Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
07/04/2024, 18:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe
Resource
win7-20240215-en
windows7-x64
0 signatures
150 seconds
General
- Target 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe
- Size 5.5MB
- Sample240407-xcfamsbc4w
- SHA256 c65a0c0b98b12d5aaeda7bb06a4bdeade34900a10469bc9025b35c08f0b452ab
- MD5 24e08261df0ea101096859bc6d85cacd
- SHA1 3bcc82194864f6601c3ebf7db400837249445628
- SHA512 d5766bc3a849c9571e69e20ba77987aaab7bf56a7d37e0b432109135552f588a58d765251b8da26b71fa869e577fcbf9dbe3bcd2b2081c89624dd885c8f1cae0
- SSDEEP 49152:bEFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1Ln9tJEUxDG0BYYrLA50IHLGfx:HAI5pAdVJn9tbnR1VgBVmnPHn3
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 3244 alg.exe 4924 DiagnosticsHub.StandardCollector.Service.exe 1400 fxssvc.exe 452 elevation_service.exe 5012 elevation_service.exe 4152 maintenanceservice.exe 3460 msdtc.exe 3640 OSE.EXE 2712 PerceptionSimulationService.exe 2024 perfhost.exe 5072 locator.exe 4428 SensorDataService.exe 3120 snmptrap.exe 1704 spectrum.exe 848 ssh-agent.exe 5184 TieringEngineService.exe 5324 AgentService.exe 5420 vds.exe 5524 vssvc.exe 5648 wbengine.exe 5744 WmiApSrv.exe 5888 SearchIndexer.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Windows\System32\msdtc.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Windows\system32\spectrum.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Windows\system32\AgentService.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Windows\System32\alg.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\84490fa512d07ad8.bin alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Windows\system32\vssvc.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Windows\system32\locator.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Windows\System32\vds.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Windows\system32\wbengine.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Windows\System32\snmptrap.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91140\java.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe alg.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e8795621b89da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002b1461621b89da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000315002641b89da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001fc4af621b89da01 SearchProtocolHost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e9eab6621b89da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000137f6e631b89da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005cd965621b89da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009ab3e5631b89da01 SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 4020 chrome.exe 4020 chrome.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 4836 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 3032 chrome.exe 3032 chrome.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 664 Process not Found 664 Process not Found - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3136 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe Token: SeAuditPrivilege 1400 fxssvc.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeRestorePrivilege 5184 TieringEngineService.exe Token: SeManageVolumePrivilege 5184 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 5324 AgentService.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeBackupPrivilege 5524 vssvc.exe Token: SeRestorePrivilege 5524 vssvc.exe Token: SeAuditPrivilege 5524 vssvc.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeBackupPrivilege 5648 wbengine.exe Token: SeRestorePrivilege 5648 wbengine.exe Token: SeSecurityPrivilege 5648 wbengine.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: 33 5888 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 5888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5888 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5888 SearchIndexer.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe Token: SeCreatePagefilePrivilege 4020 chrome.exe Token: SeShutdownPrivilege 4020 chrome.