Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 23:24
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe
Resource
win7-20240508-en
General
-
Target
2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe
-
Size
5.5MB
-
MD5
c81081dd4908c6154e51bd8f8986ab62
-
SHA1
55fa1dc592536f954773dff3dcb7da10e869adb8
-
SHA256
8def3731071c3254cab8dd56efba20fe42e7c6e8c50ba888be29a96cb78acace
-
SHA512
460fc984cd7ba411721c48e526ca43393f03a6cb2e938c70c1ee14ab7a7a66c278f4c6e3df76f5c7fa4f6916037185ff651463384d288f8d90b7cdc6c23ecb6c
-
SSDEEP
49152:2EFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1Ln9tJEUxDG0BYYrLA50IHLGf0:MAI5pAdVJn9tbnR1VgBVmfTjYvH
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
pid Process 4348 alg.exe 2140 DiagnosticsHub.StandardCollector.Service.exe 3852 fxssvc.exe 2272 elevation_service.exe 872 elevation_service.exe 864 maintenanceservice.exe 4544 msdtc.exe 3360 OSE.EXE 4364 PerceptionSimulationService.exe 4700 perfhost.exe 5248 locator.exe 5384 SensorDataService.exe 5532 snmptrap.exe 5668 spectrum.exe 5984 ssh-agent.exe 5600 TieringEngineService.exe 5492 AgentService.exe 6124 vds.exe 5844 vssvc.exe 5912 wbengine.exe 5924 WmiApSrv.exe 6056 SearchIndexer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Windows\System32\snmptrap.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Windows\system32\AgentService.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\b22ca088b3e2edcd.bin alg.exe File opened for modification C:\Windows\System32\msdtc.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\System32\vds.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Windows\system32\vssvc.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Windows\system32\locator.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Windows\system32\wbengine.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Windows\system32\msiexec.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Windows\system32\spectrum.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{1342F81A-D5C5-42B4-A5E8-933F7759DA30}\chrome_installer.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_156609\javaws.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe alg.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000040d76d2144b5da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b3e9a2244b5da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006b79e21744b5da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000067b3631f44b5da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a53f891d44b5da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e631731b44b5da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133618442657966496" chrome.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001ef8df1c44b5da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe -
Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 4688 chrome.exe 4688 chrome.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 4024 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 3708 chrome.exe 3708 chrome.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4948 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe Token: SeAuditPrivilege 3852 fxssvc.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeRestorePrivilege 5600 TieringEngineService.exe Token: SeManageVolumePrivilege 5600 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 5492 AgentService.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeBackupPrivilege 5844 vssvc.exe Token: SeRestorePrivilege 5844 vssvc.exe Token: SeAuditPrivilege 5844 vssvc.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeBackupPrivilege 5912 wbengine.exe Token: SeRestorePrivilege 5912 wbengine.exe Token: SeSecurityPrivilege 5912 wbengine.