31d67763517952d13c2631f94abe15bb0b0f6b8eb039f860bb9d9f0b3d474617

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 18:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
Size 5.5MB
Sample240603-wvw6faed91
SHA256 31d67763517952d13c2631f94abe15bb0b0f6b8eb039f860bb9d9f0b3d474617
MD5 ba6d2d398e1e0cef33d873b18d9d0685
SHA1 fffc3b012fa7c3c1e0f2e3a2ee053a5a60d6590f
SHA512 70340807ea3f3ea3780662333680133d61ab514018ac94e666dc31d9b7bef1b5e033d15ca2ac2dfdc996ca6fa2a424fd2fb56745343c1ac352f2b05d3214560d
SSDEEP 49152:PEFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1Ln9tJEUxDG0BYYrLA50IHLGfO:rAI5pAdVJn9tbnR1VgBVmgJ3rL
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
3348	alg.exe
4696	DiagnosticsHub.StandardCollector.Service.exe
4124	fxssvc.exe
4368	elevation_service.exe
1768	maintenanceservice.exe
3200	OSE.EXE
5196	chrmstp.exe
5280	chrmstp.exe
5424	chrmstp.exe
5492	chrmstp.exe
5008	elevation_service.exe
5476	msdtc.exe
3236	PerceptionSimulationService.exe
5368	perfhost.exe
1968	locator.exe
5260	SensorDataService.exe
5344	snmptrap.exe
5680	spectrum.exe
5652	ssh-agent.exe
6056	TieringEngineService.exe
4784	AgentService.exe
5380	vds.exe
1712	vssvc.exe
4444	wbengine.exe
5268	WmiApSrv.exe
5544	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\84928ba0c3a5208d.bin	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105437\javaw.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105437\javaws.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006775162de2b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a264e42ce2b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f610332de2b5da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b6cd02de2b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a36782de2b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a4a6c2de2b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133619121188167034"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4572	chrome.exe
4572	chrome.exe
2580	chrome.exe
2580	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
644	Process not Found
644	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3292	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
Token: SeAuditPrivilege	4124	fxssvc.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeDebugPrivilege	3348	alg.exe
Token: SeDebugPrivilege	3348	alg.exe
Token: SeDebugPrivilege	3348	alg.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe
Token: SeCreatePagefilePrivilege	4572	chrome.exe
Token: SeShutdownPrivilege	4572	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4572	chrome.exe
4572	chrome.exe
4572	chrome.exe
5424	chrmstp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3292 wrote to memory of 4672	3292	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe	90
PID 3292 wrote to memory of 4672	3292	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe	90
PID 3292 wrote to memory of 4572	3292	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe	96
PID 3292 wrote to memory of 4572	3292	2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe	96
PID 4572 wrote to memory of 3560	4572	chrome.exe	97
PID 4572 wrote to memory of 3560	4572	chrome.exe	97
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 2608	4572	chrome.exe	100
PID 4572 wrote to memory of 4764	4572	chrome.exe	101
PID 4572 wrote to memory of 4764	4572	chrome.exe	101
PID 4572 wrote to memory of 1096	4572	chrome.exe	102
PID 4572 wrote to memory of 1096	4572	chrome.exe	102
PID 4572 wrote to memory of 1096	4572	chrome.exe	102
PID 4572 wrote to memory of 1096	4572	chrome.exe	102
PID 4572 wrote to memory of 1096	4572	chrome.exe	102
PID 4572 wrote to memory of 1096	4572	chrome.exe	102
PID 4572 wrote to memory of 1096	4572	chrome.exe	102
PID 4572 wrote to memory of 1096	4572	chrome.exe	102
PID 4572 wrote to memory of 1096	4572	chrome.exe	102
PID 4572 wrote to memory of 1096	4572	chrome.exe	102
PID 4572 wrote to memory of 1096	4572	chrome.exe	102
PID 4572 wrote to memory of 1096	4572	chrome.exe	102
PID 4572 wrote to memory of 1096	4572	chrome.exe	102
PID 4572 wrote to memory of 1096	4572	chrome.exe	102
PID 4572 wrote to memory of 1096	4572	chrome.exe	102
PID 4572 wrote to memory of 1096	4572	chrome.exe	102
PID 4572 wrote to memory of 1096	4572	chrome.exe	102
PID 4572 wrote to memory of 1096	4572	chrome.exe	102
PID 4572 wrote to memory of 1096	4572	chrome.exe	102
PID 4572 wrote to memory of 1096	4572	chrome.exe	102
PID 4572 wrote to memory of 1096	4572	chrome.exe	102
PID 4572 wrote to memory of 1096	4572	chrome.exe	102
PID 4572 wrote to memory of 1096	4572	chrome.exe	102
PID 4572 wrote to memory of 1096	4572	chrome.exe	102
PID 4572 wrote to memory of 1096	4572	chrome.exe	102