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4020 chrome.exe 4020 chrome.exe 4020 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3136 wrote to memory of 4836 3136 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 85 PID 3136 wrote to memory of 4836 3136 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 85 PID 3136 wrote to memory of 4020 3136 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 87 PID 3136 wrote to memory of 4020 3136 2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe 87 PID 4020 wrote to memory of 400 4020 chrome.exe 88 PID 4020 wrote to memory of 400 4020 chrome.exe 88 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 4516 4020 chrome.exe 94 PID 4020 wrote to memory of 516 4020 chrome.exe 95 PID 4020 wrote to memory of 516 4020 chrome.exe 95 PID 4020 wrote to memory of 5040 4020 chrome.exe 96 PID 4020 wrote to memory of 5040 4020 chrome.exe 96 PID 4020 wrote to memory of 5040 4020 chrome.exe 96 PID 4020 wrote to memory of 5040 4020 chrome.exe 96 PID 4020 wrote to memory of 5040 4020 chrome.exe 96 PID 4020 wrote to memory of 5040 4020 chrome.exe 96 PID 4020 wrote to memory of 5040 4020 chrome.exe 96 PID 4020 wrote to memory of 5040 4020 chrome.exe 96 PID 4020 wrote to memory of 5040 4020 chrome.exe 96 PID 4020 wrote to memory of 5040 4020 chrome.exe 96 PID 4020 wrote to memory of 5040 4020 chrome.exe 96 PID 4020 wrote to memory of 5040 4020 chrome.exe 96 PID 4020 wrote to memory of 5040 4020 chrome.exe 96 PID 4020 wrote to memory of 5040 4020 chrome.exe 96 PID 4020 wrote to memory of 5040 4020 chrome.exe 96 PID 4020 wrote to memory of 5040 4020 chrome.exe 96 PID 4020 wrote to memory of 5040 4020 chrome.exe 96 PID 4020 wrote to memory of 5040 4020 chrome.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exeC:\Users\Admin\AppData\Local\Temp\2024-04-07_24e08261df0ea101096859bc6d85cacd_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2f0,0x2f4,0x300,0x2fc,0x304,0x140462458,0x140462468,0x1404624782⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff88be09758,0x7ff88be09768,0x7ff88be097783⤵PID:400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1788,i,12966543941699728342,15235901709348521140,131072 /prefetch:23⤵PID:4516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1788,i,12966543941699728342,15235901709348521140,131072 /prefetch:83⤵PID:516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2196 --field-trial-handle=1788,i,12966543941699728342,15235901709348521140,131072 /prefetch:83⤵PID:5040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1788,i,12966543941699728342,15235901709348521140,131072 /prefetch:13⤵PID:4416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=1788,i,12966543941699728342,15235901709348521140,131072 /prefetch:13⤵PID:1568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4176 --field-trial-handle=1788,i,12966543941699728342,15235901709348521140,131072 /prefetch:13⤵PID:4032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4032 --field-trial-handle=1788,i,12966543941699728342,15235901709348521140,131072 /prefetch:83⤵PID:4004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3996 --field-trial-handle=1788,i,12966543941699728342,15235901709348521140,131072 /prefetch:83⤵PID:2700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 --field-trial-handle=1788,i,12966543941699728342,15235901709348521140,131072 /prefetch:83⤵PID:3988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5216 --field-trial-handle=1788,i,12966543941699728342,15235901709348521140,131072 /prefetch:83⤵PID:844
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings3⤵PID:4448
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff7a4d07688,0x7ff7a4d07698,0x7ff7a4d076a84⤵PID:4464
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=04⤵PID:3128
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff7a4d07688,0x7ff7a4d07698,0x7ff7a4d076a85⤵PID:4244
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 --field-trial-handle=1788,i,12966543941699728342,15235901709348521140,131072 /prefetch:83⤵PID:4004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2716 --field-trial-handle=1788,i,12966543941699728342,15235901709348521140,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:3032
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3244
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:4924
