89277452b8c618906e8de27261b835de821573f41434079816ccdd2ce02c1764

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
Size

4.6MB
MD5

85a4f55c9a7b631e7534483af8177852
SHA1

b55023624ef4901264e95ffcaf113478ca4da683
SHA256

89277452b8c618906e8de27261b835de821573f41434079816ccdd2ce02c1764
SHA512

3eff68284b5470a5f460166d5748860e139d720c7596a43448f4ec4fa4f4c7c1af9a83ab5515ff1136a71486332e797240946d4c81ad9e859f4710091f354773
SSDEEP

49152:TndPjazwYcCOlBWD9rqGZi0iIGTHI6DOnIIeNxu6xl1aZt6m5xbzDI6bpsRJrAG6:r2D8siFIIm3Gob5iEOUtq

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
4060	alg.exe
3572	DiagnosticsHub.StandardCollector.Service.exe
2756	fxssvc.exe
1816	elevation_service.exe
5080	elevation_service.exe
4584	maintenanceservice.exe
4572	msdtc.exe
1756	OSE.EXE
4644	PerceptionSimulationService.exe
4480	perfhost.exe
3144	locator.exe
4692	SensorDataService.exe
636	snmptrap.exe
3832	spectrum.exe
4944	ssh-agent.exe
3988	TieringEngineService.exe
1284	AgentService.exe
2768	vds.exe
4016	vssvc.exe
1328	wbengine.exe
3304	WmiApSrv.exe
5264	SearchIndexer.exe
5696	chrmstp.exe
5804	chrmstp.exe
5924	chrmstp.exe
6016	chrmstp.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\cb5d0d2e1ed82f9f.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{38ACDD0D-FF02-4A34-B36C-7A103582B8C1}\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a55f467f47b7da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000432e188047b7da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d2d63c7f47b7da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad21897f47b7da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d24d337f47b7da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000710577f47b7da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002a48907f47b7da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
3764	chrome.exe
3764	chrome.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
4496	chrome.exe
4496	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1980	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
Token: SeTakeOwnershipPrivilege	2448	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
Token: SeAuditPrivilege	2756	fxssvc.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeRestorePrivilege	3988	TieringEngineService.exe
Token: SeManageVolumePrivilege	3988	TieringEngineService.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeAssignPrimaryTokenPrivilege	1284	AgentService.exe
Token: SeBackupPrivilege	4016	vssvc.exe
Token: SeRestorePrivilege	4016	vssvc.exe
Token: SeAuditPrivilege	4016	vssvc.exe
Token: SeBackupPrivilege	1328	wbengine.exe
Token: SeRestorePrivilege	1328	wbengine.exe
Token: SeSecurityPrivilege	1328	wbengine.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: 33	5264	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5264	SearchIndexer.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
5924	chrmstp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 2448	1980	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe	83
PID 1980 wrote to memory of 2448	1980	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe	83
PID 1980 wrote to memory of 3764	1980	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe	85
PID 1980 wrote to memory of 3764	1980	2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe	85
PID 3764 wrote to memory of 1408	3764	chrome.exe	86
PID 3764 wrote to memory of 1408	3764	chrome.exe	86
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 4192	3764	chrome.exe	100
PID 3764 wrote to memory of 1280	3764	chrome.exe	101
PID 3764 wrote to memory of 1280	3764	chrome.exe	101
PID 3764 wrote to memory of 3320	3764	chrome.exe	102
PID 3764 wrote to memory of 3320	3764	chrome.exe	102
PID 3764 wrote to memory of 3320	3764	chrome.exe	102
PID 3764 wrote to memory of 3320	3764	chrome.exe	102
PID 3764 wrote to memory of 3320	3764	chrome.exe	102
PID 3764 wrote to memory of 3320	3764	chrome.exe	102
PID 3764 wrote to memory of 3320	3764	chrome.exe	102
PID 3764 wrote to memory of 3320	3764	chrome.exe	102
PID 3764 wrote to memory of 3320	3764	chrome.exe	102
PID 3764 wrote to memory of 3320	3764	chrome.exe	102
PID 3764 wrote to memory of 3320	3764	chrome.exe	102
PID 3764 wrote to memory of 3320	3764	chrome.exe	102
PID 3764 wrote to memory of 3320	3764	chrome.exe	102
PID 3764 wrote to memory of 3320	3764	chrome.exe	102
PID 3764 wrote to memory of 3320	3764	chrome.exe	102
PID 3764 wrote to memory of 3320	3764	chrome.exe	102
PID 3764 wrote to memory of 3320	3764	chrome.exe	102
PID 3764 wrote to memory of 3320	3764	chrome.exe	102
PID 3764 wrote to memory of 3320	3764	chrome.exe	102
PID 3764 wrote to memory of 3320	3764	chrome.exe	102
PID 3764 wrote to memory of 3320	3764	chrome.exe	102
PID 3764 wrote to memory of 3320	3764	chrome.exe	102
PID 3764 wrote to memory of 3320	3764	chrome.exe	102
PID 3764 wrote to memory of 3320	3764	chrome.exe	102
PID 3764 wrote to memory of 3320	3764	chrome.exe	102