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Users\Admin\AppData\Local\Temp\2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-06-03_ba6d2d398e1e0cef33d873b18d9d0685_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2c8,0x2cc,0x2d0,0x29c,0x2d4,0x140462458,0x140462468,0x140462478
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe964dab58,0x7ffe964dab68,0x7ffe964dab78
    3⤵
    PID:3560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 --field-trial-handle=1912,i,1854463800595103285,8328655995099912161,131072 /prefetch:2
    3⤵
    PID:2608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1912,i,1854463800595103285,8328655995099912161,131072 /prefetch:8
    3⤵
    PID:4764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2060 --field-trial-handle=1912,i,1854463800595103285,8328655995099912161,131072 /prefetch:8
    3⤵
    PID:1096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1912,i,1854463800595103285,8328655995099912161,131072 /prefetch:1
    3⤵
    PID:4296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=1912,i,1854463800595103285,8328655995099912161,131072 /prefetch:1
    3⤵
    PID:4008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3780 --field-trial-handle=1912,i,1854463800595103285,8328655995099912161,131072 /prefetch:1
    3⤵
    PID:996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4196 --field-trial-handle=1912,i,1854463800595103285,8328655995099912161,131072 /prefetch:8
    3⤵
    PID:4432
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4576 --field-trial-handle=1912,i,1854463800595103285,8328655995099912161,131072 /prefetch:8
    3⤵
    PID:3748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4160 --field-trial-handle=1912,i,1854463800595103285,8328655995099912161,131072 /prefetch:8
    3⤵
    PID:3556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4640 --field-trial-handle=1912,i,1854463800595103285,8328655995099912161,131072 /prefetch:8
    3⤵
    PID:4832
- - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    PID:5196
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x14044ae48,0x14044ae58,0x14044ae68
      4⤵
      Executes dropped EXE
      PID:5280
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:5424
    - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
        5⤵
        Executes dropped EXE
        
        PID:5492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4480 --field-trial-handle=1912,i,1854463800595103285,8328655995099912161,131072 /prefetch:8
    3⤵
    PID:5220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1864 --field-trial-handle=1912,i,1854463800595103285,8328655995099912161,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2580

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3348

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4756

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4124

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4368

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1768

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3888,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:8
1⤵
PID:2360

