Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 22:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
General
- Target 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe
- Size 5.5MB
- Sample240602-1962eaab76
- SHA256 2464c934024ed0d257ac1ef3200c21cf22a98185e891b15ca86ce6813f698364
- MD5 b7690f774f50fe2e8c04fc187c4ef8b2
- SHA1 7cea8a25c53650c50a9d9a83249296ea1621d29b
- SHA512 440634ec0779b6cc2a65abd7da3da84ecd791580046660197511c508d3f3a4573c438f41c0159451cc80701e8663291b28d763b7dd0dc5fae65ec96988fe5336
- SSDEEP 49152:XEFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1Ln9tJEUxDG0BYYrLA50IHLGf8:DAI5pAdVJn9tbnR1VgBVmy65tUV
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 26 IoCs
pid Process 4200 alg.exe 1916 DiagnosticsHub.StandardCollector.Service.exe 4208 fxssvc.exe 2124 elevation_service.exe 3020 elevation_service.exe 4504 maintenanceservice.exe 2804 msdtc.exe 1624 OSE.EXE 912 PerceptionSimulationService.exe 884 perfhost.exe 1732 locator.exe 4476 SensorDataService.exe 1796 snmptrap.exe 4192 spectrum.exe 4128 ssh-agent.exe 1108 TieringEngineService.exe 4376 AgentService.exe 1596 vds.exe 2808 vssvc.exe 4292 wbengine.exe 5080 WmiApSrv.exe 2848 SearchIndexer.exe 6044 chrmstp.exe 640 chrmstp.exe 5416 chrmstp.exe 5476 chrmstp.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\wbengine.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Windows\system32\msiexec.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Windows\System32\vds.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Windows\system32\locator.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Windows\System32\snmptrap.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Windows\system32\AgentService.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Windows\system32\vssvc.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\1d8d3c6f293b476c.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\msdtc.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Windows\system32\spectrum.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{878BCDD2-1ABC-4948-8DA1-C8645DF0F833}\chrome_installer.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102250\java.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000056255a5e3bb5da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133618405348105805" chrome.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007bd56a5e3bb5da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000056e87d5e3bb5da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000022d64b5e3bb5da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005771875e3bb5da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV SearchProtocolHost.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ chrmstp.exe - Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 4792 chrome.exe 4792 chrome.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 1916 DiagnosticsHub.StandardCollector.Service.exe 1916 DiagnosticsHub.StandardCollector.Service.exe 1916 DiagnosticsHub.StandardCollector.Service.exe 1916 DiagnosticsHub.StandardCollector.Service.exe 1916 DiagnosticsHub.StandardCollector.Service.exe 1916 DiagnosticsHub.StandardCollector.Service.exe 1916 DiagnosticsHub.StandardCollector.Service.exe 1604 chrome.exe 1604 chrome.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1088 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe Token: SeTakeOwnershipPrivilege 1964 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe Token: SeAuditPrivilege 4208 fxssvc.exe Token: SeRestorePrivilege 1108 TieringEngineService.exe Token: SeManageVolumePrivilege 1108 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 4376 AgentService.exe Token: SeBackupPrivilege 2808 vssvc.exe Token: SeRestorePrivilege 2808 vssvc.exe Token: SeAuditPrivilege 2808 vssvc.exe Token: SeBackupPrivilege 4292 wbengine.exe Token: SeRestorePrivilege 4292 wbengine.exe Token: SeSecurityPrivilege 4292 wbengine.exe Token: 33 2848 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2848 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2848 SearchIndexer.exe Token: SeShutdownPrivilege 4792 chrome.exe Token: SeCreatePagefilePrivilege 4792 chrome.exe Token: