81c971c0abeeecb38c673ada4b794f7b4c24a47a38a579fe484fc3c33665044f

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
Size

4.1MB
MD5

407c06b8ca7d849a72befc8bd8389d4a
SHA1

d748d62c8feeba6b7326b7b0b7aeadb5961bda9f
SHA256

81c971c0abeeecb38c673ada4b794f7b4c24a47a38a579fe484fc3c33665044f
SHA512

7d51babe620eaae06999b9db15ef47baa48b319429af1f5ead8b2ab81b181aef84e10770ee0f9c210aa596175339543a90ff1576a07079233616563ffedf9c9d
SSDEEP

49152:R5Viqwo4KxghcyJLBaSbvviqMjfBV+TFZ1bBzP7n1Y8/17MVfw1QSXm+RFvTCr9f:RBfr+TFFqRlw6a+DUf

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3592	alg.exe
4332	DiagnosticsHub.StandardCollector.Service.exe
1984	fxssvc.exe
720	elevation_service.exe
4388	elevation_service.exe
1968	maintenanceservice.exe
2832	msdtc.exe
3268	OSE.EXE
4548	PerceptionSimulationService.exe
992	perfhost.exe
5028	locator.exe
4384	SensorDataService.exe
1084	snmptrap.exe
4984	spectrum.exe
4800	ssh-agent.exe
4660	TieringEngineService.exe
4396	AgentService.exe
2736	vds.exe
3036	vssvc.exe
2892	wbengine.exe
2956	WmiApSrv.exe
5076	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2e95c260c8648821.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\javaws.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000020093953dc9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000be3442953dc9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009d61c7963dc9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000062389933dc9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aed13f953dc9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000021d399933dc9da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000237c0933dc9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd25b9953dc9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
916	msedge.exe
916	msedge.exe
6056	identity_helper.exe
6056	identity_helper.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4576	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
Token: SeAuditPrivilege	1984	fxssvc.exe
Token: SeRestorePrivilege	4660	TieringEngineService.exe
Token: SeManageVolumePrivilege	4660	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4396	AgentService.exe
Token: SeBackupPrivilege	3036	vssvc.exe
Token: SeRestorePrivilege	3036	vssvc.exe
Token: SeAuditPrivilege	3036	vssvc.exe
Token: SeBackupPrivilege	2892	wbengine.exe
Token: SeRestorePrivilege	2892	wbengine.exe
Token: SeSecurityPrivilege	2892	wbengine.exe
Token: 33	5076	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe
Token: SeDebugPrivilege	1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
Token: SeDebugPrivilege	1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
Token: SeDebugPrivilege	1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
Token: SeDebugPrivilege	1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
Token: SeDebugPrivilege	1012	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
Token: SeDebugPrivilege	3592	alg.exe
Token: SeDebugPrivilege	3592	alg.exe
Token: SeDebugPrivilege	3592	alg.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 1012	4576	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe	81
PID 4576 wrote to memory of 1012	4576	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe	81
PID 4576 wrote to memory of 916	4576	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe	83
PID 4576 wrote to memory of 916	4576	2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe	83
PID 916 wrote to memory of 64	916	msedge.exe	84
PID 916 wrote to memory of 64	916	msedge.exe	84
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 808	916	msedge.exe	110
PID 916 wrote to memory of 1584	916	msedge.exe	111
PID 916 wrote to memory of 1584	916	msedge.exe	111
PID 916 wrote to memory of 2448	916	msedge.exe	112
PID 916 wrote to memory of 2448	916	msedge.exe	112
PID 916 wrote to memory of 2448	916	msedge.exe	112
PID 916 wrote to memory of 2448	916	msedge.exe	112
PID 916 wrote to memory of 2448	916	msedge.exe	112
PID 916 wrote to memory of 2448	916	msedge.exe	112
PID 916 wrote to memory of 2448	916	msedge.exe	112
PID 916 wrote to memory of 2448	916	msedge.exe	112
PID 916 wrote to memory of 2448	916	msedge.exe	112
PID 916 wrote to memory of 2448	916	msedge.exe	112
PID 916 wrote to memory of 2448	916	msedge.exe	112
PID 916 wrote to memory of 2448	916	msedge.exe	112
PID 916 wrote to memory of 2448	916	msedge.exe	112
PID 916 wrote to memory of 2448	916	msedge.exe	112
PID 916 wrote to memory of 2448	916	msedge.exe	112
PID 916 wrote to memory of 2448	916	msedge.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Users\Admin\AppData\Local\Temp\2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 --annotation=exe=C:\Users\Admin\AppData\Local\Temp\2024-06-28_407c06b8ca7d849a72befc8bd8389d4a_ryuk.exe --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.73 --initial-client-data=0x28c,0x294,0x298,0x27c,0x29c,0x140315460,0x140315470,0x140315480
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc451246f8,0x7ffc45124708,0x7ffc45124718
    3⤵
    PID:64
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,8012398732937168147,10635367099956367199,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
    3⤵
    PID:808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,8012398732937168147,10635367099956367199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,8012398732937168147,10635367099956367199,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
    3⤵
    PID:2448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8012398732937168147,10635367099956367199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
    3⤵
    PID:3504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8012398732937168147,10635367099956367199,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
    3⤵
    PID:3848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8012398732937168147,10635367099956367199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
    3⤵
    PID:5144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8012398732937168147,10635367099956367199,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4292 /prefetch:1
    3⤵
    PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,8012398732937168147,10635367099956367199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8
    3⤵
    PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    PID:5736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff748365460,0x7ff748365470,0x7ff748365480
      4⤵
      PID:5800
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,8012398732937168147,10635367099956367199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8012398732937168147,10635367099956367199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
    3⤵
    PID:6072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8012398732937168147,10635367099956367199,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
    3⤵
    PID:6080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8012398732937168147,10635367099956367199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
    3⤵
    PID:5720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,8012398732937168147,10635367099956367199,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3556 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5476