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5008

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5476

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3236

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5368

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1968

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5260

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5344

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5680

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4532

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:6056

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
PID:4784

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5380

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
PID:1712

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
PID:4444

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5268

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
PID:5544
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2452
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe
Size 2.3MB
SHA256 a7738a745d4590c8135f025293ccd954e03568474f7e0c151d8054e227dbfc0d
MD5 02873ce655dde41568d299abb198b5ab
SHA1 6d309b39733d6f9f96bf71b41b916654c52684eb
SHA512 b99ae8903d47f4a0a5b50535eb09d636104a7a2b82e5508e58eb76d461b0342bbb63c7ded405da9b4aaab52523689ad41b593d302223fe6647da9add2ac84360
SSDEEP 49152:/5Y3YNoN9iWHMokhQ7c49W/Is7YSLTQYWkK2/:hY3goN93CTJ3rL
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 cd8e8181db9fe495920da436f1cde56416d6690579e68a077ca51cb0c043b682
MD5 d8103b9a1bbd12d187ba1dc4e4c07d92
SHA1 ca5d58af070eb3b5c385edfffc1a7c4a5be615af
SHA512 b057ee13506aecbead0d9ac4a2574807f169ccc4b11fb77f4fbc6fdfb0a72c08c8a42f7441da599738924cd2fb176bf6a838eb344afcf2876881bbd05ed0e650
SSDEEP 24576:uidnBsuEtV49pFT0SLTQYWkK2u4dax8C:1Suss7YSLTQYWkK2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 8d8a3ee3db86bd32f8c25e21394f6acc26977ac2a9bf9ea2959ecfd13142bf2e
MD5 e69ea79389dd9f35b870f55c8ed777a1
SHA1 d09c1f9383426f3890c45af7bc4eae1dffe500fc
SHA512 64d2e5a50cc767ecc0b309fa1b1773b832cd6364f47ce0663a0d1ad49fde3166bc11bc6c7b27d9641b0a11f4ddca33a796d41c0f952c2032ae1b3e012972993f
SSDEEP 24576:z+gkEVfh4CoxV49pFT0SLTQYWkK2u4dax8C:KgkExSrs7YSLTQYWkK2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fc4302c4cd08aad9dce10c893f3a402aab126e6820110cbc6a34fe0692611b94
MD5 bac10a2fa003dd82d5c7b91f7451cd06
SHA1 80e28124e2cae499e91a5ff5c27222322ffaff49
SHA512 4f9f3ec702e73e5a0cf98a978711df3335ca9cb43e1299672d3f36b2a6ba67fa421990a89b49e63afe8ce9dba0b9046e9a6cf10213e065a67bcf731e393475ce
SSDEEP 24576:LBpDRmi78gkPXlyo0GxjrWV49pFT0SLTQYWkK2u4dax8C:9NRmi78gkPX4o0GxjSs7YSLTQYWkK2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 49cbaa964fe8d20550f95709c8f2cd37acc40029a7f4dd1fbbdc38e0b61481ff
MD5 a00105dd94be3a01f2d8e4812cca08da
SHA1 6b8ab70e6a2de9c3010faf69c021c3159b863deb
SHA512 3c8bb9945ea8cc349ae5b5932d8b6bcd86e3cf0d7979303d68f6d58f27664bae894eb83aa5386677450291b6e4b5c7eb2ad554a8fcd4da83ebe91265a67f444d
SSDEEP 24576:FLOS2oyPIXVxV49pFT0SLTQYWkK2u4dax8C:v/yas7YSLTQYWkK2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 cbb43d8a0bb60f99ff1867c0a48395831016a950719371a0356ae86dd6cf4188
MD5 04a3e0317dab3f0eb35072ce809bf6c6
SHA1 b4802dea56a130bf45943d1ef9c00930419b8246
SHA512 978f75fc81eeac8aea60f50b5d048497b0635e13e774271fc0f9327ec2526c58c7b3eb55c5133349ddd767518e5c14f407afaada759c31aade49e18951eb68a2
SSDEEP 12288:XfL3F4SOpFjn04R4gq4HSUQH4WT65RShG605414IQanx8/6:XfLV49pFT0SLTQYWkK2u4dax8C
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 16d1a1ad34c8ebe33717e0f22c27ef918774a078e83437d711e17a52d2dabcdf
MD5 05c16c46dd0354ae5dbcf59ddaecbe2a
SHA1 fa49feaddeb91c1e37796f7bf485b346caeda2de
SHA512 21ac83f9e9701a85ea1262a7afb02a03aafc299928b850a1583de3c5a47408f884733a7192d9e8197784f809b4a04f4bc9d0977a0ce283dd26498bfce6224671
SSDEEP 12288:LeBNUbTVO86Uo3F4SOpFjn04R4gq4HSUQH4WT65RShG605414IQanx8/6:LJIUoV49pFT0SLTQYWkK2u4dax8C
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c75a2ac640ab64e008167775fcedd4bc7d8d5fef53392c22f465e67112de62cc
MD5 d805935ad39fec9b902f6d816bfb4519
SHA1 0e19828bb21a8c1743c21f1253f583280a4c35ce
SHA512 f99a919c57b0b68eeb70586a3fc07763998951ab6b9215170d3828422f72012ca836b7a3a4e3373f2dc8aa2f8568cfc71210d4b8fa31dbb446ec2b1d37488244
SSDEEP 49152:FQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THT:FQvGAdlCEL8c/yRNw5CyJ3rL
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 89eb040396d3592e53765573180f2791a8d02dc11ad391582922f90327414c8a
MD5 228ec6383291f64c64df4a38097f0340
SHA1 7bc81888af3a479035a894d780f5e148535ba8b8
SHA512 5e8952322193153efac661adcf9b224a9307cf45cbf01cd057e18b182bff1387d0a2c71e4a0b547f536096ba90cdaa676efdf088565371acfefe1a92a90cff22