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Users\Admin\AppData\Local\Temp\2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-06-05_85a4f55c9a7b631e7534483af8177852_ryuk.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=124.0.6367.202 --initial-client-data=0x2c0,0x2c4,0x2c8,0x294,0x2cc,0x1403796b8,0x1403796c4,0x1403796d0
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8be90ab58,0x7ff8be90ab68,0x7ff8be90ab78
    3⤵
    PID:1408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1924,i,10051224660240429367,10345311588423772183,131072 /prefetch:2
    3⤵
    PID:4192
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1924,i,10051224660240429367,10345311588423772183,131072 /prefetch:8
    3⤵
    PID:1280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2188 --field-trial-handle=1924,i,10051224660240429367,10345311588423772183,131072 /prefetch:8
    3⤵
    PID:3320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3060 --field-trial-handle=1924,i,10051224660240429367,10345311588423772183,131072 /prefetch:1
    3⤵
    PID:224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3092 --field-trial-handle=1924,i,10051224660240429367,10345311588423772183,131072 /prefetch:1
    3⤵
    PID:4852
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4288 --field-trial-handle=1924,i,10051224660240429367,10345311588423772183,131072 /prefetch:1
    3⤵
    PID:3436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4432 --field-trial-handle=1924,i,10051224660240429367,10345311588423772183,131072 /prefetch:8
    3⤵
    PID:3244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4256 --field-trial-handle=1924,i,10051224660240429367,10345311588423772183,131072 /prefetch:8
    3⤵
    PID:4544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4632 --field-trial-handle=1924,i,10051224660240429367,10345311588423772183,131072 /prefetch:8
    3⤵
    PID:5632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4568 --field-trial-handle=1924,i,10051224660240429367,10345311588423772183,131072 /prefetch:8
    3⤵
    PID:5372
- - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    PID:5696
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
      4⤵
      Executes dropped EXE
      PID:5804
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:5924
    - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
        5⤵
        Executes dropped EXE
        
        PID:6016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 --field-trial-handle=1924,i,10051224660240429367,10345311588423772183,131072 /prefetch:8
    3⤵
    PID:5844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=1924,i,10051224660240429367,10345311588423772183,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4496

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4972

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3572

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2756

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1816

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5080

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4584

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4572

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1756

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4644

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4480

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3144

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4692

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:636

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3832

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4704

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3988

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1284

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2768

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4016

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1328

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3304

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5264
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5144
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
2.1MB

MD5
04800bd60198e049994dda9e4465b0af

SHA1
c604fe410abaa65d4473eea9ab193cd3c61e6655

SHA256
c039072ddb1d2e7818fc3d257881f801eaa9230a6c923ec6ac38cac22119afa7

SHA512
95cd2d1cd74621734ee007a03488ba8899d947badbdb0bfdd859dcc2575349e87eef2b8f3b5cda1d99897a69d77fd7c55b3ddbe409727d4c9566a4f5cfc1278e

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
797KB

MD5
1877b44e5f100f0bb706c59f154de5c3

SHA1
f25d4a44457b2ea9a268d71a4e4e8e424438f546

SHA256
e41bc2a6754ea24e580fb9a10c72f91089a7608729882eed0ca9dd6db799d99e

SHA512
2486752a0f4e7870c34252e753a3f2ce7981de8144132ec80a009f547b1439d8f42d218439418ad1ba3b530e4e4c3d15e461a4f2a9a02382345b234915c8f7dc

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.1MB

MD5
3637e257c5ddb129d7ca08cd1a7ac3a1

SHA1
dc01fa90fb3ccf66311a0d7a3442238ad74bf4fd

SHA256
fe932d37367ab2434005463d1158ccb3265b7beec4a485884f2e9f5193c56282

SHA512
5aa01add667014a6f319021418ef711bf3ff84391b742c8a27c6e0c710133f9655999fb63e4073c018c9623b2d7b9bf730c87eaabaa4cec9443a1e12b7cc21f5

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.5MB

MD5
783e0fd3202ae4d57a7ead694e85f709

SHA1
425897d41eb05f5adc421d1bbfe7fd02f99ff74e

SHA256
698a926ce1d1d7b6e519fe52626d33e00d48ec7f62a7b4bc1922bfeb443862e1

SHA512
95356463a9fcc130844498d2ee0b4b9417606e90185b020ea4296c9dc028c7a8ff2bf1102074d857cead10266f79a96be6ffab1d81e51dd8453291e5641c6058