SeShutdownPrivilege 4792 chrome.exe Token: SeCreatePagefilePrivilege 4792 chrome.exe Token: SeShutdownPrivilege 4792 chrome.exe Token: SeCreatePagefilePrivilege 4792 chrome.exe Token: SeShutdownPrivilege 4792 chrome.exe Token: SeCreatePagefilePrivilege 4792 chrome.exe Token: SeShutdownPrivilege 4792 chrome.exe Token: SeCreatePagefilePrivilege 4792 chrome.exe Token: SeShutdownPrivilege 4792 chrome.exe Token: SeCreatePagefilePrivilege 4792 chrome.exe Token: SeShutdownPrivilege 4792 chrome.exe Token: SeCreatePagefilePrivilege 4792 chrome.exe Token: SeShutdownPrivilege 4792 chrome.exe Token: SeCreatePagefilePrivilege 4792 chrome.exe Token: SeShutdownPrivilege 4792 chrome.exe Token: SeCreatePagefilePrivilege 4792 chrome.exe Token: SeShutdownPrivilege 4792 chrome.exe Token: SeCreatePagefilePrivilege 4792 chrome.exe Token: SeShutdownPrivilege 4792 chrome.exe Token: SeCreatePagefilePrivilege 4792 chrome.exe Token: SeShutdownPrivilege 4792 chrome.exe Token: SeCreatePagefilePrivilege 4792 chrome.exe Token: SeShutdownPrivilege 4792 chrome.exe Token: SeCreatePagefilePrivilege 4792 chrome.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4792 chrome.exe 4792 chrome.exe 4792 chrome.exe 5416 chrmstp.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1088 wrote to memory of 1964 1088 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 83 PID 1088 wrote to memory of 1964 1088 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 83 PID 1088 wrote to memory of 4792 1088 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 84 PID 1088 wrote to memory of 4792 1088 2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe 84 PID 4792 wrote to memory of 1400 4792 chrome.exe 85 PID 4792 wrote to memory of 1400 4792 chrome.exe 85 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 1936 4792 chrome.exe 112 PID 4792 wrote to memory of 840 4792 chrome.exe 113 PID 4792 wrote to memory of 840 4792 chrome.exe 113 PID 4792 wrote to memory of 448 4792 chrome.exe 114 PID 4792 wrote to memory of 448 4792 chrome.exe 114 PID 4792 wrote to memory of 448 4792 chrome.exe 114 PID 4792 wrote to memory of 448 4792 chrome.exe 114 PID 4792 wrote to memory of 448 4792 chrome.exe 114 PID 4792 wrote to memory of 448 4792 chrome.exe 114 PID 4792 wrote to memory of 448 4792 chrome.exe 114 PID 4792 wrote to memory of 448 4792 chrome.exe 114 PID 4792 wrote to memory of 448 4792 chrome.exe 114 PID 4792 wrote to memory of 448 4792 chrome.exe 114 PID 4792 wrote to memory of 448 4792 chrome.exe 114 PID 4792 wrote to memory of 448 4792 chrome.exe 114 PID 4792 wrote to memory of 448 4792 chrome.exe 114 PID 4792 wrote to memory of 448 4792 chrome.exe 114 PID 4792 wrote to memory of 448 4792 chrome.exe 114 PID 4792 wrote to memory of 448 4792 chrome.exe 114 PID 4792 wrote to memory of 448 4792 chrome.exe 114 PID 4792 wrote to memory of 448 4792 chrome.exe 114 PID 4792 wrote to memory of 448 4792 chrome.exe 114 PID 4792 wrote to memory of 448 4792 chrome.exe 114 PID 4792 wrote to memory of 448 4792 chrome.exe 114 PID 4792 wrote to memory of 448 4792 chrome.exe 114 PID 4792 wrote to memory of 448 4792 chrome.exe 114 PID 4792 wrote to memory of 448 4792 chrome.exe 114 PID 4792 wrote to memory of 448 4792 chrome.exe 114 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exeC:\Users\Admin\AppData\Local\Temp\2024-06-02_b7690f774f50fe2e8c04fc187c4ef8b2_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2a8,0x2e0,0x2e4,0x2a4,0x2e8,0x140462458,0x140462468,0x1404624782⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff825a5ab58,0x7ff825a5ab68,0x7ff825a5ab783⤵PID:1400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1900,i,7157609297838905243,18146033262140799225,131072 /prefetch:23⤵PID:1936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1900,i,7157609297838905243,18146033262140799225,131072 /prefetch:83⤵PID:840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2200 --field-trial-handle=1900,i,7157609297838905243,18146033262140799225,131072 /prefetch:83⤵PID:448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3048 --field-trial-handle=1900,i,7157609297838905243,18146033262140799225,131072 /prefetch:13⤵PID:4644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1900,i,7157609297838905243,18146033262140799225,131072 /prefetch:13⤵PID:1292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4200 --field-trial-handle=1900,i,7157609297838905243,18146033262140799225,131072 /prefetch:13⤵PID:5192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3640 --field-trial-handle=1900,i,7157609297838905243,18146033262140799225,131072 /prefetch:83⤵PID:5288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4156 --field-trial-handle=1900,i,7157609297838905243,18146033262140799225,131072 /prefetch:83⤵PID:5316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4764 --field-trial-handle=1900,i,7157609297838905243,18146033262140799225,131072 /prefetch:83⤵PID:5720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4712 --field-trial-handle=1900,i,7157609297838905243,18146033262140799225,131072 /prefetch:83⤵PID:5904
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings3⤵
- Executes dropped EXE
PID:6044 -
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae684⤵
- Executes dropped EXE
PID:640
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=04⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:5416 -
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x29c,0x294,0x298,0x290,0x2a0,0x14044ae48,0x14044ae58,0x14044ae685⤵
- Executes dropped EXE
PID:5476
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 --field-trial-handle=1900,i,7157609297838905243,18146033262140799225,131072 /prefetch:83⤵PID:6116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1564 --field-trial-handle=1900,i,7157609297838905243,18146033262140799225,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1604
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:4200
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1916
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1600
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4208
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2124
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3020
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4504
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2804
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1624
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:912
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:884
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:1732
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4476
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:1796
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4192
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4128
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:3712
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1108
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4376
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:1596
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2808
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4292
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:5080
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2848 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5636
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:5876
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
- Size 2.1MB
- SHA256 9081d081b295a1c3f57d52f3e02cf358551270187c41f8f5f20aa47720495e07
- MD5 070325f2661c5f17a8179bf9816123de
- SHA1 c2feaecc0fd64dabee56f92027e43b43716ca984
- SHA512 886089ccd3644af812ac6abdc5fd79706f3defc35593200cce33b0259119c69c5745dd8fea873f64ea8db03127616f0ccde181cae9d00a294cfdceee002ec213
- SSDEEP 49152:0uYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5N65RjUV2Vo:0PfTqi90bZ65tUV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 797KB
- SHA256 9650893e47e2a9e2aa49751d5ada015de807e4041b0410c1039fee021aeb3acf
- MD5 effa738e01aa558588c3890140268aba
- SHA1 73d02530296195ff244f55cd609f29627aaec841
- SHA512 2bf8d5b72e73a101f9e6d84aba77ec4c3b36bddad3a1e24aedc80ded2b86c547f24777a45bf1d42286242f3bd2038ae654a0c6a76ac0a51742bc163e01efe6cf
- SSDEEP 12288:IcQiQmNJLBsunEIIxn85c6S4Hb4849nIYVjIlCOU4hog96o2gZ:yidnBsuEI65gcTVjUCs2Vo2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 08e280b47c063a7a0013e1a7241a9b11dc827d14e1121c7143091adc8a99c25c