SSDEEP 12288:pAwSfxL/2Dc34DLLmt0LDQewsAj+3F4SOpFjn04R4gq4HSUQH4WT65RShG60541F:adewsAj+V49pFT0SLTQYWkK2u4dax8C
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2cde82caa92efb91ac5b484788757ec76440fe1edfcc2e96ad5fe55df2b1a956
MD5 7cd84f6350715b0e60974415c71da687
SHA1 9a1ed35196cfaf143df36e85c63c6605a46b6f88
SHA512 7f1fedcff15b8b01fab24132694bfc35e411064498976b496d1a2788b3344a0cd07ff33647b402f9267e5e6668deee2a6fc9ddeb11e7936981c61a98dfd243a7
SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHZlP:WUEtQevvqc2W1cpV2EI32zP
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 82fa0e1b1c72095376f110c50c30c70b6591b8c45e05f2fb242aa98320cfe047
MD5 3d639f013f34b7ed17dfe4698d118d28
SHA1 913425dd978ef7ebdd3e24d4d499d79ecc39ac0f
SHA512 5975df538f5f0ec10acbd8e8b099f6520a70ae60c524342a735827d5c12ddfa9e62d87b911d7b23c244ac94dfe39a375fc11849c08206c0f868585fa0c8ff09d
SSDEEP 49152:5CbRquA/m2yL5zifFiV+XenmE3/zes7YSLTQYWkK2/:WoqHVjnmmJ3rL
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 520d792817bcb8318de67d249ff8be44dc83565164d6418cd2f4d57c5b1cd2a9
MD5 efa9e0e446de8baf6f199ac28d1aa003
SHA1 a3abf67b45b845d3d1f0dcc1e783bcc0f9569d26
SHA512 7d118d67d44a87f551df3c2f44f4695757a4e4a6f0910e27810abd4f497e0560ec6e1c2506b2f60f75b0fbf3ce82858b10f01a5aa2ef4497c1643fffe85ed16b
SSDEEP 24576:MAhGLJIFoiwtA5l7S53hV49pFT0SLTQYWkK2u4dax8C:MAMyFoiq5Rs7YSLTQYWkK2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 00a96bde01924c5fc745d30e8430183d97ad21d6d86f0c15c2987739aea126f9
MD5 bf12877b7b25d0dd179283da891da911
SHA1 50482289bf3eaf90a9f8e778701f3958221c90f9
SHA512 8f3a2f19f393698e9cfe6d5cc7392a40791f402508f0dd3af77c51e902e702898e42b06162789d899cf44c21d485e91e8057f133cc63d9996072257c96cd1f0b
SSDEEP 12288:Imw5HEjsChNVBFgl0WDm+Cl3F4SOpFjn04R4gq4HSUQH4WT65RShG605414IQanb:lwuoOWaV49pFT0SLTQYWkK2u4dax8C
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 4d529e9b9e27196fce3514ade35cfa9aa1b3f981ac21747921a55691aee50f1d
MD5 794ac1d2ddfb69bd5bfbb0c0f4256131
SHA1 bb478cb0641d069afe8e95b72ea2f649ceea5c0b
SHA512 7863260d5ec492f8bbbba3df6f508bdcc3a92effbc353e6e5a88ad7bbbb43923b73d79b69cd3847249273f8bf4fa4ef596b494f93543d2414d216293e4850a36
SSDEEP 12288:EBZ1IyO3F4SOpFjn04R4gq4HSUQH4WT65RShG605414IQanx8/6:iZu/V49pFT0SLTQYWkK2u4dax8C
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 9133ca4efc1b9b21cf0d89b8a84232229eabb645a31a58b272466b3672c739fb
MD5 102059f89cb067fb451dad578a37a047
SHA1 63b147ff68e87c7ac5c52353aa7a2c8bf834c62d
SHA512 6b1b2de9939de7a90f4558a5d7d74e67873bf6067428394f1eb5ac10575d3856e925541638e31c21da1b59a9ebe1b72fa8d2ac86c19be056586d6900b6b579d8
SSDEEP 49152:20kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLj:gwfhY7g/rLd7yYA3awr341geJ3rL
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 5abd64d5528b00f123b48d08f03492ad6b5ffc142ac3c57e09622869d0654134
MD5 c1fbe4d4748cda197c33c99ed89ad56a
SHA1 7fdf86e9ec39cfeedfcbf2ec6a3d82dbd584f569
SHA512 46a8d07c84fad3b5b763f5cba32899e75f705d99dd6542b3a22b75e9d3db6731456e32f64e9f565895ca5770a379202b005af46219a0810619a2f0ef50200990
SSDEEP 49152:60kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLj:MwfhY7g/rLd7yYA3awr341geJ3rL
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 b1b51e08cfdd46fb6e7f753a8954bdae59d2b6fd17990100b871aaf3262c77aa
MD5 42bf1dc2a6dad076aac2db2e88e06e3c
SHA1 72dcf77d1916d5743cf5a5124adf7b02c0774349
SHA512 74cd50431fa0a7e7068f29ad466b7dc7c984871c3bfb7c37f9088bd6c792c315dfb7b3a6346ca911b82197d25a40682f91581fb659145d11959cf3b26d27688f
SSDEEP 24576:YcTyYv0FteQU+5I2kjgD6iQacAaV49pFT0SLTQYWkK2u4dax8C:YuXv0Ftpn5606zOas7YSLTQYWkK2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 e9024ecdf9d2b05f25aee4b5c366ff68cbfb275241c0d6ec52b7c68d7f10e9e2
MD5 8974a124e4c68537f4afce854e802c64
SHA1 b0cb91cfb2c9ba20a5adcfe929b6769ec7eaf601
SHA512 db27f16c438a64ae9bb1a3d79163c29d899fa30427aef8c926e3254a0ceb1f66499ccc5126e5c0c272cc954ee4f0b8609a699826d03290a8d59fbd22a15d8728
SSDEEP 49152:Wy7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxis7YSLTQYWkK2/:9mYeyxHjWjMTdJ3rL
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 1ca1c498d6df280c98c6e85d567d92b1be8457e05d177be7c5b42bceb23ff54b
MD5 973791b16cbd2e3c9a8b3fbb121d82fa
SHA1 11d33cb7fd32ca1feca66ad0f45bfab7fbcdd4ca
SHA512 e75fe637437495fa2f4eaf023f25fcd3e09f18696f15081ffad1be5722deec41603233e4a0e9a7514f55f4a8624dd7003f3638861da7ab0b3940b96bec700f60
SSDEEP 24576:06drZn1WEci182IEUeNbJeRgUebgW816HV49pFT0SLTQYWkK2u4dax8C:0WnDci18yNNUgbYys7YSLTQYWkK2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 a36ef82028b17ba889b447d7c66a651c2500f1160cd396878140a2fd18998c7e
MD5 e774ab3b1bedf06482ba45b4d1790f1d
SHA1 8eda96d52e5b9b9e1571bd4e5fad620d66b18a0b