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.2MB

MD5
249e673cd118fea562c90724a4c0cd84

SHA1
b6707412ea4dcb53d070022d844836861329de87

SHA256
ee3cba95cc64b4cf22eef7258027fdfc12c4aca1559c6efd02701d7ce77467dd

SHA512
7d84fe29ae66241837871ee45da2e000bf2c5c122a31db0c4807c91e04b9c224998990e5244792e073d4226a32da8f973379e2263de56b2222eeb6c67ba2c31c

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
582KB

MD5
95ec79c5d754793f2f8afcec5791cab1

SHA1
e98a202bff1829cc0e064a7d628608ca6a006a28

SHA256
30a2c20abf1aa0280bb99e0c3924e84b3fd78ccd88c46e5e4df79b0fb0fea393

SHA512
7f4c94016f2c15121391afde2a4b31ac02eb63af5ebb3b9331d99747a74ad546efa0cc82f1db1f7c119eafc7b8b8f4e4c6e8f893e8a88a9af476eec83ce11aa9

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
840KB

MD5
6333e44c864783112cc10989905c74d0

SHA1
1530cd1fa62e9dda27ebe6ec9e1e8b01728ffce6

SHA256
03cf2b94b927e1915625c900029ac7e8340c15714130b5c19cb0ca47fd22ed8c

SHA512
3437dc099801050cc013c5fbeabcfdc37b37d1d284a3c66b10bbd434a8b96326bcda80ed7c903e1d8f39589bdd382c86b7f15d39f03d376bc8a962a807e8572a

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.6MB

MD5
152fbad6de47f53364eae4e435a94017

SHA1
16e69dba2399579c66d2ac4c4908a9b60fb120af

SHA256
5bd6ab8b3c0513109a58711b49ba2feab2c758d97b204f31a50db54785adb701

SHA512
c4883c089056175098238c42fc5e57552f15eb9d9c9510de461f2b42153a6b1938dd7d80bd301dec706b79aa755a7af7005050a3c283b5381dc750d3f6cd488a

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
910KB

MD5
a17d41e86a7330ac4c4fcf99411090d7

SHA1
5119cb9be6b986226f3d9658309a2b3a4d72058e

SHA256
2404df1201e9b9ce90eba01b86aec4a4dc0ddef292f0005dc66cc67a4a965372

SHA512
ea0dc849dcdeaa1737270064b1ef8d14cf4fb0def4449efe275e7adc79540d6010883a17224f3468769fd032cb448751e97f25b44fff4414fac7faf4a4fb53f1

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
24.0MB

MD5
d7b34eebb58f75afc9dddc29a0c7524d

SHA1
33e84d97dd73e1505f2a95b981583e2b13e65e5e

SHA256
b81b7edc934d3b839b9f02f1a08a26729d953bc8ece6de5d97a4a13c3c161f4b

SHA512
ba7f9ce8170f7bee5c3dc11c931355b01092bafec978aa81b0f7246766123a578c34d3e1c7208f8d5a65f058fdeff4a8c7b6d98191b4233e6005d1d05f18fedd

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.7MB

MD5
1d467c191461259154aa4498aa2755e4

SHA1
847293116c5f270d477b0a4434ccf38251d7cfcc

SHA256
cb3bd6e39e209f4f3949c39523bdffc53c3e3e50f7e513ec331455f4fb9b0f40

SHA512
32d28be0e78ec9661f65d2a69a51577a1fdba895a921c7d7ced70f01de9343e89ce62b19987a3b66dddedf457a70600e68f02c617ef66cb58ffabadecdce821d

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Filesize
1.1MB

MD5
af4847eb62f9312f0ee178ccf57eaa31

SHA1
780401b79c5567afe94ea64e568fbca10befe2c8

SHA256
63478552f1a53b818e88e31716caa6708d3c64751de0d068ffb8ad5774ae4f65

SHA512
fa47f423dee10e1ed1d1303d0c0d82db8482c058586672a521d7f89e02b1e2b64a84b9e8fbc2c3616aa30ead346b7b9db96e4ef973ba257a36063a3443bb5ec8

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
805KB

MD5
8b4746380661d9b29f8e90d14d56219d

SHA1
e0d0c791190bdc8237839ea96713bc09b4e30f9e

SHA256
b92af6de70278d4957813bd6a0c528c58e24c5c779821df92688b4a2a35dd5b7

SHA512
4de1525f797244ed676aa164a275943b974f9fad2bd18d23210cf901cb4842798daa647846b8374b50b1800279b57e35c2e9cf2d2afa36c103a13813a1a89d95