- MD5 c12a108fb7f11ae5b5a02962d38cdb91
- SHA1 d0a3146cdc4ed7f269d590d0b644b409606500ae
- SHA512 c15f50d7e032f79feda3f89c113e9c33f4ba253754749ea57394b8d1eae49e493fe30a1de27595a370236fa90ba34264d9a45019bf21b19ecc50e8da5869571f
- SSDEEP 12288:O7a3iwbihym2g7XO3LWUHfh4Co8Ixn85c6S4Hb4849nIYVjIlCOU4hog96o2gZ:v+gkEVfh4Co865gcTVjUCs2Vo2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 59d53d05206ed03ef3b65401db9998a8dd109d6c6369fb402d738a9b5ec1e5c8
- MD5 c1928abbe75d48c74ab0c8ad6f10b4d0
- SHA1 d8a78c2a98626f1421d034d4e7e107e0fadfa471
- SHA512 a87d40c35d122ca42890112e05b56f5ba4698f7c7c41937ddf7b098298f1215146035cbc1e43e4e47da7c194b49c9ee7684c39dc1621b7636017eca358d9eebf
- SSDEEP 24576:hBpDRmi78gkPXlyo0Gxjrx65gcTVjUCs2Vo2:zNRmi78gkPX4o0Gxjt65RjUV2Vo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 dab8e11c3c11111d683c903a322df8e9aa4f1ff6e135e71a1c7955537a5eb4ee
- MD5 f2fe924b15a6f38bcb879ef265b1611d
- SHA1 18317ae45e377c891c60bd8af710aaccad94a243
- SHA512 2e5354d92685537c48a7a654c9bc3b4a900e34f14426c51171c1cf860f7e38de35e491f3487b7f490da4bd4b08ef109b5f9c99ab40dde429bacc444b52ffc3c9
- SSDEEP 12288:zfC6Aj+TN5uixZN+8rKhUdTC/wE1MD0Ca5ZIXV8Ixn85c6S4Hb4849nIYVjIlCOB:jLOS2oyPIXV865gcTVjUCs2Vo2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 ce393b01b7a1ce50a980b067347fe57be7cfdfe1bacb8db679fa0db701f89651
- MD5 680ac5811af9ee3a05232311bf690bdb
- SHA1 cf936c2ba033ce5baf1f6711f98a78bbfdd4ec3a
- SHA512 80de1ca039cfe0bd22fc63ee02669d01a458e2c5de88666f27813d9c322b94d4835c0bbf3320b21395d93a0864cfcc1e639c7719dc507aab2efb0c549d3571b3
- SSDEEP 12288:LfmIxn85c6S4Hb4849nIYVjIlCOU4hog96o2gZ:Lfm65gcTVjUCs2Vo2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 f2f6a6a00a9cb90d398afb14d0ba3c4e872138351caa8aae8ea6e815d2ab7e8c
- MD5 a5fd7ecd3268ad7de57f4da2bf58e07d
- SHA1 514705d7a35478d7e29d2cd47543dd260b8d9e52
- SHA512 634d78968e740de1ecd74fd3b98ee41ef51ab5a27c96bb9ff4862c05b39237f603111525a7efc13f8c844c1ec9ad0e9862dc5da99889b73d554990ee9729b079
- SSDEEP 12288:5eBNUbTVO86U7Ixn85c6S4Hb4849nIYVjIlCOU4hog96o2gZ:5JIU765gcTVjUCs2Vo2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 3670eda3b82c39d0ef618742807f68dccbcc76ec4ee078dff2b6478eff01d281
- MD5 de63ec6aefda471b9da0f62caa658bf0
- SHA1 38e9a75e0da8fc174828f92290a5f7380944db6a
- SHA512 591ff2b3ca02bd3e5598f43e5c78de19f455493433f417720cf39a01ffd498f735731b8a10e95405015838222af4761accc05581bcad223a8737e7b3018f6469
- SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THX:HQvGAdlCEL8c/yRNw5Cw65tUV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 6275ede103a095083ebb70c1fa0ac0ec6c77e6940b3da75220b39d7e0d1821ec
- MD5 898834bd1c34309c8a785c6f45482a51
- SHA1 1929ffe6f2e7240ed2ec01ae7b797eaa1fb220e1
- SHA512 ca4d55b0dc7bfefa7a91561f2e4610f00a66efcbcc04a116dc7ce6d84d39101195f5e2ac0a799c543eef2236aacd5cf0aa2e81180b7a46f88776ecc153f977b6
- SSDEEP 12288:4AwSfxL/2Dc34DLLmt0LDQewsAjZIxn85c6S4Hb4849nIYVjIlCOU4hog96o2gZ:ddewsAjZ65gcTVjUCs2Vo2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 d1f6b3fc5e4c90e94a5da3b802421359165c0db2d0df26e6f1c81aec4d8c2e8a
- MD5 a1dd87b17809519e15bf37836a18da4c
- SHA1 56970acaffa189e9e5aa0ffed5a0f76731f4ec3b
- SHA512 a21170c9a1d1d3a3a5b787ea3589c411b7e8533ca104da76557e3f1edc88ec7f565085655caeff6d8d519ddd4c789c2fdcefed0698cf6a2a67d11abef38656b2
- SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHsLu:OUEtQevvqc2W1cpV2EI32
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 c5eb245c74318d2670051d3a69060dc269546ffd30f6d3e73609d8826fbddb53
- MD5 0c46f5d5bfb04f6cd6c1e20aefa8da44
- SHA1 e8044fcdcb4cdfa14e0495cfe92a682ad482deef
- SHA512 13cf4f43694fe0554d4501df260196a00501be255132bcc93f871bfd28cb325e9fc5089f24a1ccee52a598108580e41034b8db2a9a017d222b187efecd6afc6b
- SSDEEP 49152:9CbRquA/m2yL5zLfFiV+XenmE3/z565RjUV2Vo:6oq2Vjnms65tUV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 323b912e84ce24d8ab340cf4240edd167cd72409d99851747057bfa11e25049b
- MD5 3a8b617a7f26cb517b9a7e02fcfd701d
- SHA1 fe8bf6675c3468b3835aca4df4cc2f992f4fb32a
- SHA512 6c41acfe1a7204cb1a9317ca03727a2976926d12c26c3d8b6133f85e58961e664f3e91fa8d1531e723adb3177eebeb0e8d274f8e798f6ea87587a18007cbbc55
