675a81916f10cc652d4ceaf67c2091e7f30776431ed3d2b58f194f835c7350264fd180d3fea8883384
SSDEEP 384:Vx1FLPLeCAXlj1kXqKf/pUZNCgVLH2Hf94hrU8QHG8gjH8:VrFLPLXqlj1kXqKf/pUZNCgVLH2HfGh2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 281KB
SHA256 a6033fc5b8786556aacdc2a745f21c5f80b06d01c75d7c2f753d850c1aa38c89
MD5 7ce2726dcf872f7944545423a8e24f7a
SHA1 9b512ecc44718fc68692168fbc3b5a6756369950
SHA512 0f448bbcc8635e4f8c9f8d35756289abb12b4c284a91d0eb86ec3f8a22c23e59f4e80c522465b702f46804db7bbaf1755cd6e10e0aa2764892c8a38baa5b7fbe
SSDEEP 6144:I5ARoOu0WkF4qSLj1Bkvc46OUr2rI1Qo5yzkpeXjnJFzXsWW:0UoHb/qwhBOJEjCkpeXtFby
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 257KB
SHA256 3e148f6d54b061e6559b1b86c7e8967bd8e38293f6045966291dede93055ff8f
MD5 2539c897848b5924a8e903326246f0d4
SHA1 d81072f987117c1fc8bddf7ac77075757537b2ca
SHA512 e59ad41fa249397db1f230d8ae2174b5dc6fa0671fed50bcede87841efc329d10f2c49c6d24b6125894b8a8a5ef33f5248a09b1e08d8e54ea61e82a1f5e88e31
SSDEEP 6144:uJrI1Qo5yzkpeXjnJFzXsWtQYRPILxZnhLMJjX0EeGzY2rLL:EEjCkpeXtFbZQ5fnReEFsLLL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 8ed6cb2d0433a6a6a1a814af2d6c0f949e4786b0181667605011856874a2b48a
MD5 214c0db823ec569c96d3a63b3239c29c
SHA1 0e0f8d862fe0bdbf749bc92243a5bd522d99057c
SHA512 2de097c20a120f35d7324ad552f920e2567f39cbd5251732f13fef0050617e4f32cb91ace362117bf90064031f7e32bde8caeb819e01975c87e151f72a77f782
SSDEEP 6144:II0WkF4qSLj1Bkvc46OUr2rI1Qo5yzkpeXjnJFzXsWW:hb/qwhBOJEjCkpeXtFby
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 caa507dc864ec896a42f829328a3c37dc08b2e586bdfb97578131a60c782fd92
MD5 060369757da4c718807086bf3c205d8b
SHA1 f128ac06f6b143b53ef2e2fc7864b2c7fb1e5849
SHA512 5d4c9a452c588234ee14df75abaf793f5a90af81dd25d6e56bd156f1079590c2b51161057bd790a468ce0f49f5560e0709cd653bbfd13f798454cb640147ca8f
SSDEEP 6144:IZ00WkF4qSLj1Bkvc46OUr2rI1Qo5yzkpeXjnJFzXsWW:/b/qwhBOJEjCkpeXtFby
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 91KB
SHA256 ed5854b9caf1b934ab5841a7c2fe7ecea694a8ee96094bc5ade91e818f4ffb23
MD5 d74a02a78c92b1b0d21e634c948ff7b5
SHA1 30ba830183d5736ffc70886a79b83f7dfb93fec6
SHA512 a18fee613451026fc92bd1c9b05fa2a2293ede731c33c78966d7180924b7fdee072e8cc4bff2c2c29d342b4afc5e517d7ff9db18dc8817ccfd4d58505cd51dcf
SSDEEP 384:qOZWxEQrC8a8CJXPJHYHIGppuSj1+EcI4N0TUoiAVnzbriE2d9L24cyz3/XQuKMH:uiQXjGB7K9EnT+52Kd+dt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe57e9d3.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57e9d3.TMP
Size 88KB
SHA256 eadf6e40b5c5a09adcada3e81b8cbe539bdd8cee43e1a9bb8b185093ac817a82
MD5 0dffed8ea84c125d37be35eb1636d4d5
SHA1 528bf758d06dfd97d49e45301a023381b470eeba
SHA512 3f7442853e0125b8fe33000cf65992d3fb47bb70d1a7603da3afd1229eb25695f4085ba394279b3d85aec3bbf1b72e59134437a884b892594c41836823a70134
SSDEEP 384:kOZWxEQrC8a8CJXPJHYHIGppuSj1+EcxN0TUoiAVnzbriE2dZ24cyz3/XQuKMcsC:oiQXjG77K9EnT+52Kd+dE
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 7KB
SHA256 c80c82971d0250dc6c719468b7ba71ebf993609637feeabede70beb0bd939562
MD5 620b78a08ad0e1b54bfaee833e59ddd1
SHA1 ffff3c306c0b4a45332bab93d8c726dadec0a5cc
SHA512 921607fd6d8350338dc74d28bf25a53f4cf70f0d278cf8d0d2bb355ee75d9b228eee6553059b3ffdc95984d7c2320d6b8195bf031e75a7f87d792498ca25abd8
SSDEEP 96:vHUbPM3kIHS/0dwK3jK33m7P2cvmT45wK2pKK2D9fH/4z2AOB7RZRNMM:93q/ni3zUTvOvRZRNB
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 8KB
SHA256 6c21e70a74d4f23f135ed12348dd36e9dc22f4ff448450b5847f7cfac90c95e0
MD5 d2a3ea94ad14570e7a4f965d33b6b15f