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2472
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1400
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:452
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5012
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4152
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3460
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3640
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2712
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:2024
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:5072
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4428
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3120
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1704
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:848
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:2272
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5184
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5324
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:5420
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5524
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5648
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:5744
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5888 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5436
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:5944
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
- Size 2.1MB
- SHA256 937f19306656651ca873dd4f7985ff042fb036921aff7296b352abab82811cdd
- MD5 2605ea6ee1aab2910dbbd7593eb0b784
- SHA1 477843586c8edf02a74b99d1bdd602a1a69a096e
- SHA512 e2b1313b41ab478ba97c326adf078cb4523b6d56ed7814b9e985d4077ed0371e3f201ddd8ec69205a2b65b6234d4cae67cc724ecfa5ce8b1fde1e60a3b04164b
- SSDEEP 49152:BuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z53P4suIRbDv:BPfTqi90bbPHn3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 781KB
- SHA256 a641095118451d38bdacd34503c5ec6ced7f5a2d3292e5175beeb9692b4b5434
- MD5 a91d59ba19e4e02d040ae0187a689178
- SHA1 43262bd485b63235971c18c31aab3278da9c6440
- SHA512 8d68603b69405ad888fc617e7e00e43a93ecc082e20da9684dcb86e0587647640063c0d37e507247bec692b7588d595fec21939f7c51adf2f43bffa20ef438a7
- SSDEEP 12288:iC0P9Q/Jcui23Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:+PsJcui2Hofe3y1sInB2COzRq8DvFqt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 a90d649883c144d26497e1566e55211e62e4a18a31b27074dc1e6f41cf7b1b63
- MD5 2cdff6b5086b9393b44e6010db801489
- SHA1 5e4b157e75f260fa82261b5c2801b51ca9e15c61
- SHA512 0d5bd5e160cd7afbd751826d2c9e04b7b836a21279347800dd3376ec0b623bb2f4894092efe7606ca5624f1e3a53c5f10b17c81cfa04d22ee70cdc113696dd81
- SSDEEP 24576:T+gkEVfh4CoKHofe3y1sInB2COzRq8DvFqt:qgkExSWP4suIRbDv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 e4d32a900fa348f31786529faae06ae446f702e22171b7e716d22786af6795f9
- MD5 cdabbecda08b2161eb7e518534fcaf6f
- SHA1 bfaa0b052086b85e08a306351dfa02f34358c824
- SHA512 f34ea741232a3826bbe91d49c4aadf105747562d02e1b92eaf9ccc6fb4883783edf70ba90a8f6ee990dec8ad53951b7e741c2c4b9defcb57431886492c59c52d
- SSDEEP 24576:KBpDRmi78gkPXlyo0GxjrbHofe3y1sInB2COzRq8DvFqt:ONRmi78gkPX4o0GxjXP4suIRbDv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 b59d2da1c4de7c43b4895d6d7b10c5bc4a115bea7c675bc3c3cae96c92f3f137
- MD5 9b221acc8fc751ccd1157bfba0fef033
- SHA1 d6581a34ec5cab222a1a7199f1eb1bd2251c5a13
- SHA512 95ac1e5791e6b787f3b7cbf5d84fa5ba0696a1b7fb32e29e49f6a030fa85670a56fafbc6034d2bf391b6f3c7f30874aa2acce30f0db588f604b3ff50ace790e5
- SSDEEP 24576:PLOS2oyPIXVKHofe3y1sInB2COzRq8DvFqt:p/yPP4suIRbDv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 87ee1cbd7f4c377c39709aa642a3c7c88e0e819964c3473eb3f63960d0eb61f6
- MD5 5209316f52946a8f2585c386d5124db0
- SHA1 5f9949f0bc88fb84d3a07af127e9418c7f8b9d82
- SHA512 45f18cefcdd470150a3d4d7f5e983fb040995f52ef1f9746ef1fb3654af43841a86d390633cf463476507d636dee7da7654c7466ab8964e0d3f037f6eaa630af
- SSDEEP 12288:ZfI3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:ZfIHofe3y1sInB2COzRq8DvFqt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 a857b3ba8932d1caf13b8a32e4511c319e91e43b10e4fdecf5b207e88d4b5b7e
- MD5 bfea0f691e5e36dd9636c5fdc625417f
- SHA1 431a5775671cbc97738757021f2ee339dabe51d4