- SSDEEP 24576:EAhGLJIFoiwtA5l7S53M65gcTVjUCs2Vo2:EAMyFoiq5c65RjUV2Vo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 7ef3637c09d174d165ad1c865a1ed8d82ca1b00f3af73681b9f3604cab1e6ac5
- MD5 6ca82724b1c96b855b8c5a7f1442b2c2
- SHA1 c2716d65b1148a8f34aba41984032dd08d45eff4
- SHA512 f28f28c815da1b492d05fc6bb02d32aca6cf84a5f1f726f9e893f3832181c75140f6197b34b9fe8ab9b1c27c7785eee595f494154ee1042747b478fc80691f05
- SSDEEP 12288:qmw5HEjsChNVBFgl0WDm+CgIxn85c6S4Hb4849nIYVjIlCOU4hog96o2gZ:jwuoOW165gcTVjUCs2Vo2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 c99ad682f6c56566c4e5fa968bb589de8a4a2b11d6db97e0027125d2106efd23
- MD5 a8e0a8a90da03afb193b85b816cf61bb
- SHA1 b7d6f2054d407aff33d19ca8ed294d263eb7d24a
- SHA512 9d8fad7ea164a9fa07d9647564bcb40c94f753516e785e7fe99165a069fff14c06b4a478b4fe1a91ab266957e999f06ba4328546db18b8121e384abea8fe4321
- SSDEEP 12288:CBZ1IyJIxn85c6S4Hb4849nIYVjIlCOU4hog96o2gZ:sZu665gcTVjUCs2Vo2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
- Size 5.4MB
- SHA256 f781fb19a292f2927b4a6b4555147a0e8d69e0f54982cbbfad366fe426f47ea4
- MD5 7a672acda1c2633a069f5b9f326fed4c
- SHA1 c19fd87c7592bfde15fdb1de3328c51f85d72823
- SHA512 91c1b9f0571a0959f76d71527d14aefec65122c31ddd4fadd6813fdc24b5d6c6a078fd9e8103c65f3a97b021c3cd417f2ff294d19aa6f6ad463aecd9c6e7966f
- SSDEEP 49152:R0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLH:hwfhY7g/rLd7yYA3awr341gk65tUV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
- Size 2.2MB
- SHA256 bde6ec198b97a261d6381722befc59d173f47d87806783650c4db0460edb2b73
- MD5 1f641b4a0926ec7ca3e6e0e2b37375e7
- SHA1 9c0c2d5291e9ee52fd33af22f56448d468ff6f3a
- SHA512 ad6a1d5e2f0959ba7988f70e4153bfb31fd9d04ec3010d5d1959db68015c8effedcff072894ec5c18813c3642dbcdcdf719faef45b5bc4bd138e25536fc5c860
- SSDEEP 49152:7y7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxZ65RjUV2Vo:mmYeyxHjWjMTZ65tUV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\SetupMetrics\92a9732e-91eb-47c6-8909-6307e03d4fa7.tmp
- Size 488B
- SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
- MD5 6d971ce11af4a6a93a4311841da1a178
- SHA1 cbfdbc9b184f340cbad764abc4d8a31b9c250176
- SHA512 c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 bb1dd36169c1710322c28fb0a6c999c857797c20437441875d6411f8a98f4276
- MD5 e08a374dc3b3d204ae6eba87314362b3
- SHA1 21cd98affd4a3363f72f5dcc8941e6313e510815
- SHA512 9f91c321029c7bd30a20253c9d8a17b0ccb6f0f23a70b2459a0c542070d757737a8dc8dd8b5ebde4e968ba37897aeef7ffbd3919c0e2a7ab95ab9c43fe7829c8
- SSDEEP 24576:1cP4mcvIjkGOxhKP2l71nNKbrh/8KBy65gcTVjUCs2Vo2:aP4m4IpOO67W8Kw65RjUV2Vo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
- Size 40B
- SHA256 62d7beeb501a1dcd8ce49a2f96b3346f4a7823c6f5c47dac0e6dc6e486801790
- MD5 23e6ef5a90e33c22bae14f76f2684f3a
- SHA1 77c72b67f257c2dde499789fd62a0dc0503f3f21
- SHA512 23be0240146ba8d857fc8d37d77eb722066065877d1f698f0d3e185fcdae3daf9e1b2580a1db839c1356a45b599996d5acc83fda2af36840d3a8748684df5122
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
- Size 193KB
- SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
- MD5 ef36a84ad2bc23f79d171c604b56de29
- SHA1 38d6569cd30d096140e752db5d98d53cf304a8fc
- SHA512 dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be
- SSDEEP 3072:HXm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4g2rJBXCy9enoN:HXUMCm4U6q62MEBi99g6JVCvoZhhl+No
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 f2495b1bfde530b19b3f27205e59e311e1dd833b246ea05186f98cdbd730c194
- MD5 7ffc24fd5afa624dcf2057e10ca40812
- SHA1 0b39b95526c2b645df9f827a93f843e11d31d3a1
- SHA512 89ebec03f0aec9925455de03ae915f30241b1617247ccf1c8bbc2ab4b519b1c1ced0971c37efbb3f1f0dcc5c539f5206a23a29a11203a8348e3ac2b467f0df66
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 356B
- SHA256 98b8c83a36ebb19623c74085ada9f1ac1514333d0ba98516cb647baf1ad937a0
- MD5 9b6ec61355f9a489f4175155181c7fab
- SHA1 8276aa585854d8b628cd7a91e1f9edfa15367932
- SHA512 a2188de8e6960550b73ae3a432d9ed728240bb691f0e2482818bcbdc7706625c6876e33aff37c118bf696655a1eb33a5307d1647824d3f3d943531b0436b527c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 5KB
- SHA256 12a78dcf20a86400423b29be481854b65ea1fb95f585f04904343db8d0629535
- MD5 3accc611b4b594de69a062c4bff85b97