SHA1 925f6c081713d47dab0f6990366df0e07fb7237d
SHA512 f0ed7407f0fc4b3410eb5095913ab6024767208dc2e9b6920dae5a7cfd375d41dc219c3d01fe2af707f7e6c70f89bdb94e066210cc4fe473dfdf2ccfcdbfd1b8
SSDEEP 96:vHUbPM3kIHS/0dwK3jK33m7P2cvmT45wK2pKK2D9fH/4z2AOB7RZRNM3Po7fUowu:93q/ni3zUTvOvRZRN57f5RXua6lXU
MD5 SHA1 SHA512 SSDEEP

Submit Download

442de4ec8648821.bin

Path C:\Users\Admin\AppData\Roaming\442de4ec8648821.bin
Size 12KB
SHA256 2740df4f3f9dabd1122313af887a95e1915c79be663cc165d95715378c8a53b8
MD5 581b1c40265ddc237c01a75bf88119d3
SHA1 5c1efe15cfeb1c2a4e2075fd7059959275192f12
SHA512 7b78b242800027607a895091df9792366a323e1be28d83c4c654153f1d7e6732f93948822b6ee1d74bef2f0268ec8ffb4b0c1239c0ebfc31bba3d55779dcf167
SSDEEP 384:fTYncgiqT+2mVArvMcKmByNdheE9VVP69inNdA:Ycgis+ijMdZLwiA
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 2754e142da001d8fc8b1d52b631c4706635d41029f1d2c78e66911778b56cc22
MD5 c7a324657669c6acd07bc3e2385c7ca3
SHA1 3fe1576eeb322d3270f39328765f3e398a024724
SHA512 cf225a40b260418022e933fc4b2479031315593695c1cf2e28b5a2d3f957fd8e8de9765edeaa43a08c9d6684b08c5b98f2ba925b31181fc1b8b66ded0e25bf33
SSDEEP 12288:35jf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:35jzWDwCmTPPk/z5Zf5hz0dNUX
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ab21f87d68556d1e6492f080444f438bd3c96186c597d765b68a9076ad5822cd
MD5 503ec4ef750be0c8a4f331d2f0e449b0
SHA1 f965f05c883ba06536a6ce65a09d49926c9b72f6
SHA512 81e642a24ac7e3b5a17bdd236426d8fd36fdcbd7ad24f60620a19c18b70f8c2516bc0205806414feb15aeef44d24f863f79b5f288c8cc61a8e85f479e90773df
SSDEEP 49152:ta0h2GEkuAe73q3pp46zwwQuDwCmTPc/lZfuN4:ta0hNYG4JwvwCQ+yN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 4d0f181cd1bc3c3510e6ec543d9a39011605f27fd0e20b35f9446823fe60f781
MD5 f20f3c5410aad0fc75418eafb907df1e
SHA1 7d47f9f67bcb6ec8527574a9e13f504d6dad603e
SHA512 72b0652526ca7e078f979f503f65efc921d605b6016978674c4a950ef13709454164e39ec65ea6d972d71b93012f1b2570b4be5901d897d696c8f46636058c7e
SSDEEP 12288:JhbHjfXcjf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:JhbHjPcjzWDwCmTPPk/z5Zf5hz0dNUX
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 6cd23e07d2b9704f0c0b97b794c78c15e408da97d1a6b7b22be91358cd326fec
MD5 a80074d4009e864c1f102fb40af0270c
SHA1 da6fb139cddf84a90236fffce228cd1c25e16c73
SHA512 e43607a9b51d3b74cdeca8d75aa91299b4da7606abd343fcee25459080239404eedcc567d37139f003e1fff4b2930e55d92e1fbc8974cc4078c24940ee8cd200
SSDEEP 24576:P3YgnJcRTk4yti+R5dBR/kjzWDwCmTPPk/z5Zf5hz0dNUX:PIgnaTk46pBR/HDwCmTPc/lZfuN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 3fdb8daf6f130623ef93e17caa5f164f47ac2efb859e66d121e6e8feece4e376
MD5 ea5a3f7afa370fb9e4bf7f9f79d7b1bc
SHA1 92c66a31f27eb59adcc9dc4057ca8978e07a625b
SHA512 f8b99f99c090b4f6a0c268fff4d6a4836d72972aac70138fd668c33fe8e203e6763acdedc3ebc06a8da56cfb104b40a3fd6cb88880a501c1e1cec015ce6b1fd2
SSDEEP 12288:Dljf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:DljzWDwCmTPPk/z5Zf5hz0dNUX
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 e5976429691a31361ed1d82a27488f32960d1baf260389cd4db5d43ee59930d7
MD5 64243e4cec97dd7971e4b32e08921d10
SHA1 2173763270eb9d00a5594b25b580e6d9231f0caa
SHA512 23881181a0c2387227f6703c1bc8beca37771bf927d96f577302cfd6e926207b94d85e1205f261bcfa2c08b0cac3db1b3c38568b548c48752301dad7ce361553
SSDEEP 12288:NObfA4LWOsvAYFT6jf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:qbL3UT6jzWDwCmTPPk/z5Zf5hz0dNUX
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 7ea0157e55773fe67a192ad76e7196027f049c99897ed69be816ad7d0e069aaf