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3592

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4332

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3668

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1984

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:720

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4388

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1968

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2832

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3268

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4548

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:992

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5028

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4384

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1084

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4984

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2716

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4660

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4396

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2736

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2892

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2956

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5076
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4544
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:2784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
2.1MB

MD5
2a0717164abf82ebdbc1f1eca93ee426

SHA1
cea253a10856a22c14c8439466acd5ec7b4ce7f5

SHA256
b74b4bb9bce6f33f52a3009688db9d735db6cdf320db31230978c604bd60a7f4

SHA512
ca7135196e0bcb40f0475d6e6f375815988b8f47a7a74898fde2995b0b57662c6a058498ebf2e3f64c1a631109f916f74bbf3dba03511f3856812fb56c266237

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.7MB

MD5
128a3b1b8f8242dd78170b02b0f97207

SHA1
5c647cd33a621b2d6ab37a62e02cf6f332936c20

SHA256
c171c354dd9521d3c8c16a5a62c87a0efcdab18e655962c41c49a124f97e1843

SHA512
3317fa2e3acd2cd79273aeb8f75269e1d84c54a26c5a9f02dea5fad8a9cd454a951e36cfdd2faa037fb9425c2aedcc85f64c88b0fe5259bf4c7d653d14107b2b

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
2.0MB

MD5
cbc3c05b710419efa0399be1d561ab8d

SHA1
3d4251b4df79ff40332e6a0deafd2d5bfda40f4a

SHA256
d79980ce56dfdb68abc3fe52810a4a2f35a95169c1552d0b06b628f09b526de1

SHA512
2348da9101f3421d92cf6d4029666a5ba704dcf1b15d201ad0340f725b25c9e097ee46687e911e075c1ba5b4262ded86cccaffe01c496b4cb96d5de8a2d71a98

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.5MB

MD5
8333f15ad1a632040ee8d104f07c5303

SHA1
a9d900fd1219ffc043c9ac0afcbb261b40cf4e4d

SHA256
10c2e4086c993059a900845e6452d86f9b614b9f20e7a8e85da23fc31f081322

SHA512
acd9b928132771ef89780e9807a8c98bda2c4ff5192f890488696b5def143e9e7c546cc7a7f1aceabfd848742bb4062ccbf994e707b4620e747e7300ab1c5f59

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.2MB

MD5
18bd2f237740753662f3a6349b1c2a53

SHA1
9656f000ca07380eec0453313aa874a49e7b7107

SHA256
4a54abe24c95e29ef62243dc0cbf40349e37e2a64dc80c2ccc8e40a098e16908

SHA512
6f9d01462feea58d9de014e7e4dd7b819aeadb213356a3a7c740fa878327431ef50fd489531156da7282de51b530709873bea4338fb4124c478f92d1bb64844e

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
1.5MB

MD5
4203f0d8dd252841c65183420186e8c8

SHA1
221d8d8c550833dc7d1f1e186b0e19580074fa63

SHA256
0cd9a567aa1115d4a88c8c7f23b8d866e1df5193f166135d0d929fa53c7f0e7f

SHA512
6029dd8878c11d66653985ed5c0a1f5923d56ac8c2bd50b79c3a666e3642617fab61bf74f6e8dccd68f6d47ea4f13feb276169e9a5c6e8195143c6af6e6824b1

