f74740f6bdc42b663070ea8569645a0ddee27a4c27d3c953cb146f70ad688704

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 18:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
Size 5.5MB
Sample240609-w5ts3aec32
SHA256 f74740f6bdc42b663070ea8569645a0ddee27a4c27d3c953cb146f70ad688704
MD5 425e9556ec34d9dc439b74fd2f0502ce
SHA1 cd211415418d85c0d889ac52ed45e4af676b22ed
SHA512 381c106d58fefdfc58d0b03726ce5e2e97503530911c273b42c09cf32012c54e625dc651cb29628e33eb70ee2795409323aa4a6de8f923dbc6ae70702c504c8d
SSDEEP 49152:dEFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1Ln9tJEUxDG0BYYrLA50IHLGfB:hAI5pAdVJn9tbnR1VgBVmDqo4w
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
1140	alg.exe
5060	DiagnosticsHub.StandardCollector.Service.exe
5052	fxssvc.exe
4788	elevation_service.exe
3344	elevation_service.exe
4804	maintenanceservice.exe
4644	msdtc.exe
2516	OSE.EXE
2456	PerceptionSimulationService.exe
4124	perfhost.exe
3148	locator.exe
1460	SensorDataService.exe
2140	snmptrap.exe
1016	spectrum.exe
3736	ssh-agent.exe
1036	TieringEngineService.exe
1524	AgentService.exe
4204	vds.exe
3104	vssvc.exe
4460	wbengine.exe
3668	WmiApSrv.exe
1988	SearchIndexer.exe
4228	chrmstp.exe
324	chrmstp.exe
5436	chrmstp.exe
5504	chrmstp.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b1d7a51be703f493.bin	alg.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110750\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c42b812f9bbada01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000087366d2c9bbada01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005aac602e9bbada01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000e72652e9bbada01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ff7cb2e9bbada01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6986f2c9bbada01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cfc1542e9bbada01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a11442e9bbada01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000059d4672e9bbada01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001ee77a2e9bbada01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000087f2282f9bbada01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054eb1d2e9bbada01	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
3920	chrome.exe
3920	chrome.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
4640	chrome.exe
4640	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4772	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
Token: SeTakeOwnershipPrivilege	4352	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
Token: SeAuditPrivilege	5052	fxssvc.exe
Token: SeRestorePrivilege	1036	TieringEngineService.exe
Token: SeManageVolumePrivilege	1036	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1524	AgentService.exe
Token: SeBackupPrivilege	3104	vssvc.exe
Token: SeRestorePrivilege	3104	vssvc.exe
Token: SeAuditPrivilege	3104	vssvc.exe
Token: SeBackupPrivilege	4460	wbengine.exe
Token: SeRestorePrivilege	4460	wbengine.exe
Token: SeSecurityPrivilege	4460	wbengine.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: 33	1988	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1988	SearchIndexer.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
5436	chrmstp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4352	4772	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe	82
PID 4772 wrote to memory of 4352	4772	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe	82
PID 4772 wrote to memory of 3920	4772	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe	84
PID 4772 wrote to memory of 3920	4772	2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe	84
PID 3920 wrote to memory of 936	3920	chrome.exe	85
PID 3920 wrote to memory of 936	3920	chrome.exe	85
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 3908	3920	chrome.exe	98
PID 3920 wrote to memory of 2240	3920	chrome.exe	99
PID 3920 wrote to memory of 2240	3920	chrome.exe	99
PID 3920 wrote to memory of 1268	3920	chrome.exe	100
PID 3920 wrote to memory of 1268	3920	chrome.exe	100
PID 3920 wrote to memory of 1268	3920	chrome.exe	100
PID 3920 wrote to memory of 1268	3920	chrome.exe	100
PID 3920 wrote to memory of 1268	3920	chrome.exe	100
PID 3920 wrote to memory of 1268	3920	chrome.exe	100
PID 3920 wrote to memory of 1268	3920	chrome.exe	100
PID 3920 wrote to memory of 1268	3920	chrome.exe	100
PID 3920 wrote to memory of 1268	3920	chrome.exe	100
PID 3920 wrote to memory of 1268	3920	chrome.exe	100
PID 3920 wrote to memory of 1268	3920	chrome.exe	100
PID 3920 wrote to memory of 1268	3920	chrome.exe	100
PID 3920 wrote to memory of 1268	3920	chrome.exe	100
PID 3920 wrote to memory of 1268	3920	chrome.exe	100
PID 3920 wrote to memory of 1268	3920	chrome.exe	100
PID 3920 wrote to memory of 1268	3920	chrome.exe	100
PID 3920 wrote to memory of 1268	3920	chrome.exe	100
PID 3920 wrote to memory of 1268	3920	chrome.exe	100
PID 3920 wrote to memory of 1268	3920	chrome.exe	100
PID 3920 wrote to memory of 1268	3920	chrome.exe	100
PID 3920 wrote to memory of 1268	3920	chrome.exe	100
PID 3920 wrote to memory of 1268	3920	chrome.exe	100
PID 3920 wrote to memory of 1268	3920	chrome.exe	100
PID 3920 wrote to memory of 1268	3920	chrome.exe	100
PID 3920 wrote to memory of 1268	3920	chrome.exe	100

