8373b546e0befdd0b165c4f095522f2603006a338d7e3e9e061b68cb3bd05ff3

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 18:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
Size

5.5MB
MD5

33bb1bee1732d04433d402e48fc4de0d
SHA1

77a3579ed56f3364935c4fb0d6c5d6103d913a81
SHA256

8373b546e0befdd0b165c4f095522f2603006a338d7e3e9e061b68cb3bd05ff3
SHA512

3d5417ce35c65240e3c21601e7bfbc20d94f7fd2eeb90a6bb70f594fa6b3eea82047e65a0555045ca170e65901704a417cabaa07ab701114f129d6e0fbd2640e
SSDEEP

49152:lEFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1Ln9tJEUxDG0BYYrLA50IHLGf2:5AI5pAdVJn9tbnR1VgBVmwlI7K2mF9

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
3996	alg.exe
748	DiagnosticsHub.StandardCollector.Service.exe
2128	fxssvc.exe
872	elevation_service.exe
4520	elevation_service.exe
3984	maintenanceservice.exe
1404	msdtc.exe
2348	OSE.EXE
1052	PerceptionSimulationService.exe
5048	perfhost.exe
4356	locator.exe
392	SensorDataService.exe
3600	snmptrap.exe
924	spectrum.exe
1700	ssh-agent.exe
4264	TieringEngineService.exe
4536	AgentService.exe
5016	vds.exe
3004	vssvc.exe
4572	wbengine.exe
2368	WmiApSrv.exe
1800	SearchIndexer.exe
5852	chrmstp.exe
6008	chrmstp.exe
2860	chrmstp.exe
5316	chrmstp.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ff44a7f21ed82f9f.bin	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007291de283cb8da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000425e76273cb8da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c17189273cb8da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e443d0283cb8da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cdc836293cb8da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e9c078273cb8da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133621707435088167"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000207f4283cb8da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bccbf8283cb8da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b20e87273cb8da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d368e273cb8da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
4544	chrome.exe
4544	chrome.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
5088	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
2756	chrome.exe
2756	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3528	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
Token: SeAuditPrivilege	2128	fxssvc.exe
Token: SeRestorePrivilege	4264	TieringEngineService.exe
Token: SeManageVolumePrivilege	4264	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4536	AgentService.exe
Token: SeBackupPrivilege	3004	vssvc.exe
Token: SeRestorePrivilege	3004	vssvc.exe
Token: SeAuditPrivilege	3004	vssvc.exe
Token: SeBackupPrivilege	4572	wbengine.exe
Token: SeRestorePrivilege	4572	wbengine.exe
Token: SeSecurityPrivilege	4572	wbengine.exe
Token: 33	1800	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe
Token: SeCreatePagefilePrivilege	4544	chrome.exe
Token: SeShutdownPrivilege	4544	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4544	chrome.exe
4544	chrome.exe
4544	chrome.exe
2860	chrmstp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 5088	3528	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe	83
PID 3528 wrote to memory of 5088	3528	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe	83
PID 3528 wrote to memory of 4544	3528	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe	84
PID 3528 wrote to memory of 4544	3528	2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe	84
PID 4544 wrote to memory of 3344	4544	chrome.exe	85
PID 4544 wrote to memory of 3344	4544	chrome.exe	85
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 2596	4544	chrome.exe	112
PID 4544 wrote to memory of 1964	4544	chrome.exe	113
PID 4544 wrote to memory of 1964	4544	chrome.exe	113
PID 4544 wrote to memory of 4344	4544	chrome.exe	114
PID 4544 wrote to memory of 4344	4544	chrome.exe	114
PID 4544 wrote to memory of 4344	4544	chrome.exe	114
PID 4544 wrote to memory of 4344	4544	chrome.exe	114
PID 4544 wrote to memory of 4344	4544	chrome.exe	114
PID 4544 wrote to memory of 4344	4544	chrome.exe	114
PID 4544 wrote to memory of 4344	4544	chrome.exe	114
PID 4544 wrote to memory of 4344	4544	chrome.exe	114
PID 4544 wrote to memory of 4344	4544	chrome.exe	114
PID 4544 wrote to memory of 4344	4544	chrome.exe	114
PID 4544 wrote to memory of 4344	4544	chrome.exe	114
PID 4544 wrote to memory of 4344	4544	chrome.exe	114
PID 4544 wrote to memory of 4344	4544	chrome.exe	114
PID 4544 wrote to memory of 4344	4544	chrome.exe	114
PID 4544 wrote to memory of 4344	4544	chrome.exe	114
PID 4544 wrote to memory of 4344	4544	chrome.exe	114
PID 4544 wrote to memory of 4344	4544	chrome.exe	114
PID 4544 wrote to memory of 4344	4544	chrome.exe	114
PID 4544 wrote to memory of 4344	4544	chrome.exe	114
PID 4544 wrote to memory of 4344	4544	chrome.exe	114
PID 4544 wrote to memory of 4344	4544	chrome.exe	114
PID 4544 wrote to memory of 4344	4544	chrome.exe	114
PID 4544 wrote to memory of 4344	4544	chrome.exe	114
PID 4544 wrote to memory of 4344	4544	chrome.exe	114
PID 4544 wrote to memory of 4344	4544	chrome.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Users\Admin\AppData\Local\Temp\2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-06-06_33bb1bee1732d04433d402e48fc4de0d_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2d4,0x2d8,0x2e4,0x2e0,0x2e8,0x140462458,0x140462468,0x140462478
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd790ab58,0x7fffd790ab68,0x7fffd790ab78
    3⤵
    PID:3344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1912,i,6013592127255972363,2293558434646019184,131072 /prefetch:2
    3⤵
    PID:2596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1912,i,6013592127255972363,2293558434646019184,131072 /prefetch:8
    3⤵
    PID:1964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2200 --field-trial-handle=1912,i,6013592127255972363,2293558434646019184,131072 /prefetch:8
    3⤵
    PID:4344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1912,i,6013592127255972363,2293558434646019184,131072 /prefetch:1
    3⤵
    PID:3304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2728 --field-trial-handle=1912,i,6013592127255972363,2293558434646019184,131072 /prefetch:1
    3⤵
    PID:3984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4348 --field-trial-handle=1912,i,6013592127255972363,2293558434646019184,131072 /prefetch:1
    3⤵
    PID:5744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4444 --field-trial-handle=1912,i,6013592127255972363,2293558434646019184,131072 /prefetch:8
    3⤵
    PID:5792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4576 --field-trial-handle=1912,i,6013592127255972363,2293558434646019184,131072 /prefetch:8
    3⤵
    PID:5804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4724 --field-trial-handle=1912,i,6013592127255972363,2293558434646019184,131072 /prefetch:8
    3⤵
    PID:5832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4884 --field-trial-handle=1912,i,6013592127255972363,2293558434646019184,131072 /prefetch:8
    3⤵
    PID:5876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4984 --field-trial-handle=1912,i,6013592127255972363,2293558434646019184,131072 /prefetch:8
    3⤵
    PID:5672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 --field-trial-handle=1912,i,6013592127255972363,2293558434646019184,131072 /prefetch:8
    3⤵
    PID:2424
- - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    PID:5852
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x29c,0x26c,0x270,0x268,0x2a0,0x14044ae48,0x14044ae58,0x14044ae68
      4⤵
      Executes dropped EXE
      PID:6008
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:2860
    - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
        5⤵
        Executes dropped EXE
        