SHA512 0fab2067422fa9f7b2a1618fe3e0665ae236cadf287b57a3b11a128bae57a56fbd7c02055bbeed6428fc63db233b62d73a3bfd74b155ee76b6b8207c90991bed
SSDEEP 24576:Qk5lHW5EzMZupO80G2reD+melRgTTv/1nysV49pFT0SLTQYWkK2u4dax8C:mizMZm0GhamSo/s7YSLTQYWkK2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 5e2d2353d00b93ce8cbfd7be9c5a54bde3fc559737c09e2cbb7ad13a314c4c71
MD5 0ab5b220d4f213bebed4e3c8cad4e30f
SHA1 118da66ffd931d392fb35d75f0ef63ff3d8af802
SHA512 844b6948f99614974e9b1ed46efc762785de107b8d211e87d467a873e69a83c2f5ef03db21a941abd5fcab85076c41efdea9d44eb6de7a91b731acda599a5b3d
SSDEEP 12288:RUFmDDLE3F4SOpFjn04R4gq4HSUQH4WT65RShG605414IQanx8/6:1EV49pFT0SLTQYWkK2u4dax8C
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 0cc277125b5bd55a7c42e32f351b5bce3ca6003f28bc0646db5bc6b9b5135c07
MD5 e646991f9b7863013f4543e5deea2d49
SHA1 7d3ab1c249b15c5bc5761baef819fa96b043539a
SHA512 8b7b264f086ee2d1c1ec1199307d6511ce964890e84312a1c12c21a0a1fac24d6bf005a2ded820ecae3b51b58229a8ce724e98e40b03e1f93d3914948025a76f
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 193KB
SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
MD5 ef36a84ad2bc23f79d171c604b56de29
SHA1 38d6569cd30d096140e752db5d98d53cf304a8fc
SHA512 dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be
SSDEEP 3072:HXm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4g2rJBXCy9enoN:HXUMCm4U6q62MEBi99g6JVCvoZhhl+No
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9b7382b92a4a513489cff43ad473ea3f9bf7465b45abad0560f95cfa30d81f36
MD5 18c4abc99532f356a48cbfce6f09f7ea
SHA1 74c1275720661e2e9fed484e09e3c29766fb1fa4
SHA512 d9757c38f5827c642997cd63a45bd6f6311e2f4bdd4596872e5363514b36beb1b4fb426c40bd9371ea675c2bd7b4bc56b26dad1e702b0de06f8a36625e647345
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 b520378a88316d3c8ca918eabdf93f9dc10f570eb0a4ca3b173d5f007e2e890e
MD5 bcb556f3a17ce4acfe846ebec3d2b41e
SHA1 8f16e0f7790efd31498043fc57ce7ea143ce1c53
SHA512 11a861a259e940400873f165ee7429783d01eebadab46af38deea166ddb74871f315b1ee880f2aac57ad6c9a8ec9c333997c44552e9aeab944ac60c34eea6a52
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 f0b5bfeaed2050181eb2ab4d31c6eaebbb3546570e6a053d70c87494aaaf135e
MD5 3d9174e4b6dc81bfdee673413166babe
SHA1 642b93a2e76300ac7f092f64f8f2be711841930c
SHA512 1733495074be05866e403169aa150509402f7998e755ae51ee12c3fa42f2d932f6afcb867cc6f7d2c10a317a885b21e4f3f203ce0185c897285231d71a9a694c
SSDEEP 96:oYggj5QxsXFuxhwUNkJKkp8iZRy7Dx+6MSmueBBO1O3Zk2Dw2MEVMup:ovxxsVyGJB8syh+FRrpiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe580eff.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe580eff.TMP
Size 2KB
SHA256 6568b506f3cb4367abf414e66e1e93a4d4e40339dd3a2a1d5ded1f1907484337
MD5 c4d12c24a85b7e1aaf85cad983fe7610
SHA1 00bcb6e962cbc5a3d88689ec2f8c15feda6ff7fb
SHA512 0d45cd5f36424147b7a67d4f154539d9ddde285cb363a139c5922814e6073cf731d61902a7eb84e9ac6547bcd52e65b023a2f97636072db478ccd04495a59aa6
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 84512e78a7317ae53f6aca73d1409247e1fb2e25c09d67e2b65ea04615003f5f
MD5 18de30b81d7297594d5fe4cdfb0f6e85
SHA1 fcf07e5964ec147e2e4cdffce78d9732df301ea4
SHA512 e2139c5856d35f297805ac9caa1077b4022477769346d0d8431de9f8cedf5877573095976d9cb073cf99332a196cf296f8dc11fca80a875f25944a8c31fd772e
SSDEEP 384:B1adLPLe6cX041kXqKf/pUZNCgVLH2Hf9ZsrUtQHGnXwYvN/D:BkdLPLDO041kXqKf/pUZNCgVLH2Hfnsc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 259KB
SHA256 2dd2de7ba45200273e6b0dca58146e48effa56fc33bee3dfa48408bee650d48b
MD5 6ee7b66cb56e22246ddb3153dbb4a49d
SHA1 15be62b6162c212bf77e69c5a320daf1d0c10fc5
SHA512 621b8298788a232cf31b0ce62ca72e1e069ff475ba04c116356804f7651c960d7d3404c32a9951488e0eec154d820850943f7c52081df35314aa125a398a11a1
SSDEEP 3072:+FSxo70xyNCzdMrXi2rmu8+s5rk7elHalVJtel1QotTyzB+lLrOuxfBSw6jKy7JU:NgtCzMmLrcrI1Qo5yzkpeXjnJFzXsWm
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 7KB
SHA256 b4460233cc682187f6fe1dc69336be29ce151d9d7ad416f0f46f48ecb0994d4f
MD5 242e48d7de8ae21e25a7d3c3341ff7bb
SHA1 fb9c1977789be42b1cc0e6cae76e09dffa7df950
SHA512 1e7abe9a9345c2e31adc708a6c40d85fae1160afb48badf15bcce5aa21a660c31921595265246f34ed0fd9bce8a01b3dc8856fc31aee50ebd484c1a9534ea857
SSDEEP 96:RcNHE7raQT9oTRwK3sK3ZZtAOnjKBKwK26K2dlSmR6NeV:5fToC1UBKNkX6Na
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 8KB
SHA256 2e3f704803a3753bccbf696d432b5f9d8466eaf7bc404072e8c6aace1c4a89fc
MD5 f22055070278570c86876d78e10d856d
SHA1 31be5608866634401649fce0ea00435a030fc324
SHA512 0d6209fb8b3df6aff9a9b1e13ef4a9a1b5233c1df2e5dbb65c6b43b8666e98cfb118271eea2d4c35fa3b3589986d52f218821185309469979d37dbd2d88c6f51
SSDEEP 96:RcNHE7raQT9oTRwK3sK3ZZtAOnjKBKwK26K2dlSmR6NedjoUIzoHwK3IvK3/s:5fToC1UBKNkX6NNUIUQXv/
MD5 SHA1 SHA512 SSDEEP