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Users\Admin\AppData\Local\Temp\2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-06-09_425e9556ec34d9dc439b74fd2f0502ce_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2d4,0x2d8,0x2dc,0x2a8,0x2e0,0x140462458,0x140462468,0x140462478
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90ebbab58,0x7ff90ebbab68,0x7ff90ebbab78
    3⤵
    PID:936
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1912,i,194474486856167316,13949631167956004482,131072 /prefetch:2
    3⤵
    PID:3908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1912,i,194474486856167316,13949631167956004482,131072 /prefetch:8
    3⤵
    PID:2240
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2064 --field-trial-handle=1912,i,194474486856167316,13949631167956004482,131072 /prefetch:8
    3⤵
    PID:1268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3000 --field-trial-handle=1912,i,194474486856167316,13949631167956004482,131072 /prefetch:1
    3⤵
    PID:976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3008 --field-trial-handle=1912,i,194474486856167316,13949631167956004482,131072 /prefetch:1
    3⤵
    PID:5040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4276 --field-trial-handle=1912,i,194474486856167316,13949631167956004482,131072 /prefetch:1
    3⤵
    PID:5140
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3916 --field-trial-handle=1912,i,194474486856167316,13949631167956004482,131072 /prefetch:8
    3⤵
    PID:5276
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4692 --field-trial-handle=1912,i,194474486856167316,13949631167956004482,131072 /prefetch:8
    3⤵
    PID:5340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4824 --field-trial-handle=1912,i,194474486856167316,13949631167956004482,131072 /prefetch:8
    3⤵
    PID:5988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4064 --field-trial-handle=1912,i,194474486856167316,13949631167956004482,131072 /prefetch:8
    3⤵
    PID:6072
- - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    PID:4228
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x29c,0x294,0x298,0x290,0x2a0,0x14044ae48,0x14044ae58,0x14044ae68
      4⤵
      Executes dropped EXE
      PID:324
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:5436
    - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
        5⤵
        Executes dropped EXE
        
        PID:5504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 --field-trial-handle=1912,i,194474486856167316,13949631167956004482,131072 /prefetch:8
    3⤵
    PID:5280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 --field-trial-handle=1912,i,194474486856167316,13949631167956004482,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4640