        PID:5316
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4756 --field-trial-handle=1912,i,6013592127255972363,2293558434646019184,131072 /prefetch:8
    3⤵
    PID:5844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2440 --field-trial-handle=1912,i,6013592127255972363,2293558434646019184,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2756

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3996

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3056

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2128

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:872

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4520

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3984

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1404

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2348

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1052

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5048

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4356

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:392

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3600

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:924

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:880

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4264

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4536

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5016

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3004

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4572

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2368

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1800
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5456
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5532

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 9a52ec30a47c03d91e4157e81fd17a36 Hc6sLmavnUuVmPXAeQ6v8w.0.1.0.0.0
1⤵
PID:5876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
2.1MB

MD5
04a11a3e04508ab954b34ca7a9a670d3

SHA1
7a82f4e8b97e7e9a470b5c504240d1831bf4161b

SHA256
68a28657dc710a8134a89efd46dbb1d607ce7ff0b61e5833e002334c5f52db1e

SHA512
eb4db48a69733e61d98d32bfd5d60542e39ce50826ccf1e0ba6f2f0a7e2f393fc4ac3ef950466a52dbb0b56a09511a36d889a4726e8dc2042e865caca1ad6e65

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.4MB

MD5
d8e4747770b1979ca7685e9e80dbf516

SHA1
80d6b61254103c53e3542aeab5ae8eae286320e1

SHA256
20d7e3a5ca1b8efc52a47fcc1ff3a1581571cd849699b8471dd6cc20968aef25

SHA512
f16e25ae3772caac9e460168e6c085ff0fd5bfce2bee161ebf5f5cca1983e48922f93a70fc4cc18d9e154216286912129fdc507595aff7c5be33b2ab4bae5f64