MD5 e955d8d36aa016d9b206c8ea66973de8
SHA1 8cc7445592aa78301e65fd04aa7d8eb6b569762a
SHA512 73309d9f65a4092e4d71d8fb093b6fc9194f817e997dc5c9462d70e2a9c8226f3c1689aee0802dcc2bdf44bdfdc0caa935143e19856b44a5d91be97630fab0b9
SSDEEP 12288:ZpFtIOGjf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:YOGjzWDwCmTPPk/z5Zf5hz0dNUX
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 44ece0b34bd7a7748c3cc900a58c57ad8f17d6b1325ac4f6433b3b80b789014c
MD5 2b4507e6e4401930558e5541682bbbdc
SHA1 04f9a24a75134e9ac86b783646a1f347cc8a703b
SHA512 0b92528a9cbdc8fb26a1d5922488b803c645608e7be7992669f53c67d6d23908f69b16abe1fb74874984fd2cf8b554b07120559195c19544a13b62b72b91f65b
SSDEEP 24576:t7NM9YqZqmWMUkPjZM48Mv6bEhsJjzWDwCmTPPk/z5Zf5hz0dNUX:t7cBWMpPjN8DbEhvDwCmTPc/lZfuN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 6c953de28d560518db839489d6676edb5ca0ae9fd122e41a5795d4c156f3ebf0
MD5 7716633ad60c8a7855a0d255b7215327
SHA1 0fd2a5b5beeee1f8b68bc90c0e12657f04794940
SHA512 a391208ef7e05d45503c21d5a3f7c04e222f51b28f669a848c76ee64f6a1e58659115ef25e802d6feb3afb01cce7d3e69ea3c2536a92156e6fe322be73e11020
SSDEEP 49152:cF2YuHNETovAvNYf8kmMDwCmTPc/lZfuN4:56BCf8k9wCQ+yN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 538d2745dacbdac6a8613b099e6a23ff330ba07e58f0dc930ec0333a489df7ce
MD5 db28b8b678d3ac422c301e2092ac7ba0
SHA1 6fc9e81b6b839d32572e1bf2daa6b3117d4588c0
SHA512 7988e416ce02842a406ba174a464abd6a1f583949d1b18bf057a8fe1c37b51a0107537cc3c85172e3b5ae10baf1f418d1951f1a4915859c33ba1329296813485
SSDEEP 24576:CAFs06+OmlfkNXEbToSjzWDwCmTPPk/z5Zf5hz0dNUX:7Fs060lwXuODwCmTPc/lZfuN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 e104d3daafac4fce2eb8428032b97c32778c01f7a19fed0461d687e17155b68d
MD5 9e305bcd0dba6d3ef31f2f5914eb5750
SHA1 e83be0ccff302680e592930d5008709b5b36deac
SHA512 45ab2333d9aac7309a7a6e257b482e96e67d1e10151207c94cb3a4c98cb745a955c2e6787cb50e26375fa557565c7f8e8f5d4d8cbd568901f62cd78e2c927975
SSDEEP 24576:GJnJ5D3WXHjzWDwCmTPPk/z5Zf5hz0dNUX:GJnJ5DGXODwCmTPc/lZfuN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 11a6be592ea0df165d2a9f86165e9e6a345655a87a6d96973d19d880c08b8022
MD5 af0b1bf012a8984ed0803af26c5acb84
SHA1 8dcca580bddc998e48033639177404689779edf3
SHA512 4e141dd89bbe987f52866db971c067a12b423fa5ba2042ba38bc3808647fb82875ebef39583c6855dcc628ee6251c6f211171dd18add4bd1ea220495559b06b4
SSDEEP 49152:Lg06DIKdwc+eQnSt65aVgDwCmTPc/lZfuN4:EswCQ+yN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 8327603b1bccde6641a27397a6233d50a3bee3a175f6cfd8b616790ad1cbc666
MD5 49f754fec3f5d9ff096dda3bd640aea5
SHA1 5235c655cdcad105ef1ea4a7737a1bdb6140fdfc
SHA512 867e9c36afc1c1b522aee395402f27e1944c9fad637c00f78990a36d8db06c80703d7bda76ffcaa9c423bdf13f3208b282e1230a37cb1071fb00c5ea2f97c5e8
SSDEEP 12288:7EP3RnIjf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:AnIjzWDwCmTPPk/z5Zf5hz0dNUX
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 2b42b52153cf5320c2a1fb8a0c14edcbf577e81943046a07ff4a075ead255a99
MD5 9d6a795d0e012d02feaa61460601ad81
SHA1 028fa7c84d04954e92b21393b7bcfdbd0830ad4c
SHA512 6310a8d1e18e8ec4cfff4f0c49901573f2a52a194e35e1f0fda54facf65e13749ab504089dd05ed4ef9bc0ad855fae8229d74b1f06204e074d59af7165bf1cc0
SSDEEP 12288:TjkyMjf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:TIyMjzWDwCmTPPk/z5Zf5hz0dNUX
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 fa1ca5ce7cc452f2f92e14e400611d1cd0887d40ccca67c0da66a61fe50058b9
MD5 21b3f7ec2e8f25ddf2b103291a7eb607
SHA1 a2c5b64251037238656a911f6d6e7a425c2f2443