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1140

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:692

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:5060

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5052

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4788

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3344

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4804

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4644

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2516

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2456

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4124

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3148

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1460

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2140

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1016

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4804

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1036

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1524

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4204

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3104

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4460

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3668

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1988
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5656
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 1385451238e5a9a5ca6a270cf0074c30652f6ecd68a0978ade367a6ce2d32fca
MD5 7f36ed966f738577868b19afa0239004
SHA1 c213e760b82a2fdb933c77f2df61fde051b7df0e
SHA512 8339c4058e1b841a4843e9b3fb91e5729f79e000e49b16aa4d1ea8b108b580985507ef35dd9fd6e7f33d3a0332fd1beb45fd8c22b1b15f11bc7121501f589e6a
SSDEEP 49152:duYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5fkQ/qoLEw:dPfTqi90bnqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 668d9d692a4779c10df65a463967e07431be1757497132f362ae402f8a574395
MD5 644b3eb5f1ac0329cb9d9257c161374f
SHA1 9da7a965a6f61ec9482ada4ba107ffca6df26154
SHA512 dbb12b32641a2e463d1728f3ac6052c6ca7931c420bb5f72867bbe853cc1cf1ad338747199133a00adac652262715930e835e802ed2821aa356ce448c5b7f1f7
SSDEEP 12288:qcQirmNJLBsunEeMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:0iinBsuE7SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 22c5c5b1abc838bb8624eb7e7e7323a9050da8166519227e4d82b3b5a28d6256
MD5 840ee0d19f779f00ee9df5522b768720
SHA1 b05d20fa9a440b2e386f16a730aaeff3cf2ca875
SHA512 05646972134c875f6d368cb6a2b7d3c9418e7b11c1451f7c2352ce22aa8682732a499b36c997ffa69997a3874f45b3eef0a12d3eb3d61103a954ba3d64d9764e
SSDEEP 12288:d7a3iwbihym2g7XO3LWUxfh4Co6MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:4+gkEDfh4CovSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d840d8314cb65c21bd345c218dc8a99e341d065d2b7a3ce08f4d4336842e8b15
MD5 6bebbc32f8c12733ac2f2a68861bb38f
SHA1 debb1cf944d6d2edb04bbe7e9176ea327c408ec1
SHA512 5d32fc86bf912fe2f6f1515d22826c1b76b29ab0777d0304e8851aaabc18b00a5fdf7017ec5441fbcc7dc423fd3e8e8eb4c2dbd0ea012caae46aad5625f5d07f
SSDEEP 24576:tBpDRmi78gkPXlyo0GxjrqSkQ/7Gb8NLEbeZ:HNRmi78gkPX4o0Gxj/kQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a694677eb7170132f2870865d42db4771b16a82f30e938944c6b5e2821398a42
MD5 f6e97491a585c3046d8af9a5078463dd
SHA1 3652ddea939e8d44d755ab22cd99eb9d135e3adc
SHA512 48b5a18d651fa47ede4ca5f094743aad9408ee6196542fba52c443d754d3d456967647e0f83473b8ca7db26f93907bea4fff3c4b1c76d75be2c2dbed028a9365
SSDEEP 12288:yfC6Aj+TN5uixZN+8rKhUdTC/wE1MD0Ca5ZIXV6MTmkJR4Do07Y86gw5CtCjX+NR:uLOS2oyPIXVvSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2acc60b9cb296756701bc81e3fe062709fa6f2db9dc2381f6f6e827e8d53227b
MD5 2d0d445d37b01bf5e7861c2cfa81fa7b
SHA1 747e3030e12a2e76f1434257952750ac3b83f609
SHA512 97a95fdde40c33160c7277911b636f4b383543b483056106f8bfdbfdc2adae2f6a37d2abb6e876d8404ff693031292aad6e5fd1ca5f52069834543a2e4074fc1
SSDEEP 12288:qMsMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:qM9SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 38aa76b27c111a5eccdbef2e51dbd1e602a952474d7987f7d7158b0e12409658
MD5 58ccbfe238f4754d48b2e9334bd74bdc
SHA1 c265a5a9b20ec96bbf8233b3692daca5da48e12b
SHA512 f84f5be4e550dc6edbc6c7a75f43c700d921b14cfece5c5f8df6d735e463f1adceb50f8e61b46beba12a62106d9ebc183a50c16a1b8aef5cd3bd3d5c2667b746
SSDEEP 12288:eeBNUbTVO86UrMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:eJIU4SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d2c3643766ef1f11efe84770823063d6aa1d66a09d9753ba0193d7ae3d293735