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.7MB

MD5
efab7edc3e3521decc88a4f709aab315

SHA1
cbe9b817c3fe09848600953640d774db3f2be290

SHA256
1742092149c3306aef3c42a0e60925468a9d7cf0163b3c00d6809ff6a3c8a5c3

SHA512
c4b1f614663bd186ab5b35d72022a98559b3d7255797095022955a90d774814748b9307c26a1876b35afcc5113efeac3e81d8422f991223033ecdbbe35511779

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.5MB

MD5
412c054e2dcc7f6df7d87b176eb7584b

SHA1
05e7ae33cd469be0d8b3ffc6c3637895d00ccd7a

SHA256
968c6a9f9f67df303e61f3f7e5c59dd5fc7bc8816ff7b8d0ee867ec713a049f8

SHA512
81415f57f6c4a00589f6545132c30c7be715ad80050140b67d9023eb5215e6a6fad86ecb9830b8507b8040fc3b214a515e61d468eed42a46690f476c3ec6fce1

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.2MB

MD5
c6aee0064eb3e7bc71d818314da1103b

SHA1
eaa167b0d2db20593b23f57a1cc4988a57b02411

SHA256
96aad930aee6a33b41727d0147d1be136e6aa7f72321263201730fab6a314be0

SHA512
458e1881cdce7a028e528937a5161e76f95786dc8dd6ab08dee37c0039564e282a515ca8de975b3f2c8fe7bb9a6f1841a02c464c2f286138d91f3a9eb2887a01

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
1.2MB

MD5
3673a44f1ec55a7a2a483f7bb6f70b62

SHA1
6f1e4330701440306045e5e90f171373515d610a

SHA256
e53e4d60c50847b46464ea8e0aa89c5846035fa11e1b2e72bc99efadbe3e0e7f

SHA512
4d208d790676223658222e3723b10638505510a2b86ee33822c08483e81ccad0facd9218ad9709a9fff98b2748a7fb8c86cced1f89bef116ba34ab8fb1827ef4

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
1.5MB

MD5
1f92fba17b8c17a88f52ec3f7e37cce0

SHA1
c3bdf596cbd61d4b78e9285f02788edb3a014a11

SHA256
4765781456808056481a7a07fd2ff99f6648b02da355461f502da1bcde47fbc3

SHA512
7a562b5cb22c39174fa57210c5c9a76ac0759a9f302c24975c25fe72ce6fd91fbcccea76ff83997ffb61cd1ca582a77dbafcadc18dd30d12baeb42c3d6d5023a

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.6MB

MD5
f44af4ece404b07ac6707f47ed1868be

SHA1
8f27238abf64b68c6abcf8de181a1e89dacff5de

SHA256
bec200d1a4674308e73e98a4b93818ac67bf1f2a0f3d278f77a8df5e07771243

SHA512
bb93a1ed945d2c4d1e00ba3a9a46ef64e75e9cd04022c871fd4e1f94d6c4466ccbc2b74607a429bb4fed675e243919d0e0e1145cc905f066e4ed1a9fc6893005

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
1.5MB

MD5
478a3c6cbee607d3a77eeba77d4adcaf

SHA1
58d5aff5ab1616d5acb74ef7635f8555cdea58aa

SHA256
9a99dd37a54218ed4395e25d5a77a9e5622d69232876ac764cdc6ea14fb5eefe

SHA512
ddc5242dc62b400d52e33a32da4ff461d5309baf9c32c76e61cdefe5a801f4336674bbaf443fc3590ee0fccdf4fae6d71f6c2e8b2633b6fbbbc29cae4eb0d118

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
24.0MB

MD5
a3be4958fe34f2708d4b3a2a876ff59f

SHA1
fa1973b2dd77a41e655b9d6b50eda4e2a239729a

SHA256
6fe13f5b43312a089f8a5db2339a29c1ad1654d82e32b1f1f6ce17ad00804e05

SHA512
10768de637b078b78768fe317ab3b2a585fdf441c6ecc510f944bf6e790e6726364df76cb192cc592fed1da359370887e588db6885c6a4fe179b6de2c13c3f81

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.7MB

MD5
5510bf0300a25f15ba84cbe5b32abeaa

SHA1
ea65c02f98d80d0d3747c7152f4040ca092283fb

SHA256
a3e52a6a30329891433b34d6a750c146f7ff6d4a59afe7e198d65374e5983ac2

SHA512
27bf55fcd416725b2800ca15422682b79f6ab2e77471b0a328d53af9bbe2066e516b8f218522625b883f8dfb96c7a1422a0145c8271da738e00533a7e65f389d