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
1.7MB

MD5
2d5ff152e25c11bdc020b9059ebfa681

SHA1
0ba2179ed76b8cf0abc47a8e6a73a39b4dcf2dd6

SHA256
eded7971bafd856903f505263c0a4731823b075aaa1a348f226bc927f9b7a064

SHA512
4ccd7e9e0c7045f31c78020e3ecaa177454fdc7219ef021760b5388c667f5f2b1686fb631fe6fd21169b138da700dda349f3cca6b1991b97454e8f22fab20164

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.6MB

MD5
531d8d42f22e9cbfa53619299fb681a8

SHA1
709e73bcb66ce960df3a3e5acea04a8678f950d9

SHA256
a286ec7372191ff067babf55e5ee22c08aaac87e8021c704bc3a2b89fd5b8df7

SHA512
f142864f053ca55552df5b3fc8e404ed5978e3ff69721bceb8eb5dde0bbad9808618678a570e6353c06991e543c3ad74e9b178a939eb5581211b8dad713520a0

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
1.8MB

MD5
5542caa184d73236bad25d2faac42446

SHA1
d11bf357a200fe609bf85306b547410d78630864

SHA256
d47d1680a5b692e9d490c373c97faa2028dd5b510a512ca001a28b4f96622f9c

SHA512
177165442f2848de7741f086a4504a026f3768b6694bbd73fa76c131e75d0e352f0f60922913e0ab36b88d9b3a005f993e2944cccbb65cd18a7a95911d5325df

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
24.0MB

MD5
3b984b10b90e856ab05bcb588ffa0bce

SHA1
d4c5d1ba6df0b0baab924ea1b7ded414bc2b8eda

SHA256
f6e5ce82262d5d37340c6dcb997a8067eb94200a2fdc1f1972dffe710cf85470

SHA512
aa2a94c1dba2078bbe44651d5119fb1d06e4d136ba7c3b2967528ea704803020b6de8833cc85829b2e3070ebb95fc53499ea899c85d9f7958ce2db1f328a2683

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.7MB

MD5
ff5c7f321c1e73866899f05ee5158c31

SHA1
505ad8916998cbd1f4783b07d4e9f982d2bbd538

SHA256
942f94e57401c347a63f4fa91fa937ecefd6e69d3c4fc7ca0c307257ebee8dd3

SHA512
e3319435b9bbcf98ee7323724d41836f306442c4adafa846acae2ce713059c76c805b6e796228344debbf26d5a0e4ee8f63ef826ba14cdd83a0c08c85885d303

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Filesize
1.1MB

MD5
4ba5ad2d9b1a64560f8411932b0889fa

SHA1
b5a0fec7ac719ad449667862f768ba6fa15f6180

SHA256
2043d8d409f2f2d067e60667358a0f5c09b67645d762c3135326889c8d88fdf5

SHA512
52d99ff3da768f6967f7bf0145360136bb64c9c7207582266d6c9ebbec06c26c4238fff25659e86c3530812bada50d8571c1ebd66517fcf67a5ffb9dc4439a90

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
1.7MB

MD5
36c1c80cc6aa3414e79f62a77e916145

SHA1
764b25a7c91c06167954ec5cef707cc371ccbdcd

SHA256
3e119f1d5012f62c02150434054a149688480982b0a162aa8739eb777aac71fd

SHA512
e5aab4dda86354a111748bff87df364b559efa3cad2c39d531bff8215d2b9fac60821623612e6d440bc5976cc47b05a81437bcb65387749ac438d21f77f6c2e7

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

Filesize
1.5MB

MD5
c6d886859d45110fea48f297bc872e58

SHA1
ae3d4bc38db4ef498769518667c8f7f201541d42

SHA256
01277d2c03183a109a1c74afc12ea0ef41c945ac3bebe21099bea7b2375fc22c

SHA512
b9112a06f2dc4ef7f3faa0594fb838793451de608313040948e1ecbaf0de9b1e2faf37b1a4e3ed7d8ae9e6d2712c81678f37043fbf295a992e8120d32dfa91b4

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

Filesize
5.4MB

MD5
b19350b4c474893c8ff208d6b0d3abdd

SHA1
7e5b1bf393e1a8f8e2005ee5356f338d5814b4bf

SHA256
42338c6b59a93701a757c8dfbd9fb27195134b8509c6e4a586f77be32f473217

SHA512
661c18c3e0311e15c92e0233876f4bfafc70a7d3406f116d859e5ba1ef25558f29fabccfd014268a65f38924be3c28310faa85c6ebd3c7c07505cddbf671a5b7