MD5 dfa8f2e9fd57f9d6d7a94869660a60dc
SHA1 ecad0426a9ef851ba3ccbd38847e3268a9a4d096
SHA512 5b046c036329186a128699119a79f8c0879b1516541024ad184c839d6800269e2f558c5a70d3bc96f6066645553205f08f6bc037105a9355b756bdefa65982ed
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THh:jQvGAdlCEL8c/yRNw5Ciqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 8f4de084bb411c571c6520303faafb3a106297bff2553153fa6641e0041d4f87
MD5 7541a0d4bfc2b8afbefb926e23ace1b3
SHA1 57457fd276fdd609e1e577ec49fe4062041d8423
SHA512 940298c705338988f5ec44f22144eaa1963e059e1ebd595c8b680770ec2d715b8df63359002c7f3ec3176161149af30f8a166dea36dcad10032ccb30139dec1f
SSDEEP 12288:5AwSfxL/2Dc3eDLLmt0LDQewsAj5MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:q3ewsAjiSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 57130e74404a7c52aec3e450e59ec47b173d3c0135380ac421d63f2a5d14f5d0
MD5 963cc2c48966f9f2b59492ed5c977f6d
SHA1 42249e1428e3a390b42255bf272ccf65fccd8be4
SHA512 762f2f2ea315c77da3d6b0baa43269cf0a6889fb2050aa71147ed5276070aeb065bf76e0620981dbbe7013404a33cc22e481a6a1ff3a395d180dc91cff335acc
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH/:kUEtQevvqc2W1cpV2EI32/
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 259d4784aaa4f77ddf6c6c9bed6151ea9683873b91806008037526340044de65
MD5 aa22b28778c3612baafdd9dbf7c2436d
SHA1 115cb23cff4f5074c1c198c86acf51ab93c0e809
SHA512 129ba5412494e2e5ff204827e71c5fbb0a5129621fa031511e953559b487e0c8b9492f6e890086a776b8475dd270f70389da9ef8b03e0b736b3756fa3f3f3046
SSDEEP 49152:ZCbRquA/m2yL5zifFiV+XenmE3/zLkQ/qoLEw:2oqHVjnmuqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1770bee971630da324942ac59261c799af36676f469e85ecbfadeae72cdfd668
MD5 bf3f45001602878704b06fbbedcccb7d
SHA1 9d269af45e9c1d2cc0b1bc3d22498fef5a38e5e4
SHA512 0ef9a0e3dcdd4f770a689ba50d2ebe207ae5ec80c870d8fcd4f2a78c71c4bc0a207d91b8e36a327bc71a0c218264280317e7e953ef3ba836fd52ddc811a8de09
SSDEEP 24576:GAhGLJIFoiwtA5l7S53fSkQ/7Gb8NLEbeZ:GAMyFoiq5qkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 d173376fbfab49a1d9004fb087b41ca7bd21983bca19844267d6fd1fd81ff01f
MD5 0e152800bdd78e3f7aeea8b6cf97571c
SHA1 cd94e1ff5e3601fbe63f210afda64906839b2d22
SHA512 71ebaa0bf255c364e63d0085f5d3a89a87109eeca8049a978da1906e2e7e5974fea9b455763f4ef73c09d306e8f02dcc1b84616e376008196aae5b597296e887
SSDEEP 12288:dmw5HEjsChN8BFgl0WDm+CWMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:YwuxOW+SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 c391d82a47df7e957c1f5736913a70f6da414191dccc7963fcfa93b47c418c9c
MD5 d347de586e7d719f2eb5f30bcd6854c5
SHA1 043fd850ccaa5d215d3de75e74a4d1ecac6509cd
SHA512 790157492898c3a50fe433390484605d2aed71de5ecfdde1957eb3fc28ea774bffa9ead0483535aa5c78d88c9fada04e765331613ca89e9c3aaa323886a2a6f5
SSDEEP 12288:O4Z1IyJMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:RZuhSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 fdc8f475189ffb8055c53db717693fdb69405df3e457e74f412d913da57cfd61
MD5 83b06848afb331704d4f630d2e867743
SHA1 31286d760c43d3dfa896f5228757f27a82ba7fd1
SHA512 001817a1503c8dbca7678a497496e1f29ed9e3d91a6ef664d572c1c20be66e23da6706617cfc61a74ff2903056eaf6e26b82e353611c893f7497be50df6466de
SSDEEP 49152:d0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLR:lwfhY7g/rLd7yYA3awr341g2qo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 aafd07552ca4503e7d92012dd8279cd6b6d09a17fb30e30725c4c8fc1fb7630f
MD5 8d1c4b68859f2ba5ebcf19f69463e364
SHA1 2d2ecdbe6c1e752f932578163e62e05d306bf737
SHA512 ec8aeb5a77a2be2dcd3a2daa54dc9864a7addf72ec476dcbbb6c2fec1bef08fef74026e77d7abba04619c348f686fa977ed490cc5bb9af81d05d8582d3235953
SSDEEP 24576:1cTyYv0FteQU+5I2kjgD6iQacA+SkQ/7Gb8NLEbeZ:1uXv0Ftpn5606zOHkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 a020d9afbc1b21a27a0726fa8ec918e32f55aba10921f95468b799ae074c432d
MD5 827563ec8d7940cfe0a8f64382b6f917
SHA1 a8a1d5e80c5156d0f732b8d8bbc1d93ed7270d72
SHA512 da26a47eb8f4b319c536e3d8c3f1b898f0178696ac6775747bd39faba4f8ffac04fae21cd782e05c9d12080a3265c0fd2edabe415899f2b57019398c9470bfdc
SSDEEP 49152:iy7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxrkQ/qoLEw:ZmYeyxHjWjMTnqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 50a24df70d8a2c6cde26eb01c6b63236c69fa237d624294863b1fb199b517205
MD5 7001ca50859387acb6c4552bf51362a4
SHA1 d5482b532dda95174ce291166ff7a92c93cce456
SHA512 718cf0baed1fe6fc5853cb4272d45e257a701eb1a3a07cf681d597e2e6cdf98f3aeebee1c5730efa331f05d54a646175a098dcfefc8168882399c7f791a1f3fb