Submit Download

84928ba0c3a5208d.bin

Path C:\Users\Admin\AppData\Roaming\84928ba0c3a5208d.bin
Size 12KB
SHA256 874947a85fcf5d08b1ccc664bc2af1521b08b32263ecf4ad6eee155b9190c90a
MD5 6e6b3b8d139843a5980080b14b131f2d
SHA1 3dfeee1d917b79183b488e0f5265f38ea394325d
SHA512 d3dc52ff7ece461f11ee0d3f7c97fab4395cf85e9fc06ec03a13fbcf86d52bea63a00f847405f49f10c22ad5773a62893c03b39f5cb80fc840dfdfff3f63ce84
SSDEEP 192:72PC1zbbO9oKELAV3fPiX8plbNVL/8zBw+B38GFqp+pPI9D7XTK+6Uicpz9dkzXe:7RDQVSX+TOVw+tI9D7XmR5cpJdsXsY+
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 55116ac07857c9dc64dd56a94317c24cd745ccaecd0b131a08aa7fcb09c84f3e
MD5 3c163bd6084f495e54a69337b7df1771
SHA1 d513cea5281cae5e871b5d0465a47550a9566bda
SHA512 ce64b00f8b296f7024bda0f28ec191e2b3161c3400e50955f5aacd60b45ab5fa2aed59bdb3f05d1d98494eddc42ba50f98deb72b799bf962baf7d24e1ec627a0
SSDEEP 12288:/i3F4SOpFjn04R4gq4HSUQH4WT65RShG605414IQanx8/6:/iV49pFT0SLTQYWkK2u4dax8C
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 5b1a82c6c70eb883e60add6c4faa6c6217783f4543be1d0bdcc867f55f1f2470
MD5 476734fbc2ba532aa140512ed0c63a4d
SHA1 b2064e724f65c7f307c0dd0a9b90504046e7a537
SHA512 bb328663e15426784de1d980679c6882657dd83cf34d2e00a20d744af21e996c5124116ef7c89024646451c226daec7b32df24d83edde15c6742f50c7e54375c
SSDEEP 49152:Ma0h2GEkuAe73q3pp46zwwQAs7YSLTQYWkK2/:Ma0hNYG4Jw8J3rL
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 9eb14cf7e4c9609d5d31fb5074e66d65b1719f8ed99a51c8e400c544d23c7966
MD5 b301339fa3c4edb9a89a64779b2b0c2d
SHA1 b004a599801ba2f8cb1bf59951ec875d604baf48
SHA512 fd8794e34599d05ae4764a6bb1806866cbf4ba6ae7dd592f0ca221a681b7d1910859bb3838b1c02e75136a542eb1c6a3ef07be55b62892b87ebacc91267bed74
SSDEEP 12288:nhbHjfXO3F4SOpFjn04R4gq4HSUQH4WT65RShG605414IQanx8/6:nhbHjPOV49pFT0SLTQYWkK2u4dax8C
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 166585c9d0d0b03a8a51354d177343f5bbaf63103d2c8d7d000d8b6a7af12459
MD5 39136ad4794627539131c48f91282465
SHA1 34d8fb3c755be2d2bc1bb3923e6a11321b0f8da2
SHA512 0f9b200aa4b6c89179efbd937bf962363974765abee6fa04f52fa41a4b6984f7e35250279fe300c14468364824371a5d57e822879c9b5ecc341f1ab6d7f891a7
SSDEEP 24576:J3YgnJcRTk4yti+R5dpR/WV49pFT0SLTQYWkK2u4dax8C:JIgnaTk46ppR/Ws7YSLTQYWkK2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 145fdded84b4e3f2d41de32a727101b0130fcd891e575e20fa698c6d2a26dc52
MD5 14d6f2cfff19365770884c81c3d8808d
SHA1 06b94dd9c34a7d932dcd8afe2debc000f33cfd4a
SHA512 f82bc8c67316ef6edc6cf81c53b30cc7013e97a75177251e2542544e05a27a73fa72647099576cba1b2761c1155d58ea80feef40880a5de7e23255aed95c7dc3
SSDEEP 12288:4G3F4SOpFjn04R4gq4HSUQH4WT65RShG605414IQanx8/6:4GV49pFT0SLTQYWkK2u4dax8C
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 3e24c04d3e5c34a6f8cb49cd080741490144171fafe9c8d730574879803aea36
MD5 818bf074b2a65c4980869ee6d70a52c7
SHA1 3959e6c6dbd4c5505110e782cf09984a61a10d33
SHA512 d34f484ad46b78da25b2ce4fb890c99005d0f3c18f5ce49a468878b829825558ff9f0c58150a39484062e055e5ba3a381e8d55b481de17afaf9a6d6e7e54218b
SSDEEP 12288:YOb9A4LWOsvAYFTR3F4SOpFjn04R4gq4HSUQH4WT65RShG605414IQanx8/6:1pL3UTRV49pFT0SLTQYWkK2u4dax8C
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 9e9ba20d2655d9eaa85a0def664a6683cd301141a3d58d01d1ac12187ab49b47
MD5 e63489f2410a2080d7d5b5a4f4d89a9d
SHA1 cc651f9a8c78bf08da5811d9e236263da05d2c67
SHA512 374949476d781497aeb7cea066abda57893d3e62e0d765c10991ef8028acf79622ec09197d489824de2f876323b958cd9f965a7b3ec4e55458ff3b79cc1c2410
SSDEEP 12288:FpFtpOl3F4SOpFjn04R4gq4HSUQH4WT65RShG605414IQanx8/6:tOlV49pFT0SLTQYWkK2u4dax8C
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a23a341603e1e935e7b5d0441242362218972a70832ab2af169c895a28c04a8b
MD5 9b472fc1977bec0f871a788e38804625
SHA1 8425f3b062b3ff78af25580a12da0ddf274791e7
SHA512 80c57742dc6f230a367bcd1638fd4f1fbc7c5fa12f92c41cd62ca2d1d8577f7f7b591f7cb3fefb425c1c9db091f88cc3ca9386d6e456a07bd3f3c529f8e7aa8d
SSDEEP 24576:h7NM9YmZqmWMUkPjZM48Mv6bEhsyV49pFT0SLTQYWkK2u4dax8C:h7cBWMpPjN8DbEhrs7YSLTQYWkK2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 1f83be435830d999d992989f708c763067597a11a5471be09de54750649aa436
MD5 3438ecb91d7bf5a7de73bd0dfaf5047e
SHA1 5b42ff9d716561d83b13a83fc2ae77006942790a
SHA512 da82f3ce1c51a0623bc6061bf35e92d4311900c3154b30ea3b578543b7d5df41e583b56c44f3171e072187135462cf4f86cf16714a35fd2274e67e3ad4f0c23a