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

Filesize
5.4MB

MD5
967d99a062a0256bfa304ca2b8d1c49c

SHA1
9ebdcfcf118ae4623fc0b7c3f5f348eabc309a42

SHA256
b97278b38ba300990539b02403e16583075eeeca2329634dce2cce7e6a4d0c4e

SHA512
e080e87466b2d20878bbae20ed865a27e847e00e3ca739eab776b506aa4676053706bf79b3365591c926f20d62780da31eb918b209b0e3294fa01f3f35d8dbf0

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

Filesize
2.0MB

MD5
a23a4d1ae3f4efe1976f736986e23475

SHA1
b62f33004b9af2ab6c7af092bfd4876a435a61f1

SHA256
66b5f3080f4f3d386efcca5c02756ec5217cd4cb2e6e708e14f649ddaa6bf2fe

SHA512
ddb679b00d5d4768ecac33bdb7990d5e621460beacb2a3ae3d619265ddd4a210d3db0ac68bd9c16ce45e6b2338ec52634c507e0a4885a410f1b0b40c41fd3d86

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

Filesize
2.2MB

MD5
aa96d8b82d04ca4f8a84086bf340160f

SHA1
bb5c643ac758e595cc072bee7dee64eedc7fb7f1

SHA256
b3c92065aef472f7331913ed0d6485a797f6e99d5eabb5413b4e4f384f1c8c8b

SHA512
66fb5df8671881ecf9b75eb7345ddc5e93b3dc4d19c9cbf8dc98fe3fbc75c62dd379bfe74c56a7a3b65478cff4d0f4f6c801bdde2498d51e9b14e3ba4e1afb58

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

Filesize
1.8MB

MD5
0db5fde65d974e8627bb70d3dded550a

SHA1
2243df353d1b7a96543375e863857f9a1852ffba

SHA256
e95a283e0ac89b1d081c64f378ead0b922486f6f147731f69faa781eeb17de22

SHA512
112871600edeea35ec967f83c2061797a5b48bb7b08ecd6a84efa71b7bc4d4a7b6fb81a0d3d585e46c9a9801e48e2bf0b5ebb433a10fcb0df7345600db2cd2f5

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
1.7MB

MD5
2420a38b541640561fa597fbc751c47d

SHA1
412faec79c5c15676c79473b4f91be1c1157db31

SHA256
a3370144e6a38c8fa72fdffe7f4b25e09dab9ecdcf9b03e71268331549f1b8f5

SHA512
3adc7d528a67d4179f5c9e3f03c8a4cc8629e81eb88b4fb8b0b988a489fb3ef0064a2335278f6857e8dd87d944b5458fe6217db1b473a6c68eb845a32dfd9d88

Download Submit
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

Filesize
1.5MB

MD5
343b3ee3ae0ff678c4230287e5f9eb2d

SHA1
a6a2dfe5e23c8b3a0e1d4d79ebff570742344d05

SHA256
66eea3e6011dd9eacb0a5b3f60c8c02a2d5c066e5cad66a1f71230e66f3e860b

SHA512
2769f42d016ae2d840270cb669184980469c13e9fddcae1f907b8816fbdbb1bd6782cf23848b1bee9515fad77750d4e1ea78399d442eb88554fe2440b87efab9

Download Submit
C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

Filesize
1.5MB

MD5
ad13776d3b5122fdd567d606694b16b4

SHA1
d1c11de5d8c2706390b1e57e9494278ad0078ede

SHA256
ec2d1335062a1662a4270b13204c6dbda0e788e78fc65c038d4031d26f343870

SHA512
3316ae03abe3a3a740eb0d48e68f2e0c1851d13b7d0064ef6a35bd54530bd03e95c939e4fb93a4f1182f42d8c17ee6349e036947f1ff43b0df498d393b772e79

Download Submit
C:\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
1.5MB

MD5
25f58ad6bc2fc442b06820ce8c84a975

SHA1
ed5c70106135012b8925a50f31d02418f6c15f61

SHA256
108190ecffe4928b98c21a08941bc321889f96a8daf6c9b73eec441210c8d538

SHA512
b8e7e5af3135a8c38429e862fd14121555dc7e21268d63827bb676bdbb774338e21b83527670879c9edb0ee68321833289c744fde09554d0fd381d3e5ba544f7