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: 33 6056 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 6056 SearchIndexer.exe Token: SeShutdownPrivilege 4688 chrome.exe Token: SeCreatePagefilePrivilege 4688 chrome.exe Token: SeTakeOwnershipPrivilege 6056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 6056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 6056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 6056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 6056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 6056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 6056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 6056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 6056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 6056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 6056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 6056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 6056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 6056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 6056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 6056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 6056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 6056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 6056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 6056 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 6056 SearchIndexer.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4948 wrote to memory of 4024 4948 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 90 PID 4948 wrote to memory of 4024 4948 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 90 PID 4948 wrote to memory of 4688 4948 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 91 PID 4948 wrote to memory of 4688 4948 2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe 91 PID 4688 wrote to memory of 4416 4688 chrome.exe 92 PID 4688 wrote to memory of 4416 4688 chrome.exe 92 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3224 4688 chrome.exe 100 PID 4688 wrote to memory of 3412 4688 chrome.exe 101 PID 4688 wrote to memory of 3412 4688 chrome.exe 101 PID 4688 wrote to memory of 4004 4688 chrome.exe 102 PID 4688 wrote to memory of 4004 4688 chrome.exe 102 PID 4688 wrote to memory of 4004 4688 chrome.exe 102 PID 4688 wrote to memory of 4004 4688 chrome.exe 102 PID 4688 wrote to memory of 4004 4688 chrome.exe 102 PID 4688 wrote to memory of 4004 4688 chrome.exe 102 PID 4688 wrote to memory of 4004 4688 chrome.exe 102 PID 4688 wrote to memory of 4004 4688 chrome.exe 102 PID 4688 wrote to memory of 4004 4688 chrome.exe 102 PID 4688 wrote to memory of 4004 4688 chrome.exe 102 PID 4688 wrote to memory of 4004 4688 chrome.exe 102 PID 4688 wrote to memory of 4004 4688 chrome.exe 102 PID 4688 wrote to memory of 4004 4688 chrome.exe 102 PID 4688 wrote to memory of 4004 4688 chrome.exe 102 PID 4688 wrote to memory of 4004 4688 chrome.exe 102 PID 4688 wrote to memory of 4004 4688 chrome.exe 102 PID 4688 wrote to memory of 4004 4688 chrome.exe 102 PID 4688 wrote to memory of 4004 4688 chrome.exe 102 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exeC:\Users\Admin\AppData\Local\Temp\2024-06-02_c81081dd4908c6154e51bd8f8986ab62_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2d8,0x2dc,0x2e8,0x2e4,0x2ec,0x140462458,0x140462468,0x1404624782⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9eb3b9758,0x7ff9eb3b9768,0x7ff9eb3b97783⤵PID:4416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=1920,i,15063918620421025327,12134933549517039108,131072 /prefetch:23⤵PID:3224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1920,i,15063918620421025327,12134933549517039108,131072 /prefetch:83⤵PID:3412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 --field-trial-handle=1920,i,15063918620421025327,12134933549517039108,131072 /prefetch:83⤵PID:4004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3016 --field-trial-handle=1920,i,15063918620421025327,12134933549517039108,131072 /prefetch:13⤵PID:4676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3040 --field-trial-handle=1920,i,15063918620421025327,12134933549517039108,131072 /prefetch:13⤵PID:2620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4664 --field-trial-handle=1920,i,15063918620421025327,12134933549517039108,131072 /prefetch:83⤵PID:4128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4656 --field-trial-handle=1920,i,15063918620421025327,12134933549517039108,131072 /prefetch:13⤵PID:4184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4684 --field-trial-handle=1920,i,15063918620421025327,12134933549517039108,131072 /prefetch:83⤵PID:3916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5036 --field-trial-handle=1920,i,15063918620421025327,12134933549517039108,131072 /prefetch:83⤵PID:4508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 --field-trial-handle=1920,i,15063918620421025327,12134933549517039108,131072 /prefetch:83⤵PID:4692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5476 --field-trial-handle=1920,i,15063918620421025327,12134933549517039108,131072 /prefetch:83⤵PID:5132
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings3⤵PID:5216
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x238,0x23c,0x240,0x1e4,0x244,0x7ff7759d7688,0x7ff7759d7698,0x7ff7759d76a84⤵PID:5324
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=04⤵PID:5376
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff7759d7688,0x7ff7759d7698,0x7ff7759d76a85⤵PID:5400
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5600 --field-trial-handle=1920,i,15063918620421025327,12134933549517039108,131072 /prefetch:83⤵PID:5764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 --field-trial-handle=1920,i,15063918620421025327,12134933549517039108,131072 /prefetch:83⤵PID:5772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5560 --field-trial-handle=1920,i,15063918620421025327,12134933549517039108,131072 /prefetch:83⤵PID:5868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3968 --field-trial-handle=1920,i,15063918620421025327,12134933549517039108,131072 /prefetch:83⤵PID:5440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=1900 --field-trial-handle=1920,i,15063918620421025327,12134933549517039108,131072 /prefetch:13⤵PID:6588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 --field-trial-handle=1920,i,15063918620421025327,12134933549517039108,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:3708
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4348
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:2140
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2168
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3852
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2272
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
PID:872
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:864
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4544
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3360
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4364
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:4700
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:5248
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5384
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:5532
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5668
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:5984
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:5640
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5600
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5492
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:6124
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5844
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5912
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:5924
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6056 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5256
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:5168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:81⤵PID:6316