- SHA512 ac3b254ca7eaa78e4166b369dacee6f94bb7cb6724027fc51200e24c0eaf6cae78f835ef1b7e18038fc26e28950f40d3d001b306747ce002a15b80f4bfb5ea1a
- SSDEEP 12288:2eBNUbTVO86U53Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:2JIU5Hofe3y1sInB2COzRq8DvFqt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 28cccc245d407c88f753a751f168d83ab1cd1ba6549612274d4a04a74a40c79c
- MD5 873fb7127b6f25643844a7d24193d571
- SHA1 82a99a0d236f25883ecf9235a98f66f86d4d1244
- SHA512 fe4cc560b2f3a7f2554c89a789e8f3a7951941faeeaa7a49a33505412f19887eeeacf067a9299b20bbaeca1b05125dc555ace12c799eddbf87818d3c650abd6c
- SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH1:HQvGAdlCEL8c/yRNw5CgPHn3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 5e3360328fd0df75f291e2a64abb1e76ba4f799379ccb430fd80f0cc1f287422
- MD5 8c4d86fd626e9751de157a984cb12c11
- SHA1 b728096df18280e591aea9dd0777b6d9913a798b
- SHA512 9f3dabacd20b5131a2cf45f1ae5c4168ddd439d6fdd65e27607ea7eee10c882157febd00e151535c873c9cf1f550c141d671ae2b9ec55cc80185437a7c016e6c
- SSDEEP 12288:sAwSfxL/2Dc34DLLmt0LDQewsAjj3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvU:RdewsAjjHofe3y1sInB2COzRq8DvFqt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 227d714c4d9207c064b7e77466bf6957413fd7d6ad24a6ecb4f4118fce52bbf2
- MD5 95d1d850bd84e5f33bd30276a9ad085b
- SHA1 240a2c26f91c270cb98810040695e571cd82d082
- SHA512 cb71465fd651ba5a10e83e4ce166a1d6e8b8ec30cbf3ba4803e20b9404305339dc6d46d1bd532f0d2132d015debf0c1f8294c7fdb8129d0126f34b93a7ecc57d
- SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHTP:XUEtQevvqc2W1cpV2EI32T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 388a14e0477f1b4626bd8079b036bbc6f1cc508d9020ecf9b451a083cd4422d9
- MD5 4305273f03531a58f57f609ecf596b58
- SHA1 7064786838a0d365b08ff41bf7f8023b847df12e
- SHA512 8d0e96dfdfaf75dfc8788bc685cc2b456e6bcf6f22335a14b1f6751c7162e02d76f84e2b87d072d7bc12a134467d33f46ef73c939d04274e122f8b4ef6e1b1c7
- SSDEEP 49152:ICbRquA/m2yL5zTfFiV+XenmE3/z7P4suIRbDv:hoquVjnmEPHn3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 6547a14bb71b849aec12302eb2e33704e279f93890923cf411dbb63af521ae1c
- MD5 e56f5b5f37040204c9aa0a2712d8de0c
- SHA1 6170cdd4c009dbbcaf341a4e6852c45aab193a0a
- SHA512 baa499418a0da061ff8a5d7ce69aad880715df1987c2c191629e4c6a10b24a5970167cea6c8345549c60acaf695d0f423c7dc9c3196ba54d9b7ff5578da3d5ec
- SSDEEP 24576:6AhGLJIFoiwtA5l7S536Hofe3y1sInB2COzRq8DvFqt:6AMyFoiq50P4suIRbDv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 43434bd82a99f0b1370981bd27460a9d587c6a91981c33181275a603bf5b9fb7
- MD5 87f32cb9f65bf326c45b2fd2fb65938d
- SHA1 2a0d896f4428ee93abb82a24efbb185b777c1071
- SHA512 3fba1f73c7679ba5a03ae57b6c7d60a1c7c4a9327ef6a7021217d16f319c63102876c08367944a137369da930971075d56b398235ca161cac7ae6c0ad940c7d3
- SSDEEP 12288:zmw5HEjsChNVBFgl0WDm+C+3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbu:SwuoOWfHofe3y1sInB2COzRq8DvFqt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 df19fb72d2694914349c4ac4b70d12e27d4c51ec410be5d57349d4eec04a478a
- MD5 84fdf77d68baf49db4e53e5003085208
- SHA1 bcd7ecdf6a856ab3dd8e94787ef18a274f304337
- SHA512 c6f19c1ae3f72bf13b1a0232cb2c1593ee2d056eac5bdebbcc7b945147d9450468ddfbc438fc8ce35eff1874ec5e0e8306ef9d7fa2a4c310dc8fa7cc1d9786b7
- SSDEEP 12288:sBZ1Iyz3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:6ZusHofe3y1sInB2COzRq8DvFqt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
- Size 2.2MB
- SHA256 2a412a96b9d05e12fa6b720f4598a966b77b7804dfbf4a4053f7ecefc96db0db
- MD5 beed1d224a93c4ccd1a573bdea8e2c9e
- SHA1 572d0e3fe3968316f69bba5e0c47611400c7a622
- SHA512 875fdbc6d9f4b76b13acebb76a0f14d5893512c091a6f81c63b658ebdeff5d794657a7549a8d2c89e3eccd83e8039a239b46892807e7cbec61a9a5f5d5f0b8b3
- SSDEEP 49152:7fzabJ8llj+SWWi2mkx+X+dikP4suIRbDv:gui2BPHn3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
- Size 2.1MB
- SHA256 1c7e11be6158e13d33937970f68418af32ba1bfbe6b7a6a042824f21f45991e2
- MD5 5b9b1ee5df92a57571ad9484e44934e0
- SHA1 3aa853ba9da73388d08508b1800b2ef20899972c
- SHA512 eb257b920abd11641b71a437265b46459529fa25e253d80bfcf412665e53c9b782a552c90603e13b8b5d32526059245a5dbbaede20c14900b82e382ddd6c6641
- SSDEEP 49152:ra/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4TFP4suIRbDv:bZ4K5MJabfsYNIPHn3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\SetupMetrics\903ebf1e-a955-486b-a2b2-8e1a48270747.tmp