SSDEEP 49152:5F2YuHNETovcvNYf8kmSs7YSLTQYWkK2/:s6tCf8kiJ3rL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 199d404ae40e0b47e0534c5cf514214988015e362475e14c91b97f33d19038fb
MD5 947766536a692e6b29be9f01646651d6
SHA1 1ca898e650697e665a962c939892b953864f40c7
SHA512 71114831fe20dee7e220168c23b1ffc09e34dd83421c2919ed3f1af36f57f3a0084a84e394cff04beadc44857a4b36223c08028c08bdbe7b2541cb8908ef53fa
SSDEEP 24576:EAFs06+Omlf3NXEbTopV49pFT0SLTQYWkK2u4dax8C:JFs060lVXugs7YSLTQYWkK2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 f830d4626a88019b14a8969895607910213c9ec3e2c05bb05b8ab2f2996e82fe
MD5 f5d5677aedf6db2cb3047db13b089495
SHA1 9565612e430473f81405e39ea80a70f1325188b5
SHA512 2d01df02c30c21f1ed85dd4a0939adf1ff318e19086512d7d52ef534631827c7e395e05d7a8f5b7730bc4a29a145e3ba4b6cc217e47ac1a15f15dce2a6448e7c
SSDEEP 24576:oJnJ5D3WtgV49pFT0SLTQYWkK2u4dax8C:oJnJ5DGtgs7YSLTQYWkK2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 2db010afaf5167aeaf6974b641828bb5ed879897571a7ca5160e30ce30d413ff
MD5 59fb5ec5d6a60e831f1c830a4c8e48ef
SHA1 2152508a57916d4bdde7cac1eab217df01c552c5
SHA512 66c0ae3e5624e96358e4178d4dcc2f3abe746baf1ff79ee8fde728e57c8d5a0b4c06ea1ff7071380abd465518825d94398f25875f85f2360539233052ca2de4e
SSDEEP 49152:Ao06DIKdwc+eQnSt65aV+s7YSLTQYWkK2/:N/J3rL
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 ea90708ffe93cb2a8dadbe9e77ffb26a9e9047b53b9e649f686d403445b7b222
MD5 46f4559f6c2dad6c58594b02e76ec9d3
SHA1 6c7c4927d6c1158bb30d212df9b8ee3fbd2aa0c5
SHA512 cfb415027d516ea2bf7bf2cb6983107641f5386a071ea6221d53803ca2f185d0e4be8d41b8f3ce3c10ca1d841260bb7ce180f4c7edaee184792d415e621f5bd2
SSDEEP 12288:QEP3Rrt3F4SOpFjn04R4gq4HSUQH4WT65RShG605414IQanx8/6:rrtV49pFT0SLTQYWkK2u4dax8C
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 42322f6ce6b0f70754bc0e90df6c7409b855db7d0b7d810f5358962449b3afdc
MD5 a12bacca6223a00079729633de8ed039
SHA1 00d5f64530b8a231250b313d8c67675e92e652f8
SHA512 d66465a0346f5ff20db05becf9567015936cd206db42934e1ff24e421d25717669a7e264ff7f5fc0643e3a2ac3fdbcaa593d8d8dde9ca28a73868e95825ffc7c
SSDEEP 12288:Jjky73F4SOpFjn04R4gq4HSUQH4WT65RShG605414IQanx8/6:JIy7V49pFT0SLTQYWkK2u4dax8C
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 2d8122ebf516fdc3fd03212322ddb84437c58d4ddcdcb2a42dd157faca4eef1f
MD5 d1c6d41144bd1dd2e5b452d178c1e3b1
SHA1 cde96e3a169780b755e81b673efff0c42606c77e
SHA512 da1f899ba5e324146f233546a2186c0060308b3ad535a1fbca8f0a528cdb495230d93cc3d6e767b6adb48d1b781f42023c1051938e36b7f9ceeeee7144c8514c
SSDEEP 12288:tFV3F4SOpFjn04R4gq4HSUQH4WT65RShG605414IQanx8/6:TVV49pFT0SLTQYWkK2u4dax8C
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 7484dbc02af306765829cad87f4dd5db804c9b3a10a437d36321d58b6206af24
MD5 a51b5c2257e65189495199cfacec6aec
SHA1 b56d3a91e0c40a25deff34f4d68ecd68fd896ee8
SHA512 cf3d29911e325525473c7182e44217fbdbe08e0c886bbfb9036285efc48b594321c16772c8874709c0ff748946d9f08cdc59eec8aea634192938c3917f47eb70
SSDEEP 24576:lQ9MxZKdcz97w3KV49pFT0SLTQYWkK2u4dax8C:lVKXKs7YSLTQYWkK2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 6c96d58cfdff9ff6abbac6b5b441b54f8551b08095fddea712928004056aff5b
MD5 21216383b2eecb26f936931ba05ef3cc
SHA1 d3fb1bb7ce66b73ccafaeec2fb22d2c78135ac70
SHA512 10a135963e5523fc902b947ddfee76bd503c454f97efa5fb6d56bff8e7a2b7d3f1d3008ea0d09e55cfbbab4e88926908e7e6543564b7dc8c332271653f35376b
SSDEEP 12288:FyoKo2HRple9pP3F4SOpFjn04R4gq4HSUQH4WT65RShG605414IQanx8/6:FyocxApPV49pFT0SLTQYWkK2u4dax8C
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 699e9cb3de61846f7a64b78e35b1a8cf50458bd4bdb3d5df4e99162189a028a3
MD5 89ae5306b9fe33042a21b527bd6ef5f6
SHA1 391e18ee887e00645581805c5202b953f6499f03
SHA512 d47b6f5467f4de66f9bc12f5904cc24a4600e3ebc1fda0a6ffb5c3f263ce9d9a6c74b3d6f481f1c9ae1d3f7a5647c47d7db979fae5c35271a9e73be2a934c0c2
SSDEEP 49152:nWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKPs7YSLTQYWkK2/:f0zuNIgJ3rL
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Windows\TEMP\Crashpad\settings.dat
Size 40B
SHA256 afd8ccad757251c38eecbb67fc9f41af5aecfec62b521b229c5b17e17ba05eae
MD5 de12892063f81f60b11c0497ec332fa7
SHA1 ccfa0530f55d277c3fe6d75260088ae08d5b7616
SHA512 441e809f431b7d1715efa1a6eeda910ba6945b9529a6330cf964a1d8f7233e97893e6eac6758abbeca4c61d315829371fa2e2fa02a5b838d1fb79e7a43b6d7ca
MD5 SHA1 SHA512