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
1.6MB

MD5
930ba5553a35a784b2b0ac36ab9e7061

SHA1
a8b1d71697562c93936d74cf54da2dfb63a1d7bd

SHA256
8c4e6b469eeb7a8a3b9cf51dee7599401aeea3685ea8bffeeeddcf3c1f9bed7d

SHA512
97e76752681dc56b850d767799383a221c8d366b58bb889d8330444724270e16c837b34d169b9015066e6d763d994df3901cf9528c85a64874ea5e9768808b1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f2dff87d69de231b8e81da384d81a8b7

SHA1
7abaabdf2b44422c64354bd2a42a0a1d974a2b05

SHA256
f7ba52bb91f1476199bc527ea27bc32e85ad7db08cb46e62adca2d4b6d197088

SHA512
b985fb25ceeea980f9e06ee18ab3fe79dd17e429fbc35138ce3e414f40d62269f4ecd9d0918938b3f0e7d9f04e3e6d2746803bde338a4dff30c9ee7eff5d671c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
2e438445c75b2d46e6f567d3f26f9867

SHA1
07d579d7ca83a20b15e70202af9e3f8316bb9e22

SHA256
cc067586d110c40716434b15528edf435f72cf37014e30c437ee6efdd05ee71a

SHA512
5f0cb5e98c9482bd3b693ad9a30e811ecb057c24fdbcd953484a63cf67bcddc9711a2c3651ab9444e42b304554c7c5ffe308fd577613c5755cac445c5560b48e

Download Submit
C:\Users\Admin\AppData\Local\Temp\msedge_installer.log

Filesize
4KB

MD5
01b4147548bc4ef96759f8232d0e0f0b

SHA1
42f2ecc5e6b276167f8494a6ef5f29300476cb57

SHA256
b56d4c3068cd093e30d45fa74436873bb01ce1957ded40c439f765e9e88a9eaa

SHA512
20ca913807b38a7bb35927b5c72c4191861d69f934343e67772685b3c5642dd200ec0f56d973d5413b636856315cfb91878e36a074fdf326348896853fc468ef

Download Submit
C:\Users\Admin\AppData\Roaming\2e95c260c8648821.bin

Filesize
12KB

MD5
ea860c6db7160b2e1e97c123abcf3912

SHA1
15c73445823324757dabdb0cf9757ec6af23b6b6

SHA256
eb7e14c7706158b73239d3ec5409792f8b71ba5c22c80f46ecc44974cf7a8f5f

SHA512
a17d8cde87664ee63014bb6d941f812b7c9e8f196e504908e6e341b4c38cac0c99fd788030cfc93b85e8eb91adc37f01559457fd3d5184ee2a98cba0b7c0d9eb

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
2d7df11e4b0792ffe4a69f5055f3731b

SHA1
da932952d1331acba8a832b9b9551852dc641afd

SHA256
7264f573fbe159035a720cf6c050494b5335e8ff9f825b063a823fa521aa2ae7

SHA512
61cbb3be9ff3027d6fdc21544577ed27c48d41498f84d7e84bd85b506ed5330cb053821972b24ebbe09d0a43c0b07794c25086936d3a35889e21cc35d920638d

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
1.5MB

MD5
9b4cb01703e37c22346b219723485fba

SHA1
79637f0dee6ec2881383db9da621b72b02b6ea50

SHA256
d9b31b155f492a22aaa7add6aa550b5441a2716f11242db20b236bc2372b93be

SHA512
eb5a2de98e4a26d749a1d7ee99afb1d94fc3cefa6b2e9ab21e6ecf1f489c695beefc9fce12fc6b8fa807c730d3aa9ad11d28de86e99922dff2e500c76ffe667c

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.7MB

MD5
6bae026f44147fc6e14710e871817d11

SHA1
eff5e30ea056f2eba2f4e8af3854c299b92052dc

SHA256
8decae9c9b7aea88062b79970c0aa6d5c2bf5cfee8b2042c993f42e3935357db

SHA512
9a94a094ac5b1fd581a46d469b1d01d5d69d1db15cfca8039ac7d0f915b1b9023186d97f9a22402ad8e4800401ac03e1d1363c1f19f6c66e98f2e0133fb87a25

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
1.5MB

MD5
fb9e7b15733d76c9d80ebe9bf87e6ec4

SHA1
6c18cc4c7aaccfd4ca4c52bd131195d8fa1fe21b

SHA256
4568f488197594f5b91f9a4fbed2da59cc1ec727c57c68f7303948c8fb645abf

SHA512
621089650e574122a1459e82ac9d5cdf84556597fbd284c4c775f5d6c43b637c3729bc81eacf6d3279e02ffd162930146027445b92f2161ff92ca08786e98962