- Size 488B
- SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
- MD5 6d971ce11af4a6a93a4311841da1a178
- SHA1 cbfdbc9b184f340cbad764abc4d8a31b9c250176
- SHA512 c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 9dae207ba9f21a21773c43465e423602dd52fd14c66cfd5d8174deda560c70d9
- MD5 99b74d34966f023dec2332b224534dd0
- SHA1 4ba7e543702483d436abe4a8d566826b17115def
- SHA512 3dea8ca0fc904ee3ced4bfb0a4664a5b8107ab3980470d1e2e84a82dba19b06d45014dd9ed34a1ff7885802ecab9d80664c9dc02f2e584f14d45c94e7477b405
- SSDEEP 24576:ScP4mcvIjkGOxhKP2l71SNKbrh/8KBkHofe3y1sInB2COzRq8DvFqt:dP4m4IpOO67N8KgP4suIRbDv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\dotnet\dotnet.exe
- Size 696KB
- SHA256 cd90178e648a9cd9034e2c3dc265d9d541eae1dab17f7344a0de6f921e46e614
- MD5 7c114a04f48041495bceddcd6cc201da
- SHA1 a4e39b9168216325c5fa7b0f70cd9ff982dd87cd
- SHA512 071dac7042bac6e3604232cf7cbe1c10940d8b602998e9ac03cef85ab1d28561f543a8deda4d349aac48cdd511ee726cefd8d18379dcf7ac4f49631dc3681967
- SSDEEP 12288:ZFYq0SL3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:ZgSLHofe3y1sInB2COzRq8DvFqt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
- Size 40B
- SHA256 570055b300595d9bee19cd486aec73f2e432043cc1a510b5075bc55da6b32757
- MD5 99cc49358cfa3628888247c84b312722
- SHA1 72df90d4341e204b5d695a65f8f0575d75d6d342
- SHA512 1b3f0129c396f2e582b6e1316e622f9faf71776e5878c95e71a961e4851f9aa90b651f0e3c3d406602c79f377776df5c8353578f44673359088ba16998fd614d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
- Size 193KB
- SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
- MD5 ef36a84ad2bc23f79d171c604b56de29
- SHA1 38d6569cd30d096140e752db5d98d53cf304a8fc
- SHA512 dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be
- SSDEEP 3072:HXm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4g2rJBXCy9enoN:HXUMCm4U6q62MEBi99g6JVCvoZhhl+No
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 fe5a3356983d3dc422cdeb5964ed22f31bae0fb3ffd485ff5f845e1c8cbb2800
- MD5 b5951aac6adfec5dba7f781fdd078f98
- SHA1 b813e927c3143b8ede9c6cf9f870e699240e30e0
- SHA512 c4c0dca04c8f0a04db72c62176f864455dd9d965d3002fc8d2aab6bbd7dfb40f98697a4fd71ec052334b7d5f82a3ab0bdf57b2db79118fcdf0c5f2469bcf37ae
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 369B
- SHA256 b696a1b68a72b1181cb324c47bb7b76a6a9ef0b5f2bbc575b2e066615f88f285
- MD5 0cb980f3d74f4fd266bde079ae2099d5
- SHA1 68b3ef29125d3eb9416d6da2d3291212e048244a
- SHA512 360585719a6acb8a2d336afe7203675bd976d1f5e8695f72d0d2123b2e0d98097c8e349805d75f0a88336a2b9026bc5595916cb3aa01c7365c9768b21387a968
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 5KB
- SHA256 4c55759414d03b718576d029c98539e373f7531dc42e2bca34c73a91d2defdec
- MD5 41832eb200dc51d0cfd72d2489827456
- SHA1 00674ad09dc9c1143e8ccaca1c27f6b4e68d3b50
- SHA512 e56accc3e2b1f9497f4117f1872d9694907da08ccdfd5921c1e9a101b5a74aeac8d81e7cfe626d3527dc752e504717b3fbd0e06fe7976e62d3b5f5cdaed96442
- SSDEEP 96:4/+PX8GXKkMSX08iZRy7Di+6MsmdeSOOjXjVlVup:4GPsGaj8syy+FrjS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 4KB
- SHA256 fe59522d34ba9f23271eaf44797f3bee925267cbd2351548e05ab693da26a989
- MD5 35e8edf590d64f0f49a98413cd5b840e
- SHA1 9aae560c70cee315bd0b73552c9257c6bfd5c79a
- SHA512 87c4f0dd4a20301464c7ee79965a986918c22147de989c2c60133528a35c647907ea19a96f7c2080e4e5e140573a70f7fd635627c5852652a1cf621868bdcdc7
- SSDEEP 96:4/+PX8GXKkMSX08iZRy7Di+6MsmdeS0BOjXjVlVup:4GPsGaj8syy+FU+jS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 4KB
- SHA256 25d6cd11b90db453850e9e0a35b8918b2a866029531dad33d3463dc526412612
- MD5 a9146b93b126054ce4c0e51ebd00b0fc
- SHA1 994102f44a414b6659a9b9fcbfb86c2c3917d4b6
- SHA512 9f0be9e3fe375f6a72b8b1ff87f07a859237ed5b68423c0f177d423e4397a7f12e051fc27e9f71f358c5dfdf4b7693968372c5ed6f5977513a2385f09f85138d
- SSDEEP 96:4/+PX8GXKkMSX08iZRy7Di+6MsmdeS8OjXjVlVup:4GPsGaj8syy+FZjS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe577fde.TMP
- Size 2KB
- SHA256 899961eb96b3c34c8a0b0bed8f6e6d81c5979592af5cc0144590b71e394bf7b2
- MD5 9789813c7b351abcd4b4cc4821874f82
- SHA1 3c3839cb1e6fcbd66f3c6dfc092f3aa49c057c03
- SHA512 9c8dce395a863812d3b050b5068e97301309e46ae0c69f6ee0f8539f3dd453d269bfe4865d4afc6a8518e4b85ac49f8901fc937ca19da27a1e5bd178e3774a76