SSDEEP 24576:fcP4mcvIjkGOxhKP2l71SNKbrh/8KBJSkQ/7Gb8NLEbeZ:0P4m4IpOO67N8KukQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 299c0c0aef0122eb33c82a7c6c072d683d60d30ce41e12cc5ae3c3ed7875e534
MD5 305e3206097cba2bf4d1b9ca1dbc75d0
SHA1 9558ed15865be41be8d2f6e4d6165de4f7491bac
SHA512 b716539131d1373c4793a69e5dd106f139b9fa2951a092c61dd3927ed4d4f53e5e51f1c1a1373ad6a5345e68b956c0bbd8d71d8226fcc1c9a22a033b4b34ff8c
SSDEEP 12288:GUFmDDLPMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:8kSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 4e5ceefae11a45c397cde5c6b725c18d8c63d80d2ce851fa94df1644169eafc9
MD5 d0df793c4e281659228b2837846ace2d
SHA1 ece0a5b1581f86b175ccbc7822483448ec728077
SHA512 400a81d676e5c1e8e64655536b23dbae0a0dd47dc1e87e202e065903396e6a106770cec238093d748b9c71b5859edf097ffff2e088b5b79d6a449754140a52ad
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 193KB
SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
MD5 ef36a84ad2bc23f79d171c604b56de29
SHA1 38d6569cd30d096140e752db5d98d53cf304a8fc
SHA512 dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be
SSDEEP 3072:HXm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4g2rJBXCy9enoN:HXUMCm4U6q62MEBi99g6JVCvoZhhl+No
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 761af13a5700d0fb872c6c0e802935fb9862dfe9e0d9592b8c79e9501b150943
MD5 c8be2df78c2e8908ccc3b2438f62cedb
SHA1 1ca9fbfe48e625b587dfc1f4a0e9afa3235a334a
SHA512 e9632b3949e1d8121d9cee56d31831b8fd837f85b55a9fcd3c53a68aba5c4b93d75330566d9fc51d2f3885562c945fd1c3547373472cc3b41551639e78907a40
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 354B
SHA256 c1e031961e50c0bdad2f81b14e66f4de3418e9a504a07e27da9b9bf85a9ababc
MD5 6ff22cfe6c950a2e1df3f75934e8c02b
SHA1 fe278ebe6c5b36ddaf43b0acb5d46be8a29a23e6
SHA512 375694ff6ca44a58fca96b16c3492b4bbf25d122c9f963abc76d2cd16ccfcb3b8563f25753c214ebef203ba44659c985b384830570b4a219748473135fb0100d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 81a2938270ac072e06fc4aa11657c4834f46f98215238ef81447ab4e86ec2bf0
MD5 0a91fadb4c916df4dd0a0631aca49d3b
SHA1 7d4129ad6c94feb4ba3a56a99f68df4897fa357d
SHA512 997fd62b7a3af2cb1af665120b414611325f0cf8a96c54b519b7e19d382a5d7fab89fdaddf1a411c00ace820fa71913674b873211e5bd9a0a162a7b2bca9b292
SSDEEP 96:3bUgquXQX1TNudkJ5n8iZRy7Dx+6MSmuepBOzKLb2MEVMup:3/qCQbzJp8syh+F5TPPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe5774f1.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe5774f1.TMP
Size 2KB
SHA256 b9d8f68c1f5aeadb1748f8efa21c33a4235cca822bfdf19951d296b2f29944f6
MD5 1d0245a0816fd932b1963600bab98460
SHA1 82d188a3a5fd107ed83000e16e41e0d67eed941b
SHA512 febc999100ab08b73d52fa2a08f7c09cf2281c420762d121150da6cecc922372a9591619163881a5d2956cc20a7bd6d1b5017b6f0575b55ca6baeeaa604632f6
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 da1e5103f3afcd2244ca2e7d3cbe54f5cde7622e3e96beb523fd5056d57a21e0
MD5 9626af328fd68cb40ebbf8b0e5c3c2dc
SHA1 1bb0cff4abe529025677e219d00964af314ae463
SHA512 c82d16a519c5b69e314f6378a47fd8d1da5a9c4eee743a43f63888eec0a45f938e74973734ba7bc5ea7929e7b75b6377345381ebb2814de17ad1357b8e3df6f8
SSDEEP 384:Kqod7pLhLcEvh7Xb11kXqKf/pUZNCgVLH2Hf9irrUibHGAc8IW:Kzd7pLhLZJjb11kXqKf/pUZNCgVLH2HA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 263KB
SHA256 48adc0479be255089d290a534198c0b33216db153f546ae50dcf3d56459d8eb5
MD5 c97da1a4db4d0b3450d69047f90c977b
SHA1 435c2f2cfa2853c25033638da9299a737bb1d481
SHA512 daba2be98dacc218384eda7ac02354a6adf751f83a1a87daf49eb579918bb26ea7bc44188a28d3faa65cbf527be01dc6b033bc48a421f1316baa5fd52e96d56a
SSDEEP 3072:Vv+JSSB8EYIq1P2jxX5rIvEZmz5q1ScEqETt1D72NoTWLwnz4F9teZuyz1nUI3SQ:NG8t2jQMcAPNmKvF9te35nfC5mgMatpW
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 7KB
SHA256 aa7dde23f3270b47449bcf3347d84981d50ed04e3ab6e9b28a17f695f3f92762
MD5 ccbace3b204f38bd1e080428c9c4c46e
SHA1 fbd1e6be520199f1a8141ff3948779c24b70f5ce
SHA512 89150312de2c4db21b135bda0e18408ca8d056308022b0655da43dc55c83cc5f7f1673738f8fd5d53b27d7a2382af553eded081f80a27b14f8301fa54886e870
SSDEEP 96:hOevOJb8A+hDjgFWbwK3erK38DucbE49vwFWrwK20K2luyEmFxKh:4VFzdrBD3IhFrKBxO
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 8KB
SHA256 2d0fa3eb064ed1e837192d821860e2aad779a99898208881cfb57d39c8338d6a
MD5 3f09058df297c3aaae3314a0dd5b066e
SHA1 33b6798972d65fdb8bbedf91bedcb4ab5a5b8a33
SHA512 a2399952bc420a618a381f4db69cac803b6842f420546a3b2c98584beab814f087ba65edc2bdc20ffb01cddedef88724fec722047698d9205f0431a815d239b3
SSDEEP 96:hOevOJb8A+hDjgFWbwK3erK38DucbE49vwFWrwK20K2luyEmFxKtv4ZKDwK3NK3L:4VFzdrBD3IhFrKBx/ZbU0
MD5 SHA1 SHA512 SSDEEP