SHA512 a7da9a2e26ea8802292abc9ecce4882a765d9c593e38df57839669b877784d4ca3310721279e5bc86f845ea4808ac7d120619281928301243723eae17e438323
SSDEEP 12288:vy2jf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:62jzWDwCmTPPk/z5Zf5hz0dNUX
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 eacfe9587038325524a497acd0fca281496794dea0d67c62e0006a52ea7fde7b
MD5 c61c09dfdbfc9ef1f1a1ed42b6566214
SHA1 627bf60581b6c02718e9bab535bc05477c346aea
SHA512 b54743105774aa99d64bb5108ad228e2bc4cbbe99b9553500da5a401802ebe5133fb29d521855a278ba82c167b8cf8ccf62e12609cc9b28b4b24aca77fef54c0
SSDEEP 24576:xQ9MxZKdcz9dw3BjzWDwCmTPPk/z5Zf5hz0dNUX:xVKZUDwCmTPc/lZfuN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 6ef4fee33bd205f805d9665152329d9c9b84246df57b82655832eac8b35acd6d
MD5 ee1eae2f41d37e73aa746abe9840935e
SHA1 f4d653939c588b72b7f504f444338f81cb07c634
SHA512 45cd0e21effdf1d37df2fc4d035c0b4cc8d0c42fe2601f5792a58af0ea90bde7bee45a5361d62a617db63587a9ef69c02c11be84a1b4e44aedbc402add409957
SSDEEP 24576:byocDApYjzWDwCmTPPk/z5Zf5hz0dNUX:OocDApbDwCmTPc/lZfuN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 909bf4c256cdff484bea32347a6d6973593d704ff3738e8d15eab30fdeb69894
MD5 8ef78fb4b5a5423a1e878eb5dd44a5fc
SHA1 ff41edf29f4e8e890ceb9e62cf47324a7142715d
SHA512 bb0101b43a2f44d7cbc00646098dd3064f9a487dea1514549a339c0f8408780b8b2b22f0865ff2ec0373a350b8f31c35c008b4bda55a69c927c0efbcd0b42fd9
SSDEEP 49152:IWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKbDwCmTPc/lZfuN4:q0zuNIRwCQ+yN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Windows\TEMP\Crashpad\settings.dat
Size 40B
SHA256 5928caa89b1d2b710b06e2032deeeb129c5844abc95bb506a96a2181663fdb20
MD5 63c24fafa38c1b0109d7b33c1be0d22e
SHA1 9b3ae6d17378fa094069f9aef62df034089e3083
SHA512 1387ef7a3e1e729ec2d22463f44463c5645c772a8336127bbbc7532923abb04b62bbfadf10c12c2f6b50d1ffb567ae4059efe192f3fc0ffdd90ff0cafaacb6b0
MD5 SHA1 SHA512

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 eb04493c5e76e222d77ac01862be1c430485a90fa566f7ce8fa9a6043a661b72
MD5 13790e4d522177a22866a0630dfc4d7b
SHA1 1f311dfddb0b1480083d5c07c1ddf6c70f2df17f
SHA512 8f12ee7958e1d53dfeb4ac4c4b387ad2f0f0c7fc43767f7c2634e7f8d4ab318afb90fbae07208c8b386439a49023ffb130cb1f50c50f36114b935a731a08b31b
SSDEEP 24576:r1QT7EcpfxR+N5AWAz3ooiYujMqbDjzWDwCmTPPk/z5Zf5hz0dNUX:WTDxR+N5YzT4jMFDwCmTPc/lZfuN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 411a6b7cd15899ca1c47e81663b59112c1dcf7a5736010c0401ddcf529907b3e
MD5 b62f69cfe1fc382e02981327cd30dc9e
SHA1 a5722a8d42c929094a8f435e7639db441200c030
SHA512 0180d5826a974fa88ad45d773b0deabcf91ff51d966eda78a5480fdeedee1a73ac8d391b327e6a7fc4c0db950929ccef82561b53a9993a571c074869dd039e21
SSDEEP 24576:NTMdOz0FFS+bmSL/jzWDwCmTPPk/z5Zf5hz0dNUX:30K+bmSLWDwCmTPc/lZfuN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 5c66dcc076d17d33b9e23d56bd64e4e1e7f61247f70dd47bcc14c301454e446c
MD5 792211ecbc7ed9489c8e2d4bdbf03bf7
SHA1 aa05ed56b8b9eb32b6a2ae9df280520c74158bb3
SHA512 160e90933302c6b0e29f106ec652581f75bacdb7f8e6e4937d4cb7728e0935f04a24efe48f3297f9b5bc13347432356c4a06884a701d7182f45eca9d1ffc596f
SSDEEP 12288:r4K6jf7kHQWNThwCmTLTPCvXPz5Zf5hz0LAtmCBc8dwIxPAW+:36jzWDwCmTPPk/z5Zf5hz0dNUX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/64-138-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/64-124-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/428-618-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/428-109-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/428-103-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/428-112-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/812-624-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/812-297-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/928-29-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/928-22-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/928-16-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/928-0-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/928-6-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1572-100-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/2040-293-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2044-287-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2044-510-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2728-295-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2780-60-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/2780-50-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2780-56-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2780-328-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/2812-290-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2832-288-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/2884-444-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2884-26-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3080-180-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3536-296-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/4032-62-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4032-99-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4032-557-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4032-68-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4044-621-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4044-139-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4112-286-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/4204-292-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/4316-291-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/4340-73-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4340-58-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4488-43-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4488-44-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4488-35-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4580-294-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4816-19-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/4816-10-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4816-421-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/4816-20-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4944-80-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4944-72-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4944-74-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4944-86-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4944-84-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5296-443-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5296-522-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5488-451-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5488-645-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5588-457-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5588-515-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5660-505-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5660-648-0x0000000140000000-0x000000014057B000-memory.dmp

Download