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
efa0aef022108fb68a6b91866bcdc613

SHA1
f8fc26d1db5cad9e5ae2dc454f514def5cd86c67

SHA256
52a519aaa4f7e21f60133fa694cbe048ce7ff14cec8a5e527a61cab0ceb64199

SHA512
3b67290ab5442ae5a661010de2ff9f56a1054a0cc3799efed7718aacebfe77d4af6eeb31a10ddeef4d8b695e59eb34bc186f99b0e549ebd53aff38b9dcf64933

Download Submit
C:\Windows\System32\Locator.exe

Filesize
1.5MB

MD5
35c5a70ce057c23a4a00ff75d762ddcf

SHA1
1e5256adb038ff32818aa4997ae1be4f9e5be783

SHA256
7b709273c67131f40ceb9376ab4c52ba86fa6ca80fa4edc417876e7a761a4ec9

SHA512
39144c4448d8def7f8489ec5b2b53a63a417555a27bb817a497f27599763cdf602e30cfcff28ac649cb519c5db1b29131c6246633f8d54ff5b17d82ac1e79021

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
1.8MB

MD5
2659703aabf378f49613dc3ccc52f4f0

SHA1
ba1a800fe71e3f2e84723c29abbcec1c35211608

SHA256
6674009c8bbf35198c39f108d20151ac8223339f3b5f860667baf97004abdba9

SHA512
b315d85f4a3d9ffbf7de13e7abc69efe78011e20b79c3712644778c6c4c9a540b8e8f5834c80f2018a047542af14d616f8618e70045439da94b78c699cf2a425

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Filesize
1.6MB

MD5
959ce929147df2542fc522bfbaed0ac5

SHA1
2205c201fd6058f5cda24b62da7d76b62d8788b8

SHA256
4f2d952df50bcdf5575778463bc4a86896dfe37171516ee250d5fcd2700c8894

SHA512
e03eca5b92bdfe5460da4a1ab1ffb87a87808ac72353f9c20589b10890fcab7068b46c7f3c83f4370f51f4395d3add68c9f51f7a2fe9d340f34a792fbe7b3c56

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.4MB

MD5
5d950b5cafa026371303f50c2321bfb0

SHA1
8536a92076f1077dd70799cd33af9a89b4f21772

SHA256
1769df1acc51a4252d21df92fb673c5da369ad9605a48218233002b914d12519

SHA512
01e6cc317be73e479843039b6d00e87dc3b15810459c5f7561685a1090c31df14f816d6152781c3a17ce2a747093b69c52e4c9f36b64ca6eebe9c459c4a79928

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
cb64b4ade2a9e0e1bb17026af3baec77

SHA1
f29a9136d64938c25094eaa17f58d82bc30e8953

SHA256
f6ce48e3b160b4f08a894d158a516162435b1c0c97aa025bd42ab03d2f1fcede

SHA512
54c4608d808188bde653588e04c6581b704fb234831bab97a4d8beccf797aa8bbbaa910c47eeb8bf463b27b750826e93a0044821e6a6aef01092873371b3cde2

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
1.4MB

MD5
6e74604181ddca4534fb80880ded1853

SHA1
7772423bfe03fc57284fa1e4055cd8736bb253c1

SHA256
1f8c79ae3faa3fbef7cdde44505af3905f9e499aaf1da55028f7eb073993b284

SHA512
7c7243c91edff07b05e316cb01c6c1bc8ae5fdf1c7407728d2b51e55e5103ab65818c22b62e59d24c2532275bbb74c92458ecb1d5dcdcaa5840962b92a612fd5

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
1.8MB

MD5
5b628f9d915b8ed58463dce70d1d3a2f

SHA1
630b8052a65037dbb455e9d6cd6d297aaae4af8c

SHA256
bf1c0ce64fe843d895203be60596dd2c4354bc467c751a2c58d46470f047b507

SHA512
829371c93440570715440de055d58fd31f56d915d456a2979fc4a552bae6f60d4a643ba8b46ea8837a4d8f764de292fc28eacefc79af50dcd55087d909d55f0a

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.0MB

MD5
a60f943193fed62c679ccb0442fe91ac

SHA1
6dd855147ee197d5029a6a33ea6e13b983710cf1

SHA256
50f908ac42f1289dee7f1469467660a759e036943a7039bc72bd51baca6c2551

SHA512
1109d1d03c5b756f42f1593d5247534dfeba37fe49658fbbe20420d5a701bc490dfb69806beb8cc444250d55c433c176c8ee543c55669a2ed836edabfbacc8df