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Filesize
1.1MB

MD5
98517d6b6f0dde046c929b854fdae43b

SHA1
4a9d090d9ac0803729fe782e3ff9ac856228147b

SHA256
5895977dbe96efd04d172ad47bf55ad94ce241b803db48e9794a9a74294f728e

SHA512
295e4413748390e0fb28c9cdb0e56d07fd4426737a1e6d1151aaa63f5c9965307fd649a30bfcb02563257a4284653ec308238aeab95117c29e81df89db017943

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
1.4MB

MD5
f713070678c74631f041f51903a787ec

SHA1
b74a1423469430286eca7f36e15018c820a2955b

SHA256
796b0ae4705d1d0320aad11dbc4925a05e30cef27cc13acdaebe15543285fb53

SHA512
cf24f0da27ead5462e121dd9598989a3e56b80442f4ef4cecbef7e72b8cc6d4ce00f7bc3ea1057680324b47d85133d05e8d92f234b1988e5d4452faf74d50fc7

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

Filesize
5.4MB

MD5
ef56995e6ee704a239f37772f4719f54

SHA1
4b510629db48a8dc5a1bc834f00dd51e7462ab7d

SHA256
6285e7371b6d3734c139c78caac297eaf0c782b41a97a051cec80c997e4acfcc

SHA512
5eb17c8a327354cc3166703789062f5932b8d8041d1846aea5b748533020c1ce2e43d9db7323f94fb9457692dc86f668002888bb50e91da3f4c2d7ad12b26685

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

Filesize
2.2MB

MD5
0b87423698cf45096ae36efc020f9ef8

SHA1
4e6fcbda7e4966ab21edbae8487ee345de2e0cf7

SHA256
e0113f1d0195a718473dc610503c4dd799934d33cfc54096ab09ad1ffc54725f

SHA512
f4d7db62bfef131de3851c0406c091bc2e6cd25b130fed6e8c74a96b4da68a73013181c28f1f84dcf57640b3339fa14aa5b9e888d56cb0f43b45e70f845a7fee

Download Submit
C:\Program Files\Google\Chrome\Application\SetupMetrics\e04850f5-44b0-43ed-b1bd-570bb7224035.tmp

Filesize
488B

MD5
6d971ce11af4a6a93a4311841da1a178

SHA1
cbfdbc9b184f340cbad764abc4d8a31b9c250176

SHA256
338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783

SHA512
c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f

Download Submit
C:\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
1.5MB

MD5
b67058b269b3d62ec7ca7121838c7dc9

SHA1
4c179c255524f3877810d3e73b68f8a10ff3e942

SHA256
63012bd4a1f0f872f4dfc2512f1743e9581a0aa8dc3b768e49621d820554da25

SHA512
ea4d0789f0318d34ecd2d3acbf194758dbcb93da4bbd33bff18b0f2c7f8790e25aa20016091f7a278e327bb5ff3ab2637b56b692a634337960b5bc26fe08882f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\14029b55-fda5-4061-8bfb-782723764834.tmp

Filesize
263KB

MD5
93d92ca963dfab82d22ec27f05269089

SHA1
4f4c36d84c9a45b9e7df0eb2d4402fa87cabff38

SHA256
2ffc0d041530f2c7c39d4e01df79d368e427efbe051267222094a79831a94bb2

SHA512
42508943a296f27a521e6df6dd43c80c80cd46827a3a06531b1e5ff15b750a321ec88710dbe26fb2b165398b47b3ec6be4322d03f0a2fa3a1390ccf07fb9c30c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
0cd429098412849541cb95afaf497de7

SHA1
34fcdc8c1708981ab8e69a9ccc50ab898d7f7df3

SHA256
d987cb1f82d1cfa20deebd5947b3ce1b9ae9ca25cb7df736727c507a3a17700a

SHA512
955809ff9150048d9b739222dfe4c1cc7b4f330cab2858b74ba1b8af8514f1d97268812c0ef81a3d926c9928fab845515a0fbd834a8dd1d0db39359001ce5f03

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

Filesize
193KB

MD5
ef36a84ad2bc23f79d171c604b56de29

SHA1
38d6569cd30d096140e752db5d98d53cf304a8fc

SHA256
e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831

SHA512
dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
def7b55370bf74cf74751f2cd0ffb607

SHA1
ad7ae0d8908ff5ad9958f59ac8634afc018ff0c3

SHA256
fce1d38fe5a4bdb8ed1e446d52a7aeb2ebe57a58183112c3469cc4abc7bc893b

SHA512
3626e717b65da0dd7b4f964f8c97895ad376d89319d9946784e0fa2b9a1bb690ee731fdfda5aee72508a4d8c4a7027cf54b163a0c316c89a62a10fa909bccf9b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
c872120bd38c01c7e842ea10e300275e