- SHA1 dbb415dbe38b8c0de898adc3514ca198a1bd9760
- SHA512 2d7a9b4d44802635e964c3794c9c6ee015e27ce12baf3aa0a716b41898eaa61f7db5dc2a7c95aec5083ffce6894c23863bcf2318149fa0a6654096c6451e3c0f
- SSDEEP 96:gjgJvrXlbpqkJ4Jt8iZRy7Dx+6MSmueABO7Zu2MEVMup:gMhr1bpdJut8syh+FQ8uPU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe57762a.TMP
- Size 2KB
- SHA256 975c8308bab1dce91143c9ad18effdd216bc367fccb3195ec2d4fd50177d2158
- MD5 8441fa327ce1f6c12f371a1535e655be
- SHA1 7ccca62179f1eb9a2d47c3886ad8ad4bf5b15071
- SHA512 986088d4595dc5a9e166ecc0b439a878a24d512f236b2756e377050c0cc7423143d3aaa3033ba5163b28fe8551313ff985d6df2ab109117186e878ca4a98d0a4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 3dbbada27a6da6f7529375db0386a8778c61cfdcc1f18a510f4533da778c00a7
- MD5 a44d7bf5a035195bb9402dbd71a30205
- SHA1 20f55a1f9be1a027d6e520e6d4cbce2d98d719f0
- SHA512 1353b9343f05d25ea5090bf824513ba7f23ca921ffc94e241371eb2faea86df67f0d22dd75ee4178aa6c6bc5262c15788e3586c70d43956beb248e3a333a17b7
- SSDEEP 384:qK54LPLedbXjV1kXqKf/pUZNCgVLH2Hf9SLrUSHHG8GO3Rp:qy4LPLQDjV1kXqKf/pUZNCgVLH2HfULL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 261KB
- SHA256 0321738767c557887e123fe6a049d294d7369b6eb22f5e7453a5b283842cd9a8
- MD5 cb148e211077c9bea2b397e6e04dd7b0
- SHA1 2961641b6094f5b5d75096268170ca4e485a4175
- SHA512 10f9261cdf64d3463f710519af29df11aea2efea249c3a09f30f83e8356f185d168e9148bf608c5319623d0ffdab26d7ef50e4a529c7846bd5baf95c56eb54e1
- SSDEEP 6144:y+Zo0UgrZJqMU4x5iUt0/7supTCZ5IZXqXHjTdCP3y/W:ncTo5E/7supTesqlGSW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
- Size 7KB
- SHA256 64e7ac811eaf63ebf61c957a19b9f3afc3fc43fae7694cd5c4e725a372568785
- MD5 e5bf51c70b8a81d19f3f710636520450
- SHA1 c63e15126933e8115e052a3fdd984d55e56c1710
- SHA512 f8482d3a638787ee8c8685bab2706105ab376bccf1280c0ff1020b1778e1936889071ebfc0ce8d8bc844f1b48ec7968b93508cd607404b74bfecff994142740b
- SSDEEP 96:a6R6jpO7KCqvPK7gFwK3LK33OhwsHXC50wK24K2ZTPXztAN:D04/7PW9nCTy7tE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
- Size 8KB
- SHA256 b04e25f9357c0b66214666832ac2554524ccee70636f157c665d3dcc20056ae7
- MD5 32b50e461d8d7d9f6990152ba387febf
- SHA1 85ee28c9864f6c669d3e001456eb28afebea05e2
- SHA512 aee39a50578bd983425281e4bce8a5a65bc22113cc0b5945f8937f280e830b1d25a62b3e2ec798dbb8cd2c41ad03f20355116dc6b8e1e5c6f69418b8bd1a8c74
- SSDEEP 96:a6R6jpO7KCqvPK7gFwK3LK33OhwsHXC50wK24K2ZTPXztAofabAVwK3LK3rog:D04/7PW9nCTy7tWbvyy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\1d8d3c6f293b476c.bin
- Size 12KB
- SHA256 00ae8cce2b8562979cf9dc371a98ee65dfdfdbfddd57f14890b2d7083f02d22d
- MD5 3979db0c7060ef1f69595fbcfd55affc
- SHA1 593238637e3a353d5ce7caa8b06a67b377d8e9dd
- SHA512 011c6a2d7bd90f8d412bb9fc92d4574e8ce488590ca25efdd10dbb2180cf669d52c3219568a2a4aa250193e03b1a615db70279d69d7f0ac127f71bda4ae70068
- SSDEEP 384:3KZwNdTx/dSJR4wKD2H67ngPl7Na86xI5VMvQ8:31dTnSJR4w0EP7aXIYj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 83c87dc9eafc10ba0586ef4160bbdd20c73a0520487006cf1ee858a4c05ac84a
- MD5 91b82d9568c106ab90a621e15de9d80d
- SHA1 aa96d62743133265e481b7bdac07258226073611
- SHA512 c73efe777770b505a40ca8cef28e977c5c6b00a65effdb21aac9d67c5e790e2814bb10f7da1909590bb1ff2e58478b430e31fc396e023a41329af2b12c3bc8f2
- SSDEEP 12288:AaIxn85c6S4Hb4849nIYVjIlCOU4hog96o2gZ:Aa65gcTVjUCs2Vo2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 f82983365c90b2299e25d8dfaec0532c579067867ddd2cef8dc917396842de88
- MD5 4fc63e4dd432cc91b27d96e7591cdc35
- SHA1 43956fcf67b247a44cdf0e0278ba743a965b2935
- SHA512 3e9f04c9a27547aeb2ae987b948eb3345f69ab04d1bc8aa047a95e593bf56b8b1be859b61cfe311879b81ddd58a10b6a8392364dcb06cde10005d6cbd0e24ebb
- SSDEEP 49152:Ta0h2GEkuAe73q3pp46zwwQ065RjUV2Vo:Ta0hNYG4JwB65tUV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 659KB
- SHA256 7960de5a2151ccfd7beb82ddb7a87e86d1f12ac1998d7a6990483e9be1cdddfe
- MD5 43eed22dc99c1ded2e6acc17995c9e17
- SHA1 ee40de824ee193816d357e01207c1615357d298a
- SHA512 b5ec56ee41855e378f3b025a1d144108e6fa4c1710e9bd1c9b2567715bf9856d3d30d9179f5abf43d785706ebd193b8f74e072b579fc54eb32a8323e753f5dc8
- SSDEEP 12288:AhbHjfXNIxn85c6S4Hb4849nIYVjIlCOU4hog96o2gZ:AhbHjPN65gcTVjUCs2Vo2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 ed8ac9a21ed66b48fa6ed039665bae2a1d0747491dc8cf5d1f35f07c75a435c7