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

Filesize
656KB

MD5
750a9b2f650232b5190ef266a8bcc4fc

SHA1
1efa5c71fc034a66eb35f52f2d483dd805b98c52

SHA256
bd6f8723f0e87aa3f439d4a7b589e3ff53b728a036ee589a1bde7239ec996729

SHA512
84165494f138447b38bbe5d16a0e0d0a4bf23285591a675df8d372a7b4e1a144f49adee195134e0b794533f942bb1ae2bf46ec8ce42c90aad214ed16ed7245b7

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

Filesize
5.4MB

MD5
b3d6b6db475c78bfcd7567cb9b69eec3

SHA1
4ac2daa54fc30b9fe24549616a9b2aa8f2d136fa

SHA256
031e273b755ff5fecb858e29797b3457b06da64fbcbaaa76e8ffc9043dd13093

SHA512
07be67701aafd18aeb563d423064bc8cfcabde78597f90a6a7128fec2d83cbdee4f8b5666500f04643dcf097f73efd19fa4e077d5808ce09d1bfe5d8063704bb

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

Filesize
2.0MB

MD5
66565c4fbbc97e5909e3bf71f963b45d

SHA1
59b1e2584afd775a3e7a944ec0dc25f2bca42108

SHA256
4612140d13d1cbf420a886da738a73921a79f3bf38d7f689705743b61cfdcdaf

SHA512
d9f9e34954607cacdaed3201a4923da2ecc5627b35d61ebc40678871f484cc62591f5801b8929a1ab6e868ffc70f01414b6fb199140b602256418594183d16a5

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

Filesize
2.2MB

MD5
c794d673d8bf5d6654a711ded800a9ac

SHA1
e62eee6e1432f51ae726c5a5c34f68d4bbbf8317

SHA256
3e6ddec0528f5cc025c95b4039435820f55c11266797b30ff174eba602f2bf70

SHA512
29c83afebc402c87b1ba0468246ff76e1d5bd0c3990d23f06a551af5a1fc790759a3a50e4e9603ed3299a00d4e00f3dbacf91bc2f93c6ffbac6c1dcc1b5f4ab8

Download Submit
C:\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
1.5MB

MD5
2c28657ecd965f1d99b69ff05ba0b65b

SHA1
fa0441169bb6ea7a0e3a9790026c14472a54bbfe

SHA256
f8eb6e34cd3a95fa0956e578fc64090ccd76a8425ae89ebeea543c3d5bd108aa

SHA512
a6e3886fef212fd23628abc913dddfea2e88e03f7d02ef3bd4e76b8aeb9964149c85a567eae72232683d8390bf98c0cdd2eecbdadbd0e938fb4c9ee175111237

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
701KB

MD5
88ffe9f8a6540ef518914b40c353c9de

SHA1
295e17b8679cbb0565b9d22dcfc09bb37a99c4d8

SHA256
793a6cd775e3b440706bf7f5693c7b0b39dbdb65541a83f909881b5b105b730e

SHA512
61403604f39f1a73f855f6fcf1c09de4806e9f73a2699cbc481d31b8244c78b55ef4f673ab9f705908419c44877576a85295a4a69a55ebf93cdf42cc4f4f83af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
0cd429098412849541cb95afaf497de7

SHA1
34fcdc8c1708981ab8e69a9ccc50ab898d7f7df3

SHA256
d987cb1f82d1cfa20deebd5947b3ce1b9ae9ca25cb7df736727c507a3a17700a

SHA512
955809ff9150048d9b739222dfe4c1cc7b4f330cab2858b74ba1b8af8514f1d97268812c0ef81a3d926c9928fab845515a0fbd834a8dd1d0db39359001ce5f03

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

Filesize
193KB

MD5
ef36a84ad2bc23f79d171c604b56de29

SHA1
38d6569cd30d096140e752db5d98d53cf304a8fc

SHA256
e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831

SHA512
dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
d654f30de65f87b5e4f09c84a4a034ca

SHA1
c06c45e1d99eec0649b2dc2ded34cbdc1fb13165

SHA256
5949930455f00500eb72ea46871cfd0f436f331f5c62741853e293f92b2c6e4d

SHA512
f073670547fbea722fa9209273568193fea2daa13117c2c3eb2741a80631f0954f216dada3839cdf80a326f0038454722267fcd2125576b4da82f8fc03b0f520

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
5f11d4c11994b4e87cf010632215578e

SHA1
65471611ee79f05d39d07680348bca8f5d10a339

SHA256
8b3411c7622012dde3730e353935126eb742d7e5b59da1785136ad93b40d880f

SHA512
4b389a19a89c660e9d30ce1f81248ddf9f5cb493492b75e77e19241a5adfa495d5291a10ed137acc475600c08cc184ce4da5e5a0d226c76f280daf505ec5a849