SHA1
2e37ea3ff1ed0703337803217a3f8f61bb004be1

SHA256
79bdf26d852bc26124a7c92473cc32a9b1f6823323119edd7806f44253c75d9d

SHA512
d7bf1202ccec2eb5b0afeb7ff75da2f2860bb8e8bfb5b89195e3c85fa9489897db5c04a971a49dd6b51c53776baa23598d3515cae05db3d61887b20a7e2ccff1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
a9b4616dc07ef44340e12437023d1c38

SHA1
f119169cb44ca71f446d56fec63e39e593883fa5

SHA256
be424b73a5f777b13751feae1ea3626a0d3cb5d25944cbc3f2e611f385713db1

SHA512
f45572d18dd10975c538b60b54f477ac6de655efd0bfae187251a70f1830898c3229d3b83e52e41e51284cb57cf8fef840bcab27af1cacbc33644d03a5cb3cad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe578954.TMP

Filesize
2KB

MD5
411ac782e18a3f8947b5bbdc13773829

SHA1
d9a709bb6b79ade9df4024e8fb6e36190070bc21

SHA256
0217b1195d87db614149675e331d00b581206641c58f6c7cd8cadb92e718f8cb

SHA512
03cff6f4f72f375b34a35df614de1c0837ec423b3b232e5b863a2d85ccb2f2bc025d1954ae0ba9d117930a84e7fd1b44bc82b488e5acd58370c36e9c24717d5d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
31b23ba009c598796ab3c2dfb7e8fa41

SHA1
162393d7283b44f179b73c1ae21c18f3fd25a479

SHA256
fde17f082d4ba61f90e2b0d5ff1eaad9e154a9c8c6b5409ef07ea6b28faadd98

SHA512
80844383dd8a66a630c888340beccb7f8ca320e71d2567ba375ce8ce7267850f2e30d3dd2779bb883dea0d19575a786f49efab15b8c84924d67d9c79f25d90e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

Filesize
7KB

MD5
673f529fc7d417569881fa0d1e24f2f5

SHA1
fe9ccf37ea6f09d9f72e4cbd7cc3baa4e22bf6b6

SHA256
83813f33fcda0ebdd02ae38e04df5c884f10b381c7ff3bc8db9bfcae08a2ba3b

SHA512
ae83d33f40fb92ff47f305974f1c678304cf7dbaaaeda588ec2d3d55a5ff30a542fea1d577e43ef122878712fea06fa0736017cafa643918ae62b33b135be9d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

Filesize
8KB

MD5
251e693ac931826289d9cdbfaf89ba30

SHA1
31b39d937c99a617da88dcd032005099e0f0ae88

SHA256
490bff5a962185a62a6f9159d420361bf04efaffdc9dccaa15dd942e10433789

SHA512
54035f18aa25e9bb9bfa39db865ff698e09f7ce2206852d5735ee7506bcec40f46eac8eb42ffc8146b106668db776285c615d2606623322e275a4a321676c462

Download Submit
C:\Users\Admin\AppData\Roaming\ff44a7f21ed82f9f.bin

Filesize
12KB

MD5
fba82bdfecf85237c8927a37d970288a

SHA1
1d9e017ea88cff8ff40c6872a1e1e8274ebb323f

SHA256
c07043275bf82bb8dcaa3937c107da9365ad8fe7022127721e51da0f37b37b33

SHA512
e0deb227a59e82aa3c79c63f2f1eb4847b9f220833603cf568bad98f220895c556db0899e9f094bb19b8a75517f17d57b34ba626b7cce76070099b29909abb0b

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
1.2MB

MD5
4ea8f83e999bd143dd0869136b1ac10f

SHA1
c30ff9f5403b918f6d0c1c22f45f6ed1278a3bc9

SHA256
9dfe80b86e3ccbd2eb2a0ef42c85cb85174549edb6b3b4ce2519764227c8ebc9

SHA512
78fbcfdc9e01496429f837b77452d87eba664630be03c756f867df8a0641547c0bbeb7b0c01870cef4053f3e57133fca75a33df094bff0afdfa5766a6c4a86e5

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.7MB

MD5
f208dd376348607568229f1b099721c7

SHA1
d96b9446d255fb494972ec045e3050dbbe58085a

SHA256
27f4248c2f74fe502413d22291b82fc6c218cdba2a361f84fb52d5ade513da91

SHA512
f9dfef357e95ba02fcd02ae14160b9addf34d0371ad653bb5dbef66165a9687634730ba8885b6c60d4667a92c50c7e979cd6dcedf0da1445ad55da17a11f2116