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f7871fb83b8a7e29c7186281b6601a4c0e3d9c876916bfda5c01e4beb096f2ef
MD5 9259551ac48fa452134b48f885ad6dcd
SHA1 a5762298b4b69270b410f2da44d8ef3f15e44533
SHA512 48300eca5931350ce1d132549a8a12a58f30fae798496e1a44a8d3d090f9224ab4e987c83aa05b645251894e1a1f8f29252207500c1c30eedd3f2b6790065596
SSDEEP 24576:f1QT7EcpfxR+N5AWAz3ooiYtjMqbtV49pFT0SLTQYWkK2u4dax8C:iTDxR+N5YzTfjMws7YSLTQYWkK2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1712-586-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1712-806-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1768-79-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1768-73-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1768-100-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1968-609-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1968-490-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3200-101-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3200-84-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3236-469-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3236-585-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3292-0-0x00000000020E0000-0x0000000002140000-memory.dmp

Download

memory/3292-8-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/3292-9-0x00000000020E0000-0x0000000002140000-memory.dmp

Download

memory/3292-94-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/3292-66-0x00000000020E0000-0x0000000002140000-memory.dmp

Download

memory/3348-19-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3348-13-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3348-400-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3348-32-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4124-51-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/4124-111-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4124-45-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/4124-56-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4368-196-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4368-58-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4368-67-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4368-64-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4444-807-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4444-606-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4672-348-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/4672-31-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/4672-27-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4672-21-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4696-54-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4696-35-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4696-41-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4784-571-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4784-559-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5008-547-0x0000000140000000-0x0000000140267000-memory.dmp

Download

memory/5008-453-0x0000000140000000-0x0000000140267000-memory.dmp

Download

memory/5196-322-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5196-378-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5260-622-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5260-509-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5260-802-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5268-808-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/5268-610-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/5280-324-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5280-412-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5344-718-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/5344-513-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/5368-597-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5368-480-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5380-574-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5380-805-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5424-346-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5424-371-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5476-573-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/5476-454-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/5492-349-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5492-413-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5544-809-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5544-623-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5652-803-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/5652-544-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/5680-799-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5680-524-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/6056-804-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/6056-556-0x0000000140000000-0x00000001400E2000-memory.dmp

Download