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD593acc3651afb5c60e9f4e8dbb2690c6b
SHA1e9fc31a904b7750826422ac3f1edacdf2d81ea9c
SHA25668b87561e5c959a49665484d2673bf88e8d8b71b1a078078024bbe46a700e4fe
SHA512095e2f815f8c1a6a7a034ce819bc695d98d25db7ef307440e48eec76341d440ef7ba252c9d07c67c5cf4322d1c03f2b88cb378d3f09edafc45f52bd322e29716
-
Filesize
781KB
MD5458d478cc5de1b44d4e77298fdf5fdf1
SHA159949c1fbc2a18c6889748cf7449e5154f7081ae
SHA256bea3501a2d52cb38e90154e4fbd06fa03343ccc63a4de1072fc7631e4d809865
SHA5122fedd39355be08d5bfad1f61566980ccd0601ea03f195b5d23046b42075fa81fd842482c27f3dcf6e1614d2444222279e36487f196c7f5409e99338f58462d3d
-
Filesize
1.1MB
MD50b5794da6fe02c1b4bf747bf82d1cdb1
SHA1bd3a115e229112cd8e25b1d6d3bc03ae76a86844
SHA256be083f82305aae8a4fd1b054be2768e7b48de5768f1b30dd51391d850bb689ef
SHA5122fef82dfd8e2f1a6621a259beaab554dfe206ad27931b409d9b8b64481f8ebb81d3bb0582293e65095ffce0bf92cd8c3677b0f1e746bbd2935555d2df2054ca0
-
Filesize
1.5MB
MD557a99eecac14bf9dc4f9e6589c69da2e
SHA1849e19f849084bc0662b8defe9ffb4833e25af32
SHA25694f6a2aae4695f4dd23566f2c5e999b62d227adfd2437412cd87a73006dba555
SHA5121716d75ba1425f91439227d3507d1efe83c825456477663c53beb0bf3f68575747c77a30124d0b3c9eca5a70bcf9a91d0ca162fc79ef6ba51fa307ae5afc8d51
-
Filesize
1.2MB
MD5c5bb156a54dfd740400129e864b667ba
SHA1d1b696468a9b8b772c8a48f96dfb29b76e4b9ef9
SHA25613b24fd766746140906e69305c18581ecb52b5d9e6a657cf17e4087c06d19527
SHA512b8a7ca9de782d409b34e345f224bef2aa46fa2ed5ce6bba88ea8a5cfbc67c80aefdf459993666e88c4625065e8db36874c752224d4f05191dcad9e6ef259aade
-
Filesize
582KB
MD564ee32eb01f826f4f8516aca5aeee091
SHA11e3741cc9490bb04a9b3f37c9e7b860e0aedfd27
SHA25631856cba70037ccb4a154507347d707a93c3db46925c838c5ef13e96550f1f99
SHA512f6fd1335bfe06f2359e5351415ac943133863c14db9a382e9bd82ed5ad0587572131abee04896ff923063f32232fbc7c709cabc8c64138cdbcf0f4b0fce6b50a
-
Filesize
840KB
MD58e6e7d10a8f8cb372c5846c6a042f33b
SHA166958019bffa9ea5dd5ae017ab2e1d74d1f70f48
SHA256ded644ba19375e39e00c968ebb60225f53962f3c64d628c317c0afbfa9533d67
SHA512bf74b5c1acb6372b6ec2ca2a4fbf505c85b1649329d6a2fbbdc729d6cf88f6db5352d244145c8917473582ae79c26a016e2ebf576bd98fd61b80b607c5167111
-
Filesize
4.6MB
MD58a6f3c2ef0e0c2970a7026dbe96c741c
SHA1bb3d53fd9a5007590c1f8e1c4ccb213a9f38f42f
SHA256b33f957e07d0c2a7a8aa65415c0b09bbc4f0d6f69c891e2f235e3286a2a7545b
SHA512571ac28a22aeeb19187cb3929635660848a772770b58e1e39300733aba67000d6d5f8483aac376c73127626a247a205ea22e5b658637376509e29fdfd34064a6
-
Filesize
910KB
MD50a5515f48f67e171cd8f7f8262ef55ac
SHA15b9a4ab490f366eb2cdc6c91ecad09034d7cfa75
SHA256eadd5cabac023e18f959998d82c8e89771a2909a108b371a0449644a59f96625
SHA51275f70f3800be24b1a3fe3641de1e7c0fefc5553da7ab129fbc5be99662fb4a5c3a981a7ecfa2379af1b860ca447c063cb0de15ad60fd1f10290f9b406731c00d
-
Filesize
24.0MB
MD5c898b2c85cd98bff83f2378f5bf152f3
SHA19657dae2d484813d034d2ab8cc3f906a09f8b211
SHA256d0b4da94b85adcde17f46d93f80f3df665ad7bf2c3a5dbfad9d6faa5e247106f
SHA512d901c36bc2e45f8d927cce7ded9344f65d2f65482bec26c645c8cd365522272f472bf0be0525a53cf7023a7a437cee148920502bda0ed54fa4c930fe86dadf66
-
Filesize
2.7MB
MD5f155d773e68fe932d4133df975fc0cee
SHA1a75902c3bab43635ddfc34a0d416995c43ed859e
SHA2566b54111941f753a275946d676541187d969ea183c0e519db6e260650158194b0
SHA5121062ac26159256b28efd6ed24020f9231de8aefabdbfaa28d280b8bbf6d777ecac87b672c9b830372734de98b1084328379976c83b8a45f16017236f659b183a
-
Filesize
805KB
MD5c439587e206fd429a252999f5b48325f
SHA1e8712058fd547165b5058d548f78547223a1de3d
SHA2561c3054cbcfe26e127a8066831a221045e54dc7fc9ec3c73e18b52575b342102f
SHA5123eb4edcf6a79e70edabbe201e5da21c2080d7a5e3a0878dac9499ffea2aa42e3163998ac32356294ae405fc2c8af2aef776597f0421667f57f46d54800d010c9
-
Filesize
2.1MB
MD5bf95c5e74f4108b9102390930f63bf2f
SHA177f310035b6e75fd8b9369a37a9c55c1fb9ccf64
SHA256c80b0541fc8ad7fd65b4e3ccfb946547663980791e3e6b130abc6a891d57c994