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
1.3MB

MD5
2129c09ec45e47d21e10fce3fa6a3cb4

SHA1
19479c2c394b0fa672e235f048467dd669ed8513

SHA256
41a02343bbaf9f055e2ce267eaffcddd8d285d78308b64377102307c6ba3bc42

SHA512
4fe961ca39c2bf77b3fa3f3b2bc23cf50613d50ec955dd98d597529bf847e89f135bac6e77ed4efb1f291238c34db599b62d83d897f62391788abd75c959865d

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
f543f68827c69ad76814e6402b4d2abe

SHA1
898087920106e5f5d822e184fd7ea687856a3a7a

SHA256
becb2d97b7254c4e4cd93373278727ecc06c077fbce776d9bb41a4ae3fd57430

SHA512
42fcf5d83d8399b8483bdae7785682578c9d219ea878ad4a252a6ff935a9617d4a6e7b3ee51da6f24e488deae3aa43770422d385b716c014973a8e4322a3b343

Download Submit
C:\Windows\System32\Locator.exe

Filesize
1.2MB

MD5
0d08786b27872257d701dae6329758e0

SHA1
10dba3dd2b8ba3cf552bebb04485d3e650b1c5d6

SHA256
2c20249cf48aa9b3fa8b412d4c858621a53d32f4f2069efd5d1a8323ea552e02

SHA512
33f11d8186a3c77dd9c05e409bf258a7a5641193555b3568ca73d0b64bb5413f3d10e2eb4ba31ed230e49fd5a5831ebf91c1c67aab67cd7c232518613f0db009

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
1.6MB

MD5
8e3e0ec5d630f7e0550ca562d48c80ba

SHA1
b2adfb7b53facf6227f76140f100efdb9b30e773

SHA256
6895a5bdd8300c1bc0cd0baf5e3c1b26a295958a42074417ffef83598dc3c60c

SHA512
55ac1de779b0a7fae1925edafebe98903e4af37a84f3fae579a1e45212038791e8abcc7febae9b9617e682838580b09a0e18b5ebd4c55a62efed3003fd7b26bc

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Filesize
1.3MB

MD5
65ee303b84618bcc8831cb1e0369e474

SHA1
e16d0691648446bb36f8b85651a7c903eb4d3118

SHA256
4f97d036acc37c5b6081a11d55b47f8513142ae1ef1b30a6a3994c12818b6e16

SHA512
151fadc0e0b20c62e41aa8514381562801499f417958da7a868ee1d2f7575334e610a9758ae559bb1d5a90fbef52da86453fe868ae0aad136d238d7506675732

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.4MB

MD5
7a2447f935fcff9a5d129ba587095e22

SHA1
96442d2bb7b9b48e134d32d6cdac92b8ebcb1e71

SHA256
50de0bdcb53739a868e8c141a8dd51bbae3477e678c33967a1db7331b49bf95b

SHA512
d4a11b57d408aff5489bae29f115c02ffbfaac544a2e78caad7331414b1e4492b93187a520baebb586edeff25f34f835271599f4c99c3c9fec9cbed3dad60fc0

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
850bab48b34d2d048400e81a3fbe251e

SHA1
4161ced68777571f99b230d894171965d2c15564

SHA256
130c1fc228dd0b6a6d40a25442e3a9e6d0a580ab31cfbcd2d08ee76472e0215e

SHA512
880476cf8aeec33152dda11fc72f7e4f0d3964934f21ba26905a08fb14e1a5aa87e0a152edf992bd7e3fb3569e77065c3ea123709d200ef6c3c463e7e831071b

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
1.4MB

MD5
9b2e1eac420593c443d4dc7b51c79796

SHA1
e8921d786a606c8ad0fb73af13d02cfb65890284

SHA256
74775872233946065569c91f429740db50c635a8bdd213433891e9729a78ad1a

SHA512
9642dada14a46c03ce5e2f1b0adce2c2306ba298af1b3a3085083dcd8b10434d7749813cb437a90b842b855a9bc5d85d75271599af457e8d0e0e07c2887c6968

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
1.5MB

MD5
a1461dcf4cf76925afbef4d954387246

SHA1
870b1d2d3576ddc610a64610adb4f91d9453fc30

SHA256
ebbf73863390706474659a2301cd2b498c95acce41d4bfbf6865981a29b279a7

SHA512
98e857fd07087b134ece82c3e683789c8ac5aa3bb4d6021adb0a1029ae90b8e501b6849c873fe9e72a07a8fd5ee2cb4944c6eb695306d7159c41e20df47b086e

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.0MB

MD5
f4d8808800dfaa04ef77af4c8796c094

SHA1
9733b53302343879d22cc8f5c4c1e7f012cd02b7

SHA256
d0bf05fd1289d5abf07334ebe762732f4b2b53fd55a3029d0d6b4e911095039d

SHA512
6104e64a5d8b2bc97378b507ea7c36c04979f3efaab2136f3897302021eeb17a310123bbb9dc88615643ffcd9b305f451db2bbe47bb4347b0c038e92421726dc