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 15KB
- SHA256 c0ce9b4748aaeaac9e1b07f0e829600dacbf64d65a853b081cd3ef494c62b158
- MD5 e8d1ae43e75faf1f17ae9590e8ce6996
- SHA1 e00a34926d12e8c11c17ed2f351ef8a70110e291
- SHA512 6391164452297a0a6340ef127e66c5fe2837a7fb74791baa4c49db39d1ce888262d98bc6695fd63ef7a048ffbc86c85b6df24dc3b3b6d10ecdcaf9ff737d8e41
- SSDEEP 384:t6LPLeMXF1kXqKf/pUZNCgVLH2HfkorUTHGk3Krui:QLPL1F1kXqKf/pUZNCgVLH2HfHrUzG7f
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 260KB
- SHA256 4c10b3394b547572499d75983843186eee3977ff3e9e4940a622ee35b7d1eb8b
- MD5 c7d837c0803f01d7301b4e024867d674
- SHA1 a2e56cf8011dc4b18e1827253d9bc4f55b26e104
- SHA512 5f4aca6538d9b46ebbec8db5f488f7ebfe4979d8d4c169338192161bdcdeb7b990708c04c5f20f304189dcf52669e7fbe3d68fc33f553fc2aecfcb6f2a1233b5
- SSDEEP 6144:JG2fEfuP/4JZfXbs5tXnMUjUher1OTr7i05WXlpHES:xf2uP/OrsjnPjUhw1urGtXPd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
- Size 8KB
- SHA256 399052d7be7fc9ff32f70d7cd1c81ae011e8ddf13b7ce2306e74d187a637dc67
- MD5 d9df1b6e0899b527d791c95320f4ca28
- SHA1 ed8f230e363a4b3d27d8bf3c60789d460c6909b8
- SHA512 1755baa5c02247d667f02758920b2ec301e40d3bacf4ffcc198eb9da6f05f77bb17f1be88631673c1a7cc4621157b03ba976dd13c601f441c9e9a01bd71ab1e8
- SSDEEP 96:CRHGh2+Fw7+xK3zK3Q7KqidkP2xK2qK286ZQcsCDWdExK36K3E:5TwCat+7ke8AcvWiL/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
- Size 8KB
- SHA256 d2251a78cf292011254e9e94bd2124ad31dcf47e691ee49bddcbb4f51f1d5d93
- MD5 71274d12af8702b3c42aba28e45a8880
- SHA1 10a54589308b88f9379238a8b35dbf67ff334576
- SHA512 8e61a8e01613c518cbeca2fe70003b4cf05b0548f93ff2a5ea05efe4f52e3c15b639912a8dae18f2865db618564e3e6a31437c535d6f586bf893adfffe6b990c
- SSDEEP 96:CRHGh2+Fw7+xK3zK3Q7KqidkP2xK2qK286ZQcsCDWdExK36K3/g:5TwCat+7ke8AcvWiLX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\84490fa512d07ad8.bin
- Size 12KB
- SHA256 32cb2db2c9b239c89513c6be5f23d708e1888eac42d4ffb572ec616af3e4ac78
- MD5 6b9b747e6f1247d1645b1ebd8730dcad
- SHA1 0a24e1a2a6eb5f9581657987f689fa2cdbf56851
- SHA512 617dda43df481c4c7977cb6b920dea1b4f8990b58ed4aa50453c8f6bb60d9dcd95115c2df068f9a501b1e8dcd123e5142394be911d5c9ebf1b3260afe4983438
- SSDEEP 192:eEarFRHlQ9oY3gje2vwikkQO6bmF+f64vFczul3SgcMwAWfvy/L3++:efrHyD3Oe+KmF+C4vFIuliNLf6/LO+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 b11a5599af2461fcc7fdc784fc72be0b6b62b174cfa53163a3af908d3e40097d
- MD5 dba13aa9c6947cb687580323bbda29a4
- SHA1 3a115b834b5283081236648ba6dbee97a0733c6e
- SHA512 8dc0569bb31bc055a26a90fb10748574178f034fbaa74c417b7c2cea696f8d462e25d41b9293993002455880d1c527eb5fb40453270695137edbcf580d7eeae2
- SSDEEP 12288:NM3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:NMHofe3y1sInB2COzRq8DvFqt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 223dbffff09ca02cc16bb3be3f5ebb88804ad30bcc36f732ff84053a73673da9
- MD5 6f0500098d1b02d05aa215719424be04
- SHA1 355f99d1f45c39bb18d3deb222559b51325f2251
- SHA512 c52bca5234497782125dd184957cc5a6d0386484272b87136a4a01696abe924feb1a42c82e99002220398f039bd4ddd04d6c726320f6ae13902c050d425870c5
- SSDEEP 49152:aa0h2GEkuAe73q3pp46zwwQ8P4suIRbDv:aa0hNYG4JwTPHn3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 659KB
- SHA256 e1c60f0b18c721ab0e82434595c32242abf107ef69b4029061a2686bd70fd3cc
- MD5 eb8837b21d6662db05c10d465f5e3187
- SHA1 fc04f1be7788b225ac6b285ea38936ffd532d2c2
- SHA512 704ab174c3fff10ec7ed91fa9abe571aa3fbf4243fe9c19729b313adfeac176705995f44fa3dc765c4baf303dec330c37bc0e4d528d55da7c8ed66fc39f67002
- SSDEEP 12288:VhbHjfX33Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:VhbHjP3Hofe3y1sInB2COzRq8DvFqt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 74cce42b0987c564da92cd1ba6a15526c1608afcc62f3c973b3ce6369fa008f8
- MD5 179884fc440d7588ef0a478c4a92e855
- SHA1 d107a072beef4b97e11c971dda1206f966a389f6
- SHA512 471c2e23adc6fd64d060b97d4e9fe2654879bcea24dcff2e2d0436f37a322a0ecd131acaac9991798b86391cd45cc327bd133131f7413967037c1effd8e6eea2
- SSDEEP 24576:j3YgnJcRTk4yti+R5dpR/fHofe3y1sInB2COzRq8DvFqt:jIgnaTk46ppR/PP4suIRbDv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Locator.exe
- Size 578KB
- SHA256 9d90c4daf63d0ddf8a2d1242e31f920d5c15b4a9bf4db15f3ad6d0c4b3accd40
- MD5 a1fbf72f47382a3bf677ccc513bccb28