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
8eb7d2ee1e4a3b78d15289985e888210

SHA1
334460ee68179cd96d18a653d54e169d88bd9e10

SHA256
9eff53f10e7786b63a8fb303fc438b2fb883bf706ad72bb99e9f32c22f96fda5

SHA512
7105aee8c8e0e95ad96fd45dd4955987d41b38d0c049e2318cae8810ad053f946033e9eeaf5c9a7aaa1f67f2847bca08588337b97968b966b04be89303cc51f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe57826e.TMP

Filesize
2KB

MD5
411ac782e18a3f8947b5bbdc13773829

SHA1
d9a709bb6b79ade9df4024e8fb6e36190070bc21

SHA256
0217b1195d87db614149675e331d00b581206641c58f6c7cd8cadb92e718f8cb

SHA512
03cff6f4f72f375b34a35df614de1c0837ec423b3b232e5b863a2d85ccb2f2bc025d1954ae0ba9d117930a84e7fd1b44bc82b488e5acd58370c36e9c24717d5d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
e15a0741560b40b4b70641906559aa59

SHA1
b4bba168c78cf60d77baafdd48e9d2974895c7c6

SHA256
3faa788333640262616b968b1f0a2140e0d903644f4f46128042f57bab097c41

SHA512
48987f3d11455898d78c1966e91a3b71956ffe0fda46f7825094b87d2356e9cabd1bfdb4bda0e8f5a4c78247a00597f881cc2c3401f004a6f24677ec9ac57cba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
261KB

MD5
55a1e9d66c64db959a56f1365c759809

SHA1
ae5ce58a1d56726212882eea49b575047eaf399a

SHA256
5234c16df2b240ad7625a46600858021454cd1e9b896ed001f885e7b7f16f66e

SHA512
ab922e822660c174d0cce2ea6099d736d2dbeaa42ab89c19bb8fe1ad49d4ada25375e0dcbba7285d9f1ec9a26fe1e403ce182eb83647fbd67865f014257b7aca

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

Filesize
7KB

MD5
c6a2d3e7e863802dcbc0d763e89dfda2

SHA1
950c6874648a70a62ec3ef2f897382ee09903b7b

SHA256
04f73660644dedb7a19491b9a98a4230c9e2a7a41a2961f45781218eb7dbc9a8

SHA512
0e97279c09349c00b9d6f8ba1af7e0571c6f10077a171b889fa7c0bd5e826a17265ed502eb9b8a29dc24142fc1e36a092498d384f4c2c631fb7032425c80423f

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

Filesize
8KB

MD5
f7502d6cf904f6d3a5a636cf60324164

SHA1
e8b5ccdb99d5639615056430a83e582f79af8e15

SHA256
d78c7f436e1fd5190709d3870257c31f7ddcb36d1d20acb4fa535a1b95fa6213

SHA512
99dbe90abb4124331144417a122420a45efbbfa5e94a11e876a0989d666b46d210cd95c7efb31053aeaca379f2e9f10896466a21398bfdf021b73dc3ebe78dfd

Download Submit
C:\Users\Admin\AppData\Roaming\cb5d0d2e1ed82f9f.bin

Filesize
12KB

MD5
71fde3dacd6040ee4e039351c3e1261b

SHA1
e902817200ca576bd9bdc27d491de8feeb853f00

SHA256
a13bee54b034acc3ec156e9362c536b87a6a0b31a8b21c4d3845aae808872974

SHA512
6f59585d70b1203cacb3c351a88a5c55367f0d27265c28694a65c4f9972b45100333ca6eecf110b12fc23c5012dabba24a990660389ae791d10e191e958ff89a

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
588KB

MD5
9877a51fc63eec5c21af0de984fa0dbb

SHA1
f104470e8dbaf7ec9f7c6d86e00a090b8d752e96

SHA256
b295a944403fc31ba16e7382d4594527b261d57ea34a53c2e5e2b3ed8d4e9413

SHA512
a6d130b5f2850e1c1efd234136a9d1c874db1dbc3ac6c4886a0f238da6119291a5158feee942f30d68004b26e0f3f64f31fcb931808467991af445af4ce01ad7

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.7MB

MD5
bda646da2d034a7e71f89bb7a50ddefe

SHA1
f43b2bab4433e7c422ead35e11926bc61e848906

SHA256
81015b3a78a845d04e356fc0c764b96ff212938d31719843a1abdcc5dead2707

SHA512
6f81e2b537f366d369d933a7061bab9da7d0116e4c7da7bbd2813e2d809c8460db58fa0f8bb47230704c7b1f385d25bf66da1a3993bdade7c0a2693ef4d4a3af