Download Submit
C:\Windows\System32\alg.exe

Filesize
1.3MB

MD5
4af6db8dc48477ebdce17d404562c436

SHA1
11a886e93377d7d470ffda868011b8e6dd713a93

SHA256
3aef5921677f41c25090cba43a434e26fedd6e09f42553643579fde3c972e426

SHA512
668c9e637d28993e50015d0be6aa4d8fb403de3fb6892bf21d4d86d4f4a4133cdf025168f13b943de2fc9709bb763b586476efcd1cbe77796a1254bd191111e5

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
1.3MB

MD5
cc5e0938f231b2583a990cd78fee893c

SHA1
3eadf2674a3762d9db8572a248210c2126ff5a88

SHA256
6c4154a9e9d58bd24d17e26b960d9794af7c583e50155210e4117d4dcfedf0b2

SHA512
44a5ac23f20f107ef4c716f688ea1a9e92bd604e059bbdd74a27d5b6d892f29f3bc18bde4192fb49c9a30d693d158abc16f2c94af968877f13ef496110a7ef09

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
1.2MB

MD5
c03a952d7e76e630378d48e4469e4e55

SHA1
7267379436f620ce1fc5369f8ed2da1b9693ebcc

SHA256
932323a501c1f56e73bd3e36c8bd930efa784012d7952464ae55ca48c049b374

SHA512
f351bb3ecabcc3b3b5de6acfaed3cffce30cd86dd3848785ee624f12ba4939aa9f00ecdefc6782ac1c2c42562b52122eb9e5d546b3309c7eac9f25760fde3c71

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.3MB

MD5
ef1463d10a08997f59a89f020c3f7746

SHA1
cd10a4ad6dd6689ccedffdbf71e1dc6418b5b543

SHA256
9f19edeb5802aa4e1321af851d286d49edf2073f1b24d4bfdecc5b7ab8b333f2

SHA512
95e28f1a52c888d1a6b5d7bb60785e2ddc3b47cf1b4164121a58760f561654d84c57fe694bcbde3a2417e21521b8ff3cd65f26868a3948f8182d75a6e0737059

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
1.4MB

MD5
6ff5a6b1079e0635f2f0086efe4abeef

SHA1
6c9fdc4a4eef59c1883b2fd04afe11510c5bef93

SHA256
aeff6aeeaa872b0a31e44ebd3b65d58cf777e22c4df90837d0d74ce44ad8f9cf

SHA512
b952a042955f056791daa166cc23cfbd05134c5f8f66ef86b9af641a49198446b87645f6bbc81b8f6e644f444ef8e2647b09a453ae563a4684621386139f97fa

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.1MB

MD5
46fdcfd6e3c233d5c6517e91513f2b61

SHA1
0765e1906074917287897cf1fda10b0c30723f09

SHA256
f6facb9861413e42bb8bcaaccd3f9b2342a04098eb57e3217e8e17473102fbce

SHA512
554b903464a53f5508ab063b24f95e1256813075ebc160a0270ebed1e29ac7f83b4c1b925e9bf88e73ed67bd27a97c6d1479823f9df8bb1cfcd7e97371880348

Download Submit
C:\Windows\TEMP\Crashpad\settings.dat

Filesize
40B

MD5
4d858969f9b63ec4e90b337affb40980

SHA1
c5f517b47ddc66cf8fe32495fe14e425f905c252

SHA256
d228412aca7296096c2db6c01dfe1e83ca0db6a7fc2512468473c94bbc3e50f9

SHA512
df058b39862395921f86ab56ac87eec0ed1adb201b988f3bae0fb037e14a1c33d842b7fac2354f0daabe15cf41c5b6757ed9971dc8237e7a5e9377314c6b972f

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.3MB

MD5
c7de663340901beba9d07011b95572fa

SHA1
0c359aedbdec1cc11b076659972176ba79e89c26

SHA256
cdbb7a791eedaeadc809fe7ba0467b5e1f68728f01109f26bed57f5ebd6fb6e8

SHA512
a3bf9424cf0d0ec3859fe5add061ee5dd5cf0a29a16935c6fbf5efd416d95211fef57ff0fff3489f9007e1fc2b1fd45f4b159d0946aa7b83c41be3ab09d72a4b

Download Submit
C:\Windows\system32\SgrmBroker.exe

Filesize
1.5MB

MD5
5ebc971ec01920d93ae94d43aa107460

SHA1
38270421ed2bcd13208892c642fd3907ad7eacca

SHA256
c97eddfc9fe964a22af93658e45e75adda3b31b53a8276cbfc359b15cff1a1ed

SHA512
31581e27da8f1d1d94445c8a7737fc1ec866c0b6056edc0282e74a0acb53a37ba1c810dec72609c3deb6791a55bb216a9a8c8aca4e50598e16a528331d40499e