SHA5122254f6124e5af6273409e8c9bd559522b9ceae13a67d9d46d3e1dd2b946311df981ffffc214b22d55337d6c8588277217b6353a2fead5997fb7d3f98a95ab832
-
Filesize
1.5MB
MD54483852305ea04ca0ffdd16326850394
SHA1245ced5e5e193a30c7e6fcc5553c5e5cbc754323
SHA256c145dedb809cd282cf3fe19f707c011eaba63da59babd93b93fbdb760f2d9ab8
SHA51280fa0f584b06ac5651ac021a682b711f3ba439ffee1589ff6d1a202c34544c1116bc2fb3692a58d163bc5e50f7a0b4e28da56e9a35d4ea5e5dffc43eb07c3905
-
Filesize
40B
MD585cfc13b6779a099d53221876df3b9e0
SHA108becf601c986c2e9f979f9143bbbcb7b48540ed
SHA256bd34434d117b9572216229cb2ab703b5e98d588f5f6dfe072188bd3d6b3022f3
SHA512b248162930702450893a112987e96ea70569ac35e14ef5eb6973238e426428272d1c930ce30552f19dd2d8d7754dc1f7f667ecd18f2c857b165b7873f4c03a48
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\en_CA\messages.json
Filesize851B
MD507ffbe5f24ca348723ff8c6c488abfb8
SHA16dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA2566895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA5127ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\dasherSettingSchema.json
Filesize854B
MD54ec1df2da46182103d2ffc3b92d20ca5
SHA1fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA2566c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
-
Filesize
193KB
MD5ef36a84ad2bc23f79d171c604b56de29
SHA138d6569cd30d096140e752db5d98d53cf304a8fc
SHA256e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
SHA512dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
1KB
MD5ec7827d6c1200cd64ab47bf7954945e4
SHA1a2a68c4c15853a8bda105ad5f313b70404fd730a
SHA25673f3224733b1dc854a5872511065ed24955bc482d74dfc18f6ca2ec64b4a156c
SHA512477f83f166028f6d8722e93731d033b4d5f026db2f45ca5cf068c45b90ce1cabe3877691199d35536336e75f850c261e9b85dce6617e7b1bd1eb9cb184711ab2
-
Filesize
1KB
MD5a9a08acdbc43b0b75b2922636674c65b
SHA1a03765c52a17a9d45bfc85859b1b339b493a3791
SHA256d1b4189315043aa1fb7ef0626db943cf0b5bc18648c84561d0be56dee70c4d97
SHA512a60adf5665d2b0b0eafdd52dc1049fbf25cd7c310f02fa5ed03124b78ff994175729ee1d89decbad598af39aecd06c52534c421cfc22f8b6cc479481968f0897
-
Filesize
369B
MD575c65a207402470cac320eef0c4b85b8
SHA1fb3838bddd0c3993735e44f35702ec3df554092c
SHA256035939e2e206a88232567abacf61e348b0d5408325951a476a8f7fe44b955689
SHA512ba4a158fd5f1a25b1f5a5d3b1acbb214eae9a95669c61ae1e273b9a12a180da3e26e9247172f0e7aaa31d3384d7e345536df0c5850b22899cc4edc6829b5ac58
-
Filesize
5KB
MD574c15d94d5c6df0c9a76d04de948208f
SHA11741161520fdcb33d7b8709984a417001ac6b5c4
SHA256b611231ab150104393560807679a13351c322b2fc009336fbf72dabb8bab73c1
SHA51229f66d50803185b00a80a9044d17b481c45d4f7555768bddd083b0df1d7f5cc73d57a7842d4f3b429903031be38d01feffcddbdc3922690d656ae0359e5f96d1
-
Filesize
4KB
MD5900b58655cc8ebb2f53b4f053ad109d1
SHA13ff98cd3ba736a2988be14d5124efef671e139d2
SHA25655b0a9b9625d82afe9e9e1a03a540ddb1120dfc65dce6461f4b56f8a7ef7815a
SHA51249eff5ba8ea21870e88d4a1ac8919d3167ff4a77b320d68e90209fead6e6e09b110ff3067e5d858ea9599cd3a6a2203e0a44706d14abfea2101af3c8f4e25689
-
Filesize
4KB
MD5e1db7af3225aa29cab4333e7d7cc0823
SHA135f1361b019dbb62fad6d15aa9137e953664997e
SHA25620b634d30a63b8c257a1525801dd49771fe5506c9c8227960c457ff68d4d3a95
SHA512450ac710f0f8f1abba410f49feb6f2d38e9383eb32f982cdc1bb8eab6c74ac5f8264c4c129f742f55ff9293a8f589e32ef16775a45cad187125d0f255c674e02
-
Filesize
2KB
MD504695aadffdaf28b5be826d27d48721a
SHA1ce79df7c80926a86b0e1a922a05bcab16c7620c4
SHA2560bc76b0a74faa8d4d25cfa28127c42750e86004af7a10d590e07a33a89726b51
SHA512aa3438c4a09ea9c0c52dccb6cba636ac99c11b47a5b78317869823d6c39bfdfa304f40e67867b8ca9c4269efaba12431ae59a1d54c671f38acb9e4fe3d23da54
-
Filesize
10KB
MD5eed5e4d3eb0ef75c96467a145ac21150
SHA183410f94b0601cb00257870989dce73c865b6564
SHA2566fef49fb880dcc94691e7474a0dbe3448146255a46f9fa6b781f2bb92978f9c5
SHA512efd2404664b1106f3f813b6933ad5afaa98bcc621f37242c9b6317f267fd4eec71f698a4a217f688aa884c19d89b7632f6595886328ac08701297c9f1a44f976
-
Filesize
13KB
MD5e465b102a7857e3794075c5798863005