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
659KB

MD5
4f6d7bf09431298fc659397b7ca84c71

SHA1
6b42c4de2642e32b64bba84a4f0126b8f91421d8

SHA256
0c3542d07294bead171e9ae9ca94098bd461ffb304bb3405e4ac0c259dad7808

SHA512
1153a3fa8912e601a7f793d472875c13ead14172aa9fe58a7ffceff70ebb5cf6eb978293e9c3d515b453201121d88ea2e6a376840392e879d4a00d0b1adcfa33

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
8247260394ae2205872ad6d52764113c

SHA1
abd8ed7b7fb9cb30489699f9a187e51e5d85786d

SHA256
f405f337ae441585512b59e581206dea59109a04d73baabc3d8f8d9e343d5d99

SHA512
6737173638e8df2bea1a1547a1b696cfe78b51b1c391162ce7677a34a655e9619d53326a7f4a83cac77a368e6254c6e5fba3c99bc83e8b1faf86aeecaf1d9a30

Download Submit
C:\Windows\System32\Locator.exe

Filesize
578KB

MD5
eac316dad9875222ae731de1fe2d4179

SHA1
c689f1b6a4f1a482aeca789dbd879011b9556bff

SHA256
b1cbe075d9bb72efbe62785104adf2390ec3ae80bbc8254cc096ca4229bdc306

SHA512
e5b334cd605990b23e5d5464ea17a529402bdcd7be4471e56dfa49fbed8ff64c55b2dfdfa6f943359c41e21f306767d03d622a5e827ef5f289b030bf6b87f779

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
940KB

MD5
b75b93da7cd741665bdd89561662203e

SHA1
e6591e709a99219f6a4a3510bed1ae0d00edce49

SHA256
feea11a365994328cef77fed3e65585665a346b37ac2d006d7cc50bd81731953

SHA512
52ad26a09476881e0153e0e7903696a5698d15008f85c7c757b4256eede4f494e9a2a3c9a9ffcece78165d5fd5e76d0558abd3e4cd9d726163538a42c71bca70

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Filesize
671KB

MD5
5e8b866bc21d9d6105671ef25a272ee0

SHA1
24366ec08977c9612f55c5b62ac06b42c1a85d73

SHA256
85d77a4b635ab2ba2e50b83ab4fde4a4a59c87146e91df44b685cd97e906c840

SHA512
4e6612b7a0ec7728670cc926fbbbca3ee5454bc097843bba0acb252d3819210e7510e585698510591c9b6d39b6854efb9115548bf5924499a5f72ed44fe04da7

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.4MB

MD5
1ded24d76831793975d9f4730a1e7b01

SHA1
6a953f45a70b365f0db488f6ad158cb0b6d78102

SHA256
172d420018e1a8b2484b24c6370710463fa3270319112798219c41610a85fcea

SHA512
e5635d7754bea071f641838f635688354ed1545ff8867ae33b8acf69370725354b3d8db947beb9c3058fd1833ef84f8c682bb2e1dc6b892290d68cd969fa68a0

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
b358a552532aa44a148913eb6eca5434

SHA1
341c59bce40cbc05946e0bcf6ad46946ab5cb62d

SHA256
7136cca8dc6868dd6aa2dfd0d8e3599aebad0c190417d87f73c5d4d368bf5ae0

SHA512
4251e26fafd3903a22cb35fefef5ed8e55773b5d4b26fe63cb518e6f536473d963f2dcd0e1e79916f99d47701c86d61091f86e910b0a877a2a2d2b65d05a50fa

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
1.4MB

MD5
ee792e031110d50fd1344394fd04d6d7

SHA1
6e7967cd44796042700339a83c8803c63932b6e1

SHA256
0741134e5c89ebeb0caa981b2be57e4914775e1f170edb0fedcb3920608114a6

SHA512
85fc1e44ae4a2d5b160f37ebe64588fefdb73edf9fc4d89fba17c868e669bcb8beb5e779045e2f3628be574adb0aaaa26a03f60036f0b4f54eedb24cf33dab76

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
885KB

MD5
867a080c13b8c46c97b0b856c9eaf58c

SHA1
002281adfa54bb403be1c2ae742d8696cea11574

SHA256
fa8ca4b501befd0fd7e7e0cfb045858909b0949de2dd4668f0d82599ae81ae41

SHA512
6ab81986df1b757f88cf406efb8fe01aaff19fe8b635d07b5661b5a686308fb33be5958d093dea902ee283e254c37edd2a0973219d615fe301c32b097004a9bc