Download Submit
C:\Windows\system32\msiexec.exe

Filesize
1.3MB

MD5
fb0e88076bcdd816a143c6d6ab646ed2

SHA1
c7a6aac15ddd23752eb390645625db02107499c9

SHA256
b69e43072ecebc63e452b8cbecc5c9723de355c83b3d2371bdf8d92e0a6c5c01

SHA512
7243ea3d5641ce270e3731f79348fb4bde8171d39ac3327cfd6a28a04132e89a7d9fc5403ba12c7ddc25c03f4b4b67061e78ba5763d905896a6c71ffd3c0c0ca

Download Submit
memory/392-323-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/392-586-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/748-43-0x00000000006B0000-0x0000000000710000-memory.dmp

Filesize
384KB

Download
memory/748-49-0x0000000140000000-0x00000001401EC000-memory.dmp

Filesize
1.9MB

Download
memory/748-50-0x00000000006B0000-0x0000000000710000-memory.dmp

Filesize
384KB

Download
memory/748-757-0x0000000140000000-0x00000001401EC000-memory.dmp

Filesize
1.9MB

Download
memory/872-316-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/872-64-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Filesize
384KB

Download
memory/872-456-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/872-70-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Filesize
384KB

Download
memory/924-329-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/1052-320-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/1404-318-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/1700-330-0x0000000140000000-0x0000000140245000-memory.dmp

Filesize
2.3MB

Download
memory/1800-762-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/1800-344-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/2128-75-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/2128-54-0x0000000000530000-0x0000000000590000-memory.dmp

Filesize
384KB

Download
memory/2128-73-0x0000000000530000-0x0000000000590000-memory.dmp

Filesize
384KB

Download
memory/2128-60-0x0000000000530000-0x0000000000590000-memory.dmp

Filesize
384KB

Download
memory/2348-319-0x0000000140000000-0x0000000140212000-memory.dmp

Filesize
2.1MB

Download
memory/2368-761-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/2368-339-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/2860-566-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/2860-591-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/3004-337-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/3528-10-0x0000000140000000-0x0000000140592000-memory.dmp

Filesize
5.6MB

Download
memory/3528-21-0x00000000008D0000-0x0000000000930000-memory.dmp

Filesize
384KB

Download
memory/3528-0-0x00000000008D0000-0x0000000000930000-memory.dmp

Filesize
384KB

Download
memory/3528-6-0x00000000008D0000-0x0000000000930000-memory.dmp

Filesize
384KB

Download
memory/3528-28-0x0000000140000000-0x0000000140592000-memory.dmp

Filesize
5.6MB

Download
memory/3600-324-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/3984-87-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Filesize
384KB

Download
memory/3984-98-0x0000000140000000-0x0000000140212000-memory.dmp

Filesize
2.1MB

Download
memory/3996-38-0x0000000000620000-0x0000000000680000-memory.dmp

Filesize
384KB

Download
memory/3996-752-0x0000000140000000-0x00000001401ED000-memory.dmp

Filesize
1.9MB

Download
memory/3996-41-0x0000000140000000-0x00000001401ED000-memory.dmp

Filesize
1.9MB

Download
memory/3996-32-0x0000000000620000-0x0000000000680000-memory.dmp

Filesize
384KB

Download
memory/4264-331-0x0000000140000000-0x0000000140225000-memory.dmp

Filesize
2.1MB

Download
memory/4356-322-0x0000000140000000-0x00000001401D8000-memory.dmp

Filesize
1.8MB

Download
memory/4520-83-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/4520-315-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/4520-760-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/4520-77-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/4536-210-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/4572-338-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/5016-332-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/5048-321-0x0000000000400000-0x00000000005DA000-memory.dmp

Filesize
1.9MB

Download
memory/5088-11-0x00000000007E0000-0x0000000000840000-memory.dmp

Filesize
384KB

Download
memory/5088-17-0x00000000007E0000-0x0000000000840000-memory.dmp

Filesize
384KB

Download
memory/5088-19-0x0000000140000000-0x0000000140592000-memory.dmp

Filesize
5.6MB

Download
memory/5088-741-0x0000000140000000-0x0000000140592000-memory.dmp

Filesize
5.6MB

Download
memory/5316-764-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/5316-576-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/5852-539-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/5852-602-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/6008-763-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download
memory/6008-551-0x0000000140000000-0x000000014057B000-memory.dmp

Filesize
5.5MB

Download