- SHA1 a4906c421e954e1deb48b2021e46d7250da5ff24
- SHA512 81a05d067e6084307939ca0d523f7afdd4786c3efe8f9bc32938771b26b1aa164558dfae319d71f9ebd37f43c8694ea742b852daa9525a73d9250ae00210a5e9
- SSDEEP 12288:po3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:poHofe3y1sInB2COzRq8DvFqt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 940KB
- SHA256 d0ab2a76afd27c993f8f2417590fe698b3ff8a1072ba81583ea5dfda02bc8d73
- MD5 afb2c951775d71e9c42cc0e3337161fa
- SHA1 ebe1a7322e5da0d4a3a24ac048bc42b447f31c09
- SHA512 8c1edae476e7a2ba1aa209ca9e7f193708ba55cb93e620b9e3af8952af25b7741ba434f7187b935fd07128b07b2b56c7d93c681ae3d3a1bbce1944089443030d
- SSDEEP 12288:IOb9A4LWOsvAYFT93Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:lpL3UT9Hofe3y1sInB2COzRq8DvFqt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 671KB
- SHA256 2f081d8ced9af7a568ff473bf738d17ca8c023a26e6d833defd1765b0a124502
- MD5 bcf260ef5cd889078c4bb82cca6db1d3
- SHA1 1120427d110bd2349685f90f8454436d88065bbf
- SHA512 bd5ee8b1aac67961a2a4904c951957762bdbbe5c6a0d9d441ee0bcb03eda5441cb2ddd78023e5722a2109c388cbbb0338ab4d2ce36ab2c889f740c9975b04b5c
- SSDEEP 12288:PpFtpOZ3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:jOZHofe3y1sInB2COzRq8DvFqt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 bde5bed6406a8a573a96519dd8995fb0a416f803c11d3dee89d66102cccebe61
- MD5 faca9ccea3a71c72214c113d9de70629
- SHA1 0049308f44786179770b5544b29779ae8a88cc33
- SHA512 149992d6a8aef759954fb30cadf6805dfe37af9f5df431b4ec0bd48b4f7d16b14d192f5c44e8f1d501783a84909fb44740ae847369354c328340b09348c4575a
- SSDEEP 24576:17NM9YmZqmWMUkPjZM48Mv6bEhs8Hofe3y1sInB2COzRq8DvFqt:17cBWMpPjN8DbEhXP4suIRbDv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 6667b8ca2cfec1e666f78f1264b35fc258e04737f0374bf2060691c952b96f33
- MD5 874954407a923b9603c3667ce7e47a58
- SHA1 151df487ddc8c5ef7a7b80c119ed7ee363a5fb97
- SHA512 2470101fccb79e431fbacbf74825aa5b959e532e0df5154f8a53c921e740d6191133b291f1401507c596fe6243220ef4c0c60c7e89d28fcd7dc503c891935da6
- SSDEEP 24576:dW6BApg2YuyuNDYTabvcRvNYf8km1mHofe3y1sInB2COzRq8DvFqt:dF2YuHNETovcvNYf8kmCP4suIRbDv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 e70770a2174adaa5d29d4c2b51cc28af8cf9c7b6596d1b0d1811b673904d9c0e
- MD5 9e8f45a70d89ae7ad10fb20a880a43c1
- SHA1 a3553ac2d147a813579e15372819560b082ef96c
- SHA512 0178e4e80354362bb594de03ed7514d2bafd7b59b11eaaec36fdb52f733b5a1cf95fb5626e20c4567c0bbda247d7fc8288028b665d29dbdfbcd27118e86261c2
- SSDEEP 24576:IAFs06+Omlf3NXEbToVHofe3y1sInB2COzRq8DvFqt:NFs060lVXucP4suIRbDv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\TieringEngineService.exe
- Size 885KB
- SHA256 b22e2e22ef20ee3581cb15230f89c2eef98e4ddd0f2559053a04f0c54b796a7f
- MD5 b8a3cf25409e2bd27b59cbc26ab924d7
- SHA1 7ab368fc4a11511448010d6cabbd9931eff6b81f
- SHA512 9f2265d2e750976bfc12ea36cc9efaf8f6cde8a73efb94c8a8743477eede48d8d5d93081787f6c023d31e28c1d794ff0fc9aadf3e3f599b83178549e93b999f8
- SSDEEP 24576:8JnJ5D3WtCHofe3y1sInB2COzRq8DvFqt:8JnJ5DGtcP4suIRbDv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 037abf04ab029f9ff52216a12aeac856d60c0ed0aaa90c0dd6be6df3b539a786
- MD5 ab8960bb7016b92aecf6f51f043e2821
- SHA1 e5a5af3870c7941767d8813f92eab2c6a75b7511
- SHA512 b8af7b191c6e0b190e6c855112eddcd8f0155ad910f066114b8d5f19139b6d65c122711235b553c6386692903b4e3ac457838d6e10a185ec0365235f5b27cea4
- SSDEEP 24576:zEPohm6/7IIXdwcXrif7qQncjlP65i3VufHofe3y1sInB2COzRq8DvFqt:0o06DIKdwc+eQnSt65aV+P4suIRbDv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\alg.exe
- Size 661KB
- SHA256 be6a6f2dd1b52da9d26beea3fe85b9f8a59a7545fa64b8c6eb361abac5983b2a
- MD5 def7df991b2f02b1965072d0328d929f
- SHA1 600ca723ef567b3b4c170a01362c4718f1d11244
- SHA512 1b999b9a3cd2e85eac68debaa2f40272fd187ca1e38e7020d168d5bff294f5e04628382814c37b087dd88ac703ea410adcfe69b9982c6da6173d1ad725a296e7
- SSDEEP 12288:lEP3RrK3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:mrKHofe3y1sInB2COzRq8DvFqt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\msdtc.exe
- Size 712KB
- SHA256 1f546f532514b92ca1b7c4d0c16296b407e498cc353344ec2b4b5701e8b0127b
- MD5 ff732e9bd6f21836459b0aa540784701
- SHA1 aee4679f54dae2d4d36147feabb328f5dd06ed5e
- SHA512 7b245300aab15ae4ed423e8ecf141cf12efc14a8eb259a7f81673432c2a3d29010733d4f6bd87f53052f1a2d8e74c2fbaf462822aa34255ee4402dbddf2f5d2f