Download Submit
C:\Windows\System32\alg.exe

Filesize
1.5MB

MD5
727e68199aa1ca7e1beecef8a1b035a4

SHA1
237765b63647e0421d2d7d0e42f6ed34fda8379e

SHA256
704f64b0d2dcdd88cfbd7c77209223c208d265a537803b2f7168e3f096817429

SHA512
d5b3caf5cf7f548cff70d25090f0b9a28e96e8280e8a2ac5f888575ed8cd98f6a990b966d77798e4f60de6735aa54378b5777d343f47fc0c85b04443b7be7a9a

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
1.6MB

MD5
de15dfa1f18098f1dbed872e2bc18f0c

SHA1
accad96dd2af04f270f1d505cd73b02a38654b89

SHA256
6f709c401e60953ae7fde7a77dd88b8aee00ffe38168292d7eb53efc58fb8b92

SHA512
8c8f211b56bfb3ec579ffae7af7b4d389ed4b80a8a0d9c1b1ee3ae2fdba159f44082d64de06fd3b5f039053f9c1f6e961f708c9d8aed28b9779944358db9dd75

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
1.5MB

MD5
9b90eb12364bb881a997c1ac0577778f

SHA1
5b11dc19b9aa55610ff166009e1b2718083b2984

SHA256
78ee78c0443c852d664aa272c8edd41bfaa1a686e53fff8df55f1c8ba09f949e

SHA512
43790d947b374dd2ea465e8d7a32045a8b969d6b512d5d1d1205e17e2fa81e47deb594fd55e0b549d550d9f0950bdbe55fa4a3253f1dc79f18d6de5dac69be66

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.3MB

MD5
231b2db0017216c5771d7eb5cdc72e06

SHA1
ef48804c743245517499f76f914f6f8f42e6a54d

SHA256
183d2f4eb6447f857d4ad092dd52c63c5061e68d4d7c9a4bb02a3005e898f453

SHA512
936fa3bcb01a869b63fc20074059fc3084069093a646ce2a449ab274fbc4acfdcf83ff0011f38c26bdfbddd403b2b715fa7d40a5e90b5da32c027dcfc7670d64

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
1.7MB

MD5
050bde71f8787057ddc66bf2fbcec9e1

SHA1
af4046cba6192fd75dc7d5be9ad2d25d2a829232

SHA256
7f3e98f40b7e24e4da22a9ee5d7b6692879b2b00aeb01f2a97e97bca43abd0e4

SHA512
faa52daf1ca2c86441e90fc8a3aea2b26b05b8307a656d2d76f650933774b623112a24d0056f14ea0176416184d70c196591f2ccdce351c18cc8b2625ecc48f4

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.1MB

MD5
b1bf66a94906406d742ff1796a3cfbf9

SHA1
a9f3928665b5a149234da54de82e22f294f6fd8d

SHA256
3c630a819e0e02bd7152dd765224423b39720ea57f39e8befddb4bb18353c20d

SHA512
fc9bbd53dbaf4a6f9d3ee5a20786d9d00f45965e0c8710288dbb10ab166c0dae1ca78f014f17ab45326369b0465023ad34dba26ea820b2e7ce03b360f03050bf

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.3MB

MD5
28c95799351fc4c105ddaae6c5432f18

SHA1
8d5ae107f8874ea7196e7e494ac588aefdfa50f8

SHA256
ba63eb694693f189dfd173b722a6c2fcacdb6fba3230d5c19c181230df21cb37

SHA512
73e4c1edf22df57b2ebf76670dab2d5d610cfac09e9f1ac806039c5b669c2382dae32b8a384e9ab92b22e5f6800e8298fa19f4f011d54c0ed07ae3ee78068263

Download Submit
C:\Windows\system32\SgrmBroker.exe

Filesize
1.8MB

MD5
234a54207ea4e3da93bfa618ec99b919

SHA1
55444474e04de8478a52fd84c4374a2fd5940fe2

SHA256
90acd96dcfe34a7a06412bfcac777dc47fde4b7bdad935d98bc33211f11aff59

SHA512
44e85f11efa52e746aeb7edac41d8d184f2aa200423cbcb0b99d4940db8618f7c2a8888a7e28ee0b7cebd1541c61e4c28c53b34c032ca47c4ab3366ae0cc8378