- MD5 9ce3c051e5b7783af279fb39aca6c7dc
- SHA1 5000aab91feedd7c32b65a4fb3502c60c18a7979
- SHA512 cae5a780231f721ac2949d43c872a03d9e994b6e58c3edc244b092a8f59276252984a767cd14d932bb96b14fe27e6f9580e9b78b5067aa55b9ba275a7d06d443
- SSDEEP 24576:D3YgnJcRTk4yti+R5dBR/165gcTVjUCs2Vo2:DIgnaTk46pBR/165RjUV2Vo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Locator.exe
- Size 578KB
- SHA256 432451a5754a269ee9af04f118d9425e309964df96ad75453ab6ddb8a1c54d96
- MD5 3049ceff9bdda6df3e75a2fbe3ce9835
- SHA1 f9e7327fdda8f0513d71a4b268d7b2194799ec03
- SHA512 0d5d840ec467ca99ba59328a53b772723df8494843f433f05b81713032071bbb2aee7e71a2644fabe7200e8b5eef4237a81216354010ac2d7f31d9a8e1697310
- SSDEEP 12288:tGIxn85c6S4Hb4849nIYVjIlCOU4hog96o2gZ:tG65gcTVjUCs2Vo2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 940KB
- SHA256 21f46ca2818e2302e5bc6ddb0c0549b1e5f08ec58d4be4bebd32a439078dd170
- MD5 9ff5d3d22f210515b2e9e5079b0ee7df
- SHA1 89fafc6b4489cf8845236875051de8542e4b3e59
- SHA512 caf71be42a55d3778bf8d0b97f0a6d96c14b254b8966fda95fe7182dc109d64f142c19af8e6eabeb282eaea3257604b7f1f60fb041c3e578ae0e7be668b885e2
- SSDEEP 12288:2Ob9A4LWOsvAYFTPIxn85c6S4Hb4849nIYVjIlCOU4hog96o2gZ:fpL3UTP65gcTVjUCs2Vo2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 671KB
- SHA256 bc49571e7ced3920a529211ae808af016f7d5844c45739eac8f4c911ddeb5592
- MD5 422e08eeb65cfad502345f31f10f4e4b
- SHA1 0abd0975a0f25d1fda4c7436dea2f4ee33565ecd
- SHA512 03432eec950e7f0caa669baeb6b46a62051643d77da3019b023f1ab79dac3673409e748617331fb4f156c883bb7cd6101cd8dff5482399b519f80d905e0cf1c8
- SSDEEP 12288:4pFtpObIxn85c6S4Hb4849nIYVjIlCOU4hog96o2gZ:KOb65gcTVjUCs2Vo2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 c402b2cf1c6e1deabcfc012df84de93b9956adcf571bfa06da82f292d98d445e
- MD5 81f897ca660e47f5d6a223f354697347
- SHA1 738653db1532fd899c8b0c03c811ff368bc68167
- SHA512 ae18aaeb542602f9f7e70cd89833fb6d5b2778712f46932d4002615440e2232b76911eaf98c36bd9d0d26a642698c11a5a545ec83edaa418f8b17c065d9585da
- SSDEEP 24576:q7NM9YqZqmWMUkPjZM48Mv6bEhsq65gcTVjUCs2Vo2:q7cBWMpPjN8DbEht65RjUV2Vo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 061b4d2a1bb3a18dff1131029267c65f6464462664583589c12709006a94968d
- MD5 8010eab9a8a8c44b851dfca4fa3aa838
- SHA1 e2e9c0d61313673930223ab495dfd3b294bbbecc
- SHA512 2440fa62bf89f2219d1bbe76d675c5899c36f8a805bb6910820e859fe7fbbe63e8d69f98cac0638481eeaf8c3d090be0340052a50cb66f6a24760bb3d76577b2
- SSDEEP 24576:SW6BApg2YuyuNDYTabvcdvNYf8km1o65gcTVjUCs2Vo2:SF2YuHNETovAvNYf8kmK65RjUV2Vo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 c38fd6cbc9cd543151a82dde0e3ffb055ecef13802333d9bc11697021dbe835e
- MD5 b635d44ffe8b0df42245b9f7a55577e4
- SHA1 24b29de83e44ba54f124392fa2b3da868413dcd0
- SHA512 d4794c0f15fb0c71495158bb2b31c7edca238376b2fac324ba920d485e75bffbf826c6054bf6f477b0ef1025d413aabb59299cbc61e07266a7c11777ea20c91d
- SSDEEP 24576:FAFs06+Omlf3NXEbToH65gcTVjUCs2Vo2:KFs060lVXuU65RjUV2Vo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\TieringEngineService.exe
- Size 885KB
- SHA256 c2ca3911b5da6dd3f590bafa890fac270c5db738e4c66fe242a6e2bce8edac2f
- MD5 7d579dc295365c21f7e4f92a3235a3ef
- SHA1 97ed67cb346f52bb8a16cf875cacd58d2326ef77
- SHA512 0972c9558cb3ae4eb80d757eb5914b895ac2882dd7bad61e245ce5489220989cfcbae32ff0e461ae84ef0e83e567e172aa4f716e2bf7b4182063158814cac4c4
- SSDEEP 12288:BCJnJ5D3VkrDzxKIxn85c6S4Hb4849nIYVjIlCOU4hog96o2gZ:YJnJ5D3WXU65gcTVjUCs2Vo2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 bb2f070846f6dcda9d1987616c7f1b11244f03d852cae54a1cac347a407976e2
- MD5 16adc4df13500a3d6922e291145695ec
- SHA1 45fe87fda9ae8647374c1c0d1e9d4cf1a8a1bc7f
- SHA512 75c571128d38d8e72bb1109953c3f5112fc23fd85658d779e2568cef04fde50143fbbf10646626bf42a6a2f1aeb238520f3ed847b9efb83f71d8593267e8ca93
- SSDEEP 24576:5EPghm6/7IIXdwcXrif7qQncjlP65i3Vu165gcTVjUCs2Vo2:+g06DIKdwc+eQnSt65aV+65RjUV2Vo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\alg.exe
- Size 661KB
- SHA256 cbf09bd7ebf7cf9ca70b22dafcc12f2d7f2ec2126fae8221c22e4d99c4721937
- MD5 5558d92097d0be3c97ff6d5b1e38c5dc
- SHA1 522295883feb06e0d1ec57ac963d7ee4e455508f
- SHA512 30f5774f1ef4512aa9e67b184bdf113ffb2bb951bc061bbb2987a6f4a382346c490016aa5266afc998c9260185bbafadfc97515ffb4a87e3bc579cd8180eca5a