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.0MB

MD5
1d3cf99b4d5c388e3579b3df5a00f779

SHA1
944df95efc268a04a701e16739521ef4ccd0e929

SHA256
e798ad19b774ca4ad87dbea0387ed9f37adbbc6c2a76545992752a4e21cff045

SHA512
6bdf80887602b28ee825432a8b2b909080eb5057870b9a9f610df0bbd16f0c2904839e2ad9a6e799a7a1d5cfbc82d56fc7ad44ec6f820d7e0b760d1df333d67f

Download Submit
C:\Windows\System32\alg.exe

Filesize
661KB

MD5
753b97fc8e1f4127bb2f188cc845be9a

SHA1
377fc2616edb5c84c60333246d2eb25f59015cfc

SHA256
44d6bb4737a62de450355421722303c0fa6d05c4b05f058c0fe7c5ba57e80ac8

SHA512
bc8cfbbe51ae8c82d019e4da432702665aa8316294e2632efe4f00d494b01e49cd35daf7f73347809f8778f29bb5a1ee6e8dd8054f60c2fe82017f876969ebbf

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
712KB

MD5
92906e6098db6cfa3fa63ade9f240ccb

SHA1
857fd58cfe2f977af81d8beebcd1fe12c5e303f8

SHA256
3ea977eb60a100ed1efde21be650626be2ae7a139366f2096c26d1e7cf21a7ec

SHA512
965e1e679e9de2e562349966bd8755e81bcce5fc4febe33e909ba8464a37ceb0747cbb89a76eeaaec4e75cde44a6341120b23cc78453f9f544ff9d0c40ca95da

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
584KB

MD5
3b6ce18998b5b6fd15ea6904f96bf4ac

SHA1
ef2f0dd392e0622d909e336f6be8023f6805d314

SHA256
2c7e4a3851f5adeafa6547f46b60ef664cff6c30243e2afaba93a3d42cf2c7c8

SHA512
5c2a015acdb98cc80ace13c47d37ecea097317d41fb25862246c8e3ec9da076ede0897a70390aee8bd2b8b49da0e06694a3fe8cb2e12d0a51d10e2c3d9b95277

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.3MB

MD5
dfafeba501d2a85cd459246e74ff08d9

SHA1
2e5baff1ff6bba8a94ee28baa503b9f65413be9b

SHA256
d1407741dd1037d43109270ed3628a299ffffd056fc85d6c978dcd879e8b999b

SHA512
b5008ca8acf54792694bd97fba9acb6166171a6893edb72da5b3c581b485c6490e38997723187c3579d611678c5bee4e8111df5c5258bc5cc70bf3f7cf447c32

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
772KB

MD5
903f7ef5086ff8c4f5ae60baef9915a1

SHA1
2aaf7ec5e2e6c52cffd59ad0c7f2131c5b46a8da

SHA256
6881720d99836c715e77367d9012f234e1758eba5a21b0320b879aec3ab2b31c

SHA512
71fadf0f798fa8f1d8c637d283f4109825ab18a466e1d5bf2a29e70d5b2db5886b57b9b23c75381cc1a5040f2ef5f7f1ec9250dd8ac41f6f5f302da92ad28967

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.1MB

MD5
8a926a255e4de8c6e8aed8ba89425601

SHA1
30d5f98065aac63cded762bf414eb43833fa38d1

SHA256
d41825773fab5d315a994b3a82b4eabb3465f84baee68fd0c2aabc0f89c9e5af

SHA512
1e51371952ebef4848e95ab591b5cd49687dd5677cc3c633d08b8dad03370ba0e298d7b48f3556acea4641e342f7bcc8f2ea7e59480beefc42edf5ef3bf12cae

Download Submit
C:\Windows\TEMP\Crashpad\settings.dat

Filesize
40B

MD5
4d858969f9b63ec4e90b337affb40980

SHA1
c5f517b47ddc66cf8fe32495fe14e425f905c252

SHA256
d228412aca7296096c2db6c01dfe1e83ca0db6a7fc2512468473c94bbc3e50f9

SHA512
df058b39862395921f86ab56ac87eec0ed1adb201b988f3bae0fb037e14a1c33d842b7fac2354f0daabe15cf41c5b6757ed9971dc8237e7a5e9377314c6b972f

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.3MB

MD5
323a0a1f7664cae731814a458cc1c9eb

SHA1
93b47cb28132707688e3978f35ad069a906c71b3

SHA256
3795f4eada195dede6e5c640571beacbe120050460049ffa094466e4d69c4ff0

SHA512
022084401f6f54cb5380d6e881eae208847f6f6e77c17c519a754eedb0b5a69b4116f02f274f94c54fb146449cb252bf2a12f56b287a64707d92bcd0161d00eb