Submit Download

b1d7a51be703f493.bin

Path C:\Users\Admin\AppData\Roaming\b1d7a51be703f493.bin
Size 12KB
SHA256 309fee7108131b56c9408ac5ae0f6650fadcff6bb50f4add58ac9847fcb817d0
MD5 c92e3ef4b2e298ca9d488ffdf26dac6b
SHA1 ebb6af648a38092417019f3f33a4236171d0cbcf
SHA512 c0109cc8e84a1a0804929c4155f9876145a084a45447d8da72f71431636e3fe53f5483520c3bbe999cd409cd93e942fa6fe09dcd063b28f815d157e2e9f9a6f8
SSDEEP 192:GW2vbSSLTe8mFTRUsgzigt6ZvUMQRaikAB4D/40gXDWfdOknG:QvbSSPmJRPgt62RaiLbbXy41
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 9142d4faf4189e7079e526217a42faf08d6becee17109859047c9f30958c7b58
MD5 3e0490f5a90e486d57c2646f619ee967
SHA1 388fda470e947896995fbaf6e157322d6248b869
SHA512 ace4a7137c4be961b1be4118ac34a00fcc4211b73d830367cf4246b68932afeaeaaf2375cc7d962d984832ccd9c1bc6a6d1c2d6a68f5a4a300a6ff897d9f20b6
SSDEEP 12288:YIMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:YBSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 2ff8652027cc0547da4d53075df3fbfbd531460fbad7fb443a15ae4bbedec1d0
MD5 4962a73ca37928f8f452f7d7ea6cb205
SHA1 b7c13da9a993ade2aecf93ca7cf03ff285abd5a9
SHA512 57a1648a8ae245acbab2dae5a949f22d63a470ab397e0c1da5444da7f20b2c066a1f1f856b7cf67d11936aebaffa9525243d09c9442fccd3698bdae871780daa
SSDEEP 49152:Da0h2GEkuAe73q3pp46zwwQikQ/qoLEw:Da0hNYG4Jw/qo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.2MB
SHA256 abc35265848a1b2d8c223111b659b21ddeeb4519bd168fe2b239e9a3639cd508
MD5 d192bfb765342a7835faf47caf6cb331
SHA1 1a804e2ffa1039386d0ff83789103c4bce689060
SHA512 1ffc00892c279b7594f4f1359e2319a331a9ce495ef9ce72b9b5318ccb787a98d9ee7966682230701e105745a372884759a323af657dba835042fc321490c4f9
SSDEEP 12288:nhbHjfXFMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:nhbHjP2SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 dfd51872bc872fbc19f17e2dc7c768b55a69a23df2e671fdb4b10e00e0034fcd
MD5 587498d7655e872fd36c5478cb7b827b
SHA1 c984be941f10a2210383b1a4e7c0dd15c2352983
SHA512 c3229856de9cc2afbabb96054bcf11d1c4bb87cbecc722f48275d1f97e7987f91af660dc7e65b546a988913222297a733fc58ff68d73f11a94f4ac727db8dd3e
SSDEEP 24576:J3YgnJcRTk4yti+R5dpR/+SkQ/7Gb8NLEbeZ:JIgnaTk46ppR/HkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 66b71b2770bf0e94e21ec3cbe7e640ea356a70ba428c849d0bf1639317aaa9ac
MD5 d14bbd035e854aa699205bc6188b167a
SHA1 47940457a742865292db80d236c76378f2264793
SHA512 b7bb580a2f6d1a45e1c0c222b67a68f07cab585f05e05ee3a35f1b60d5b0c68fdee6b7fd2c51be543ebe3dc73d39e774ad698d841ebc8352b1cbb54c7249cd5f
SSDEEP 12288:YMMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:YdSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 bb28b9a82248d38288af525c6ae9f550f71709e2773c62dba487af84bcdf7d80
MD5 4eec0e96227f59e511ecbc3b84a720df
SHA1 64ecd018719ba1ddbd207dfe36f99a37bf9604c2
SHA512 ab250e42e1d968ed4a650782b57308c376c23d52e816343f80a74e8f8ace085758bb8db7194ab11365b11e090afeb163dde662ae9a0c0a30100a662e2f04c608
SSDEEP 12288:GOb3A4LWOsvAYFTHMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:vTL3UTsSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.2MB
SHA256 f9c912a80ae5ce811a8b0b0203c57dfa7e1165d69e44f7c1696e09e0226f24ba
MD5 ac040eff5907a5f483dc5e408cbb6d14
SHA1 67c6e6d3a54947d2c3e4540785d76880953f2f5a
SHA512 019742fb004eb721ddb7e00e497bf6b2806cf824e7304d545a51f6cd746c47a13acaa683d05ce3561c59764862fbfe6f68e4f5c2d1ccce684c3394b9ab89a1bf
SSDEEP 12288:spFtIOLMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:bOYSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6bb264a07a8c4894d6f1bbf58ebe4f7db70b17cfc483953e79ed8a583e78d314
MD5 cba5e78f1073209bac7dff8219ea5be6
SHA1 4b61af686d9cd83297cae300459410b10fa66bcc
SHA512 94e9b36d1eacb7ec5b9c650ef425c8668eb5418efb65e0318c39215a665eb49bff888b48b16f895c9ff9cdc9ac0cc2547f5ed464d19d5665a494e6b4195e7f47
SSDEEP 24576:l7NM9YmZqmWMUkPjZM48Mv6bEhsxSkQ/7Gb8NLEbeZ:l7cBWMpPjN8DbEh/kQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 ea9d76360efa22911efcc979d9de193da03e088ff7e26af84109b5723ca5b4f8
MD5 d9ddf4b809b4cfcba5ed6a1f136edd1a
SHA1 a1fb3353ec570e27d50e2d97f328d2331e30da18
SHA512 03173f3cffb1a422200927bd94eb3d138800ec95c2bcbbb11c5d87ce5af4dac5b8ce30d6e746a0d046b443ecc4c95efe1f677dbc0642d591b2c8bb63b1030d6e