SHA1b8d141569e5a4dd7f1091f1ea2bf1fca85f82d34
SHA25683b11e66e7ee616b2179f3a6f5470e65b248dc227db813710d67ce64c8adffa3
SHA51295ee6eefb53ac4b229360ca61f10a246946acb5ae932eb257359d1c2ed6fe7c73b5ad44a60c5c036d9498105299ef86d9744767ddfd7f7cc6c5d311a37df930e
-
Filesize
270KB
MD5cb2bf7a7cfca899b52489c8c033e9ac6
SHA1bdd386ff514ca5964e4a0bbf28a3b25ee29aad37
SHA25650c5f3e325f7bc6efce502a46b0d312394f31717677b5d3e843efadf462ff0a4
SHA512c40bdc4183a37f22458022bcb758fc0d1d3368af876c5209854e953815c2f76832ed1a819032d9e23fa86a6cde766535d523c063ee350932bf0b95c3f8e70685
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
4KB
MD533137fdccae221967ae33eb33b0c0aa2
SHA1e5e268e33c6aa679832f2f927123f32bd1be2db1
SHA256572cdcefcbff6178ef2c9fad9d8a183496ce9e962d0bcb31a663274f6a649ceb
SHA5122b7e1d588de55ba0a69e09cf45fe9a2dcd96edb191c8a5c7d2962bfd587bdc3d9bc98d226b30390795087a162c00daf130def52a8780ce0e6323af49fc426223
-
Filesize
6KB
MD5c84f69dbec0b9102c2ad9f3e91888437
SHA1cd157ddf8a502d26e3c50f4f2934b2bce936b6b1
SHA2569d81f51529e3db63c0d6acf64445a66f0980434e9e5ed9172adc2cc96f77cf3f
SHA512321b8f38e8898ccac32c0971e839ffc920b425a9b87b7ab83ea155302cbfac43196249a48a1916dd7bd9f56d77fbbd30690bba5cf244972ddc5058544abfb406
-
Filesize
711B
MD5558659936250e03cc14b60ebf648aa09
SHA132f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA2562445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA5121632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
-
Filesize
88KB
MD52cc86b681f2cd1d9f095584fd3153a61
SHA12a0ac7262fb88908a453bc125c5c3fc72b8d490e
SHA256d412fbbeb84e2a6882b2f0267b058f2ceb97f501e440fe3f9f70fac5c2277b9c
SHA51214ba32c3cd5b1faf100d06f78981deebbbb673299a355b6eaec88e6cb5543725242c850235a541afa8abba4a609bb2ec26e4a0526c6b198016b08d8af868b986
-
Filesize
12KB
MD579b907d356b27da4932086681be7d890
SHA15654c6632d43c9f2cd3d264d6a372a52dac1eb9c
SHA2564b8dc5620c2265e66d5da19dcbc15667711c38e7cc92a30feb1317e941c55a4a
SHA512724723da97d940d627dd0df9adf7b13c98c7ba1a6202383cfe6b359a7438774bece7743664efad0fbff6451b2df94fe3d06278f427ea61e68dfbb11bf45d7f96
-
Filesize
588KB
MD52d83c63e0e3cc035c2fb6f734f570210
SHA1ce8263a3d892e4efcdbf66ed94f3ab579dc374ad
SHA2569d66964b71c7112f18ed10bd9d8bfb6e1197b57eb0808b140dbe95e70f8942f1
SHA512a8ce2cfc5f9c02847823fc640bb71e21c24e13132de734e0c51ea362e819132fb045b421e2e603c86c577f0347fc2cb5053b7db25ad270dbc835c08a38992a3d
-
Filesize
1.7MB
MD51ee757926da2283fab4f8b8cd876da68
SHA1244c595504af628cc246ca0db8afd743c372757b
SHA25607e56a1687ce332bce1664371826be6d5912898b16eb9e3df3fe28e172af935d
SHA512444591cc806f05190a0e0c4f277c02f50db0d5014d5219fc6ba466d9c040bef86900b26db9d0d3449cdff9b08a7fb4b7e0fd107a9ca3c62d8c467633303b04f6
-
Filesize
659KB
MD52dd081669c38c1f783afbac854d538d6
SHA15202f1d4e977b3eaa4c97a7dd754858cdcf60d31
SHA25687f96edee69121f19f63ac461c59fc54970f7445b0f808db1267cdf7653cee6f
SHA5124cd8db6b67994ba46e4a0ad7c149956276cd9a13d87c281103f241652af185ff1bf6137dc4c2c69f8654fa507a957cc2e3dfcb14f060790594df99c6f046ef38
-
Filesize
1.2MB
MD53a86d9f0de57cf696530fef118b7c6b1
SHA1db60938abd3a8abb89006b941db6ed40e1da7092
SHA25611fd647c9525288e2497c0d4d582d0725917e3e33494881a7f3f43f3af65f874
SHA512d87c1669bad10f255d47acb34c98224f3c1983acababd7c55b294cd7bf6d5b68e2f3c1903f35bb2fa9c102de86c29877f11bcdd439ca29fb17f05df61a3f8af2
-
Filesize
578KB
MD56adf7cc715374817ddd646867877b0bd
SHA12a06d2b9a74c90a94cbdded968adefd71f424ff2
SHA256f09caf2222593651a1c0b39b8be03806ac7697509865c71648526e6a2c8c84fe
SHA5128dace83643cf852141489267206100ee3b5d6e2073d085886006169164a3c953419f0e6014a7fca347d60d73760093e33122f5ce86e6c90283f7eaf2e9784da5
-
Filesize
940KB
MD5aa24b27808d31b2c715b2640328b9554
SHA10ac3b6d75688faaea07587396ee8b9783d83529d
SHA256e67d7256f5997685d8adc5a117d6bdd83c860b40fc31b92138359f3229dc5c5f
SHA512916caf0dd95e3de8a45d4518eb53f26419b77854efa905094012b0f0b8237783f38b03632f418c40e308932864cee2a2a7b30c6739b8426dc82f83ee921e6a76
-
Filesize
671KB
MD5a0d5335f06f57ef56ff6c1c987377d3c
SHA17f0a036015