- SSDEEP 12288:mjkyH3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:mIyHHofe3y1sInB2COzRq8DvFqt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\snmptrap.exe
- Size 584KB
- SHA256 b98b2e2261f27792a5ef8d5a41ff5c12cac1fdd259a4007b56212b11202a148c
- MD5 7e2cddd2788231db525905087499cf02
- SHA1 0b4d9e0059555c96a1bad5ba42a6f67338fab8f8
- SHA512 deb6b55dd8deac33474b89a6f298199fb5e788de95cff1cda7c2af5df90b6c3dfad95097044a0d041f130d35e0e23517f436dbf1776f2881a3a3f423fc710b6d
- SSDEEP 12288:RFp3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:XpHofe3y1sInB2COzRq8DvFqt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 72befbc6bdc2c64bb345b2fc2e90ab2ba877ddec844c3c10ac7122707ca62ad8
- MD5 74a7c45fac7e183ee13ef24f292deb64
- SHA1 72a13f606176126df41f2facd290d297b43c69d5
- SHA512 8cb47459545a2094e30a320ddd98e625631e3bc153f943dc4f398ba6c5ceeee1659e5bc022ae133b6dfc1645f9a3545ab56fb3d4ffbdc3155f50955bb245c5d1
- SSDEEP 24576:tQ9MxZKdcz97w3UHofe3y1sInB2COzRq8DvFqt:tVKXKP4suIRbDv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 772KB
- SHA256 0d763d418a6b0700b114cb69a7ca61602eae87923d092fd748101711238cc7d0
- MD5 42b5fc0b19961a15b88838f55352a58b
- SHA1 379316f8ec1841d5b569382fdf5761a90ea43961
- SHA512 f19daad48e70aa75c9efdedc3a63c25ba743e894735acf2eb5e5530e2c2ef65976b243ec32b90b556cc28aa07bfa1d2f49937eed9ce9084f90fbb749cc26213b
- SSDEEP 12288:ByoKo2HRple9pj3Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:ByocxApjHofe3y1sInB2COzRq8DvFqt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 82f2c90bbc3cd4bc5712a2c2a092bac1ad864b8489a6cb9ee9473afde40a1e43
- MD5 aa33399c07924b22f6069b66e8dc4667
- SHA1 1b5eba5d0770fa1d1f8bb4568ead618616f5edfa
- SHA512 81cbbb9791133190b33777e199b9b22342700ad3a82c844c33926ed4c31c41cba648b4aa7e89d555a9115bd792f420242fb31709fa67334f52c730ea90ff942e
- SSDEEP 49152:9WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKbP4suIRbDv:d0zuNI/PHn3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\Crashpad\settings.dat
- Size 40B
- SHA256 26345f4eaae9348eb9da6a4c6101dc723a2cd58c0f15d93f5c1ee628b6957fd2
- MD5 a57e00e7b64144dba402c6db0f7ad149
- SHA1 51a33fa8f038784838ba3a6c0fd16cfccf49de55
- SHA512 a9d626fbae4b1da4d41e75520ebb2eee98cd2a4b9dfdf5f264e574b61f1acbf34c0bca6b1d3e1212ce37c8935a50817c47539b03030e1665a7dcc3a18dffa739
- MD5 SHA1 SHA512
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 6740a1ed6316c6ab88a3d99b3ec89e44e8c31d17a4e3ac57f7b752550897e802
- MD5 bc8dc0b77565a1937d49a852562a260f
- SHA1 74efb7c752052065907a57c7d45edcc2ee9122cb
- SHA512 820ccd058566daf32687f032ed8693670af8170c3f2fc974852850038481220d9b1bc4b0791545ff5fcc57a8609a1cab2f2b33201d9ce39b0a967d0265ee992b
- SSDEEP 24576:x1QT7EcpfxR+N5AWAz3ooiYtjMqb+Hofe3y1sInB2COzRq8DvFqt:UTDxR+N5YzTfjMNP4suIRbDv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system32\SgrmBroker.exe
- Size 877KB
- SHA256 cf93c4d5a7f7724cd06a495a7d4af7dd7f174ae0e5760aebba884a547329fc77
- MD5 10752b12ab3a03c2654ca9f9d704d717
- SHA1 53d40055a974b33b07de84cea9755ab6ca53ae41
- SHA512 0936d25f86f44d7d9011bc1440a452435e5c82c42cf3a804a9ebbb04278d641cc37713434481257ad6cf96c41bb0930878586bbddfbd4409e8a60e1f2893ba85
- SSDEEP 24576:wTMdOz0FFS+imSLaHofe3y1sInB2COzRq8DvFqt:40K+imSLEP4suIRbDv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system32\msiexec.exe
- Size 635KB
- SHA256 2665cbeedb8d45041ddf37296fb007e09453ff9f0381491c724ae33067ba9fd6
- MD5 4cc17cc0714f90320e5203368941a8db
- SHA1 24615b008d9b2afe2e404fbcbdb420f61e1b931b
- SHA512 ce23f516cda1baff78f316c45633ecd8e6106965e05225601fcd596211b59c5b006d593b45206dd70d54250820e827388ed26e2c6fbfe3efaf066cb4a53ed9b7
- SSDEEP 12288:H4793Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:C9Hofe3y1sInB2COzRq8DvFqt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\odt\office2016setup.exe
- Size 5.6MB
- SHA256 2946ba060919dda4f2992a8b15c2a1a28cbba27d040ea63c3fc7cb737db58840
- MD5 cc99e59a121adde0e324672c6ee6e706
- SHA1 66ed71b05b49f86c15e3b0dce23de576cfb00b61
- SHA512 f572632f26a498ef319455a74d3c600fdbc01b20bd71c2072a6b9324887c2f8b28db0a619d0fcbcb0609d64ee1d686c830ca19afa1be04310489c2e02bf4699c
- SSDEEP 98304:Z7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGL/QmvD/cTwY2h3FvPHn3:9M7pTXexZPGzURnBh6gGLF+W39P
- MD5 SHA1 SHA512 SSDEEP