- SSDEEP 12288:HEP3RnopIxn85c6S4Hb4849nIYVjIlCOU4hog96o2gZ:MnQ65gcTVjUCs2Vo2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\msdtc.exe
- Size 712KB
- SHA256 7b53828e4101e0d5bb3887317c866cd8a0b86c6bc6c20937e50f987a077bf2ac
- MD5 1868efe00a9308caa66bbbae427e25bd
- SHA1 9032ba6e208d7cb066b781982d716a3b934d4f5c
- SHA512 7bfa8ea5517be0997e141876cc432c6bf3d77714aab5b244bc480e42136ef57b8b490205a22c3e83af3e0c639557b20f8b7e2869d22677e9532e72dc25e29588
- SSDEEP 12288:ajky9Ixn85c6S4Hb4849nIYVjIlCOU4hog96o2gZ:aIy965gcTVjUCs2Vo2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\snmptrap.exe
- Size 584KB
- SHA256 06061582a481adfc5c218f03cd78460df265c8ca0ed5f593de29cdde1afbd8a3
- MD5 661e1f7d09d642f1013356d5afacbb16
- SHA1 d3918920ccfd3525b1c42d409c5f0465f40b9af7
- SHA512 ee794aaa0489754ca7fbe882a5df39dbe14e7359813b133361456166cfefb1a4675e7d7c8eabaa4eed8369b580372708a59d22960c0d3e4fd764d5270b20cf26
- SSDEEP 12288:xyLIxn85c6S4Hb4849nIYVjIlCOU4hog96o2gZ:gL65gcTVjUCs2Vo2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 18d15306c423e763bf7c7d7670fcdce07f8453dbf24ca3eb7d16258c0da9227c
- MD5 d770b3f6ef7c8bb1e5832d1ee1a2c923
- SHA1 7bee96af055af0bb34529a99aba53cba95a4db8b
- SHA512 339a4d4a3fbadb49680b59ac8cad6f3988ad8074ab4f023a0bedb39c7a1541274b0604aee8ab2b72b041e82fab873e5f34c06b978bf3685123fb73fd05b1c636
- SSDEEP 12288:nLQZb3C97GYnZMv5zBcKY9dMD3CIxn85c6S4Hb4849nIYVjIlCOU4hog96o2gZ:LQ9MxZKdcz9dw3C65gcTVjUCs2Vo2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 772KB
- SHA256 0e6183be37a2cf8da2b2f4b368971517fc3f43e501e456190ce318bd86d2a9b7
- MD5 ce1c0edb0330a9abc11411692fea194a
- SHA1 8fb14f1f22dd6cef04df26f527247c7f3495d3c2
- SHA512 d92192b23595b5a9d2b93205419666f05da0f72ca786f101bdb5054b4f1c2d17da4ca627c7ec6ef44e82f0b81f727037e5e796c3e5c8c78cb06938e5732dedd3
- SSDEEP 12288:UyoKo2JRple9pZIxn85c6S4Hb4849nIYVjIlCOU4hog96o2gZ:UyocDApZ65gcTVjUCs2Vo2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 98b11edc4f83aded3dca53ed161b5e2309e4817ff2e3b373a5b59b1cecbaba7e
- MD5 40a15d2b84d32a23c364eb6b6dc522e3
- SHA1 8e6f67ded99f4b754284090845a666e02c6fdf9b
- SHA512 13d25e906b9eaff6c9c83e84023a3484ad0410f47b4ef947990f12d2025ff34e0d359bbb7465c4d052ff888ea548810f7c33cdb4928637afa46dd34a1610f480
- SSDEEP 49152:PWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKZ65RjUV2Vo:30zuNIP65tUV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\Crashpad\settings.dat
- Size 40B
- SHA256 fdf37f8111f0fabb5be766202a1a0b5a294818c4c448af0fec9003242123e3e6
- MD5 440112092893b01f78caecd30d754c2c
- SHA1 f91512acaa9b371b541b1d6cd789dff5f6501dd3
- SHA512 194c7b90414a57eb8f5ba0fc504e585ab26b2830ed0aae29cf126d5a6c4888d508c22984aeedec651c8644fb1f874fa558b2090488516b33165fe7985d2815ea
- MD5 SHA1 SHA512
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 1a4ca6ab3145e6ac180c490281be4d4d1884178a900b231dc76c36e2ae4b5ba4
- MD5 6f34c23d5d37420b886a545eaf65ff5d
- SHA1 92746e0a96fa170d06bdadfbbd46ac1e2006396f
- SHA512 70038b7f31524d2e76fc6ae107bd897452c0543dd75619e84efb2ab922ef4216ed34b838d1ebbb0860c0cdd1905bc4a039651105277d6e43828fefe9d7954351
- SSDEEP 24576:c1QT7EcpfxR+N5AWAz3ooiYtjMqbg65gcTVjUCs2Vo2:BTDxR+N5YzTfjM765RjUV2Vo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system32\SgrmBroker.exe
- Size 877KB
- SHA256 1ffd6b5377a128fede2006c63fafb5ab502751fbe24ba30acd8f94cd936456e0
- MD5 f2899e2b75600f6d4b98112e206efe3b
- SHA1 f34b99fdf95eac66a4be08ae2e9ca4663d9011b3
- SHA512 0065a909ae2738d3f4cd57c5ce733656dc324b3453811ad2cc4428d288b595423a56d265aa2a9b5007592a5c78c623ae5f877282ca5ccd295bd7c796689340a4
- SSDEEP 12288:0/5T+RdOzMbFFTG+eEYNmSL+9Ixn85c6S4Hb4849nIYVjIlCOU4hog96o2gZ:wTMdOz0FFS+imSLs65gcTVjUCs2Vo2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system32\msiexec.exe
- Size 635KB
- SHA256 8a6d240bd3aeda890ee73e0cd61a101e99a6800e80ac553059c73e02a3f54a8c
- MD5 01179209bf18a04dd383c8af4ee01b69
- SHA1 fe0f2e1f233ab00de639fdb712789e7d978552b7
- SHA512 e47b4788ff0f8cac273723617056060ad81db631a1af1ad9d54629d7094d64555f65e90fc07c85a17babf6ce1b7f05a619e7b7647671b133271899b557418f84
- SSDEEP 12288:24KPIxn85c6S4Hb4849nIYVjIlCOU4hog96o2gZ:EP65gcTVjUCs2Vo2
- MD5 SHA1 SHA512 SSDEEP