SSDEEP 24576:TW6BApg2YuyuNDYTabvcRvNYf8km1bSkQ/7Gb8NLEbeZ:TF2YuHNETovcvNYf8kmEkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 5d556b32ab40d7580b3ffd8b012fc76ceb99a41234440f1544f138cce16d2a34
MD5 fb4cc8b6d538d55ccd41356bd6311e60
SHA1 3ad5cd9870405da9504287d8d1f729be46e15c6f
SHA512 76143c1a09697491b446412dd4b6ad8c3aaa01f488c982aa23e069ad4f7b87c1dd1a80079825620b0154f595b00d39601d93346f55bddd895020462f1253c8af
SSDEEP 24576:tAFs06+Omlf3NXEbTo0SkQ/7Gb8NLEbeZ:iFs060lVXuCkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 2418cb00aae86cee00d49481183b2add427d6361106ddb58769ba00bc519f059
MD5 e9034d8fe8bc95819be9d44925431d6b
SHA1 52ea5b8c83f92d45c60cdbf85505eededa175f4e
SHA512 936608e88b3799293fae42a641632018545cafff9691a0565f67b616c3d14065a4c9c77a9e49abdd4ee0aae9f950edc86cf1c866d0480ff7121f57c57eb524d2
SSDEEP 12288:0CJnJ5D3VkrzzxYMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:ZJnJ5D3WH3SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 073db008a9919e461431e5b94c2744ac2c084dd504a96c6fd6bedbf11c414714
MD5 f01dd077f86d4738f74ed23dfd83941e
SHA1 11a7f99f063afbf65e5bb4d13d0833b80abbf29a
SHA512 59875041e1f6232841dc819760c3f4014520ca7cf00d19cf71c587bac6e883806da874bd6c821593040aaf0f900b4196e3067de377f4e51e5895dd3eef0d4903
SSDEEP 24576:yEPohm6/7IIXdwcXrif7qQncjlP65i3Vu+SkQ/7Gb8NLEbeZ:Fo06DIKdwc+eQnSt65aVokQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.2MB
SHA256 a5619bd09d2e2d03ca418fa3f6853a41ec8f8f2c536b0bb56b73b6e17fe76168
MD5 1326490453d25fffceabb4e6ccef350f
SHA1 5efa49eba3ec83ed041ec0838e163464c351d36d
SHA512 c919a6f3d52be56610f542d59e0d86a3b5f0767579e175fc88b796cecc10efb2ddc3d2287481423a57e38093ed46b96294998f5f92109a6fc1cd48679544d619
SSDEEP 12288:fEP3R1aMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:k1PSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 6067e411031c6f89f7d594de3f3643c96586cc25b30b65a8ecaf39d3ab3b7038
MD5 eec4221b2e37714968cccd58546b790f
SHA1 d4175bbdacccead106936928b46fe8c6358741fa
SHA512 a0877b8382714196f86d417796b9d649fa978f478d7fba4bb172849b83ca9f446a0504214e98a121d457038448f53cdbba4ef1b976a3f78c0a660f887b7fde76
SSDEEP 12288:yjkylMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:yIyWSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 65756e282f5b2208fae56792077fdb09ec1d22006f4e006d45a27cbf4d28220e
MD5 49d707af0adf787e3b11500891b95157
SHA1 93f8ca417f2fc4421b93e08f2a5970d6ff7375bb
SHA512 c68128d4ba2458f3dac489ce4a41d2d966af746f48d8689aeb30eec0723497a1bad2e15127248c4342c8f8ace13981b00ea5ecfd63655e3294badbae147789a5
SSDEEP 12288:dKbMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:soSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 d0acf584a1ec3520fa95beacdaba7dc23640945f9e7bc2e18332c81c3216241b
MD5 91140cc497fa734913eccb5d5739a1fc
SHA1 a4aa0e35326d34835b547c1537c63b7e320a2e73
SHA512 0b3e57fdd07bcbd090bcf0c947249f71bb6a5bc83f893c4b22b85f4ac16c98108677a1f1e186fb083af6cc25a662977afbe79411bf7d07bc2aea2826fd6856dd
SSDEEP 12288:yLQZb3C97GYnZMv5zBcKY97MD3QMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:kQ9MxZKdcz97w35SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.3MB
SHA256 719291b6211d09377d2774ed75301b563c1056cd8f7fa834ac0139e924cee4d6
MD5 b4f0748114efa19eca10ed8a6acce051
SHA1 7fd48f063d28baaf001732e4eb52312a66218ba3
SHA512 9f2f7891ebb39b0a92717a5c70a8aa5ad131512ea99a69273d750867ec2d2e5fa0d96073a8f9ef077f4a34ef5f2f24a77375ddbec86014ecc074e261f2e82acf
SSDEEP 12288:UyoKo2tRple9p5MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:UyocvApiSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 4c6b4dec73618cb449e7fa6b1938e55ea682c560b84a26ea578463a643433b53
MD5 e26090dd644fe9f7f0a6b2e8b8e43eee
SHA1 ba08471c394961b776c77f041135a83d4adb5b85
SHA512 c046a8dcf89a10d6c197d57b2cc88ec102233bf991f8257fb7b4e4eea4c2fbc9470838ad8bfa24c7da3428c22d7e148a5330d69b30859bc0373c5e3cefbebbf4
SSDEEP 49152:nWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKrkQ/qoLEw:f0zuNIjqo4w
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Windows\TEMP\Crashpad\settings.dat
Size 40B
SHA256 b918a44d48859b4ed705a9a7a23d4a816a368aa2161ad495a7a6d1c6992b61a0
MD5 dd7a044bb22136e85285d21163fdef66
SHA1 1fcea0d904998de1bdea9cfa654a50c20b3dcc5b
SHA512 67afbad0468b8d5b405186c63a0960f5fcda15b2ab73767c292863e221265758001b2e110a3296f5d2ba1463863d556a535850a65a107344ade40a79c33bf358
MD5 SHA1 SHA512

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5b00a356b6f156bb7150a8bfd155c92215c4192198b792d4e027596147ed7e24
MD5 a21d9a2f6a9fb4b4257ea03b1603a109
SHA1 c93cb9972be26020fec77f7be731ca9aec579674
SHA512 eca120e2d0297f729a0de2cb4353ec1c845553ceedb522efbdd91f6a797f80f384ad11e583a88d2f39704ab8767daa8152a49ef1f9304cc6f5906afc79c2abd2
SSDEEP 24576:z1QT7EcpfxR+N5AWAz3ooiYtjMqbPSkQ/7Gb8NLEbeZ:uTDxR+N5YzTfjM1kQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.4MB
SHA256 c8bd6ad468fdf47b5469b9875779ce95a95f304612530e14f157b248144df2ae
MD5 0086cc0e700b37ca5c84fcbd21de4a13
SHA1 2cfef415ae3330bf1dd0b42cc1f8896e2c67cbee
SHA512 84763e7087241a87dc203f3619f2ac63c3b34660c4b0405514f17e4bb0bf22409b595f6ef1912d367bb39d19b3903db51265d51d520b9d8640c21ab4641f4b46
SSDEEP 12288:U/5T+RdOzMbFFTG+eE+NmSL+lMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:QTMdOz0FFS+YmSL/SkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 36718f9fbf53fb49034e2e9abd9816a93b61c0f19b7e168b75d8b1350f29b7bf
MD5 00d77ccd2504f7bf57d67cbd75527b88
SHA1 f2f89be575619a7ce7317563cd155ba10a19a8d6
SHA512 19302da616b9e90e91c249ad0494d9692eee58f16c17af412b5ed63082420aeb7cbf621007b58ba0a32c694ff40a325038df3146b3324f5cfd094f6e5078c12d
SSDEEP 12288:84NHMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:9sSkQ/7Gb8NLEbeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/324-770-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/324-555-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/1016-397-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1036-398-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1140-619-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/1140-23-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1140-33-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1140-32-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/1460-616-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1460-189-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1524-249-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1988-403-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1988-769-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2140-396-0x0000000140000000-0x000000014012D000-memory.dmp

Download

memory/2456-191-0x0000000140000000-0x0000000140142000-memory.dmp

Download

memory/2516-185-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/3104-400-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3148-187-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/3344-763-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3344-125-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3344-87-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3344-81-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3668-768-0x0000000140000000-0x000000014015D000-memory.dmp

Download

memory/3668-402-0x0000000140000000-0x000000014015D000-memory.dmp

Download

memory/3736-395-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/4124-186-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/4204-399-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4228-611-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/4228-544-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/4352-21-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4352-20-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/4352-554-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/4352-12-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4460-401-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4644-184-0x0000000140000000-0x0000000140150000-memory.dmp

Download

memory/4772-8-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/4772-0-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4772-37-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4772-41-0x0000000140000000-0x0000000140592000-memory.dmp

Download

memory/4772-9-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4788-126-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4788-74-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4788-214-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4788-68-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4804-91-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/4804-103-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/5052-77-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/5052-79-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5052-58-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/5052-64-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/5060-46-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/5060-53-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5060-760-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/5436-568-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5436-590-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5504-771-0x0000000140000000-0x000000014057B000-memory.dmp

Download

memory/5504-570-0x0000000140000000-0x000000014057B000-memory.dmp

Download