Download Submit
C:\Windows\system32\msiexec.exe

Filesize
1.5MB

MD5
191e8d98064f66af519f956565cbec59

SHA1
d08056e281af72fbece3e8cd2d73480e34fc638c

SHA256
db51afbdcf6cd3a7f39d143448ee2a0ae3c60aa0ab276fe7af5f271188efbb48

SHA512
55a69dbc277088173d5f616628d0799f79d3972252fa25d19b7dcc2ce66d47455a8eb061bf7f8280abb57283d160c6b869354b948c3f45b39e66736ccc73612f

Download Submit
memory/720-103-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/720-703-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/720-71-0x0000000000540000-0x00000000005A0000-memory.dmp

Filesize
384KB

Download
memory/720-77-0x0000000000540000-0x00000000005A0000-memory.dmp

Filesize
384KB

Download
memory/992-347-0x0000000000400000-0x000000000057E000-memory.dmp

Filesize
1.5MB

Download
memory/1012-16-0x0000000000890000-0x00000000008F0000-memory.dmp

Filesize
384KB

Download
memory/1012-695-0x0000000140000000-0x0000000140431000-memory.dmp

Filesize
4.2MB

Download
memory/1012-10-0x0000000000890000-0x00000000008F0000-memory.dmp

Filesize
384KB

Download
memory/1012-21-0x0000000140000000-0x0000000140431000-memory.dmp

Filesize
4.2MB

Download
memory/1084-354-0x0000000140000000-0x000000014017D000-memory.dmp

Filesize
1.5MB

Download
memory/1968-94-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Filesize
384KB

Download
memory/1968-109-0x0000000140000000-0x00000001401B6000-memory.dmp

Filesize
1.7MB

Download
memory/1968-106-0x0000000140000000-0x00000001401B6000-memory.dmp

Filesize
1.7MB

Download
memory/1984-80-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Filesize
384KB

Download
memory/1984-61-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Filesize
384KB

Download
memory/1984-64-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/1984-82-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/1984-55-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Filesize
384KB

Download
memory/2736-360-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/2832-344-0x0000000140000000-0x00000001401A0000-memory.dmp

Filesize
1.6MB

Download
memory/2892-372-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/2956-373-0x0000000140000000-0x00000001401AD000-memory.dmp

Filesize
1.7MB

Download
memory/2956-716-0x0000000140000000-0x00000001401AD000-memory.dmp

Filesize
1.7MB

Download
memory/3036-364-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/3268-345-0x0000000140000000-0x00000001401B6000-memory.dmp

Filesize
1.7MB

Download
memory/3592-35-0x0000000000710000-0x0000000000770000-memory.dmp

Filesize
384KB

Download
memory/3592-33-0x0000000140000000-0x0000000140191000-memory.dmp

Filesize
1.6MB

Download
memory/3592-22-0x0000000000710000-0x0000000000770000-memory.dmp

Filesize
384KB

Download
memory/3592-698-0x0000000140000000-0x0000000140191000-memory.dmp

Filesize
1.6MB

Download
memory/4332-52-0x0000000140000000-0x0000000140190000-memory.dmp

Filesize
1.6MB

Download
memory/4332-50-0x00000000006B0000-0x0000000000710000-memory.dmp

Filesize
384KB

Download
memory/4332-44-0x00000000006B0000-0x0000000000710000-memory.dmp

Filesize
384KB

Download
memory/4384-353-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4384-568-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4388-102-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/4388-90-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/4388-702-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/4388-84-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/4396-220-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/4548-346-0x0000000140000000-0x0000000140192000-memory.dmp

Filesize
1.6MB

Download
memory/4576-1-0x0000000000990000-0x00000000009F0000-memory.dmp

Filesize
384KB

Download
memory/4576-6-0x0000000000990000-0x00000000009F0000-memory.dmp

Filesize
384KB

Download
memory/4576-18-0x0000000140000000-0x0000000140431000-memory.dmp

Filesize
4.2MB

Download
memory/4576-612-0x0000000140000000-0x0000000140431000-memory.dmp

Filesize
4.2MB

Download
memory/4576-36-0x0000000000990000-0x00000000009F0000-memory.dmp

Filesize
384KB

Download
memory/4660-359-0x0000000140000000-0x00000001401C9000-memory.dmp

Filesize
1.8MB

Download
memory/4800-358-0x0000000140000000-0x00000001401E9000-memory.dmp

Filesize
1.9MB

Download
memory/4984-357-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/5028-350-0x0000000140000000-0x000000014017C000-memory.dmp

Filesize
1.5MB

Download
memory/5076-380-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/5076-717-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download