Download Submit
C:\Windows\system32\SgrmBroker.exe

Filesize
877KB

MD5
f5421ef12a84592a9ae6aec6395139bf

SHA1
444793c6f853ed386419d60f5c2898b61156590f

SHA256
324a19035aba0a276385b86d2b91995d97237dd135a09a243e845cdf9dab8330

SHA512
32a81ddf6a8100bc3a976e5ba039ffbdb4fa8c2f4d557e3ddea61442070b34d75ce63b174e1fa6a9f10cdab64c95582c802c998673149abd5fb9bc1f3e6ad71a

Download Submit
C:\Windows\system32\msiexec.exe

Filesize
635KB

MD5
7a95355bfa09ffd139777741d96c958d

SHA1
0e473f1bcd074860ce97b513da652dafdca28992

SHA256
20a3e49de8323f65e79427641ca5da161d497b2c0d7d3d5c0b7727db1f1e20a5

SHA512
6daf24250d3292d5e8e801ab571e124d5ee25f8af67a277f9cd6e6cd960376a027aded69f6808bd8c0ac7ab721820e2c271c4f4773946434a7a70bb0d7743996

Download Submit
memory/636-530-0x0000000140000000-0x0000000140096000-memory.dmp

Filesize
600KB

Download
memory/636-180-0x0000000140000000-0x0000000140096000-memory.dmp

Filesize
600KB

Download
memory/1284-250-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/1284-266-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/1328-731-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/1328-313-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/1756-126-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/1756-277-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/1816-76-0x0000000000510000-0x0000000000570000-memory.dmp

Filesize
384KB

Download
memory/1816-218-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/1816-78-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/1980-0-0x0000000000510000-0x0000000000570000-memory.dmp

Filesize
384KB

Download
memory/1980-8-0x0000000140000000-0x00000001404A3000-memory.dmp

Filesize
4.6MB

Download
memory/1980-152-0x0000000140000000-0x00000001404A3000-memory.dmp

Filesize
4.6MB

Download
memory/1980-9-0x0000000000510000-0x0000000000570000-memory.dmp

Filesize
384KB

Download
memory/2448-179-0x0000000140000000-0x00000001404A3000-memory.dmp

Filesize
4.6MB

Download
memory/2448-20-0x0000000140000000-0x00000001404A3000-memory.dmp

Filesize
4.6MB

Download
memory/2448-11-0x0000000001FD0000-0x0000000002030000-memory.dmp

Filesize
384KB

Download
memory/2448-21-0x0000000001FD0000-0x0000000002030000-memory.dmp

Filesize
384KB

Download
memory/2756-56-0x0000000000840000-0x00000000008A0000-memory.dmp

Filesize
384KB

Download
memory/2756-62-0x0000000000840000-0x00000000008A0000-memory.dmp

Filesize
384KB

Download
memory/2756-64-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/2756-67-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/2756-65-0x0000000000840000-0x00000000008A0000-memory.dmp

Filesize
384KB

Download
memory/2768-278-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/2768-725-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/3144-326-0x0000000140000000-0x0000000140095000-memory.dmp

Filesize
596KB

Download
memory/3144-164-0x0000000140000000-0x0000000140095000-memory.dmp

Filesize
596KB

Download
memory/3304-314-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/3304-732-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/3572-44-0x00000000006B0000-0x0000000000710000-memory.dmp

Filesize
384KB

Download
memory/3572-50-0x00000000006B0000-0x0000000000710000-memory.dmp

Filesize
384KB

Download
memory/3572-52-0x0000000140000000-0x00000001400A9000-memory.dmp

Filesize
676KB

Download
memory/3832-214-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/3832-543-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/3988-631-0x0000000140000000-0x00000001400E2000-memory.dmp

Filesize
904KB

Download
memory/3988-243-0x0000000140000000-0x00000001400E2000-memory.dmp

Filesize
904KB

Download
memory/4016-290-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/4016-730-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/4060-24-0x0000000000710000-0x0000000000770000-memory.dmp

Filesize
384KB

Download
memory/4060-30-0x0000000000710000-0x0000000000770000-memory.dmp

Filesize
384KB

Download
memory/4060-33-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/4060-200-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/4480-153-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/4480-312-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/4572-125-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/4584-103-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/4584-91-0x0000000001AC0000-0x0000000001B20000-memory.dmp

Filesize
384KB

Download
memory/4644-141-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/4644-289-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/4692-176-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4692-616-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4692-523-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4944-556-0x0000000140000000-0x0000000140102000-memory.dmp

Filesize
1.0MB

Download
memory/4944-228-0x0000000140000000-0x0000000140102000-memory.dmp

Filesize
1.0MB

Download
memory/5080-87-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/5080-81-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/5080-124-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/5080-276-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/5264-735-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/5264-327-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/5696-528-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/5696-603-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/5804-537-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/5804-736-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/5924-554-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/5924-596-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/6016-576-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/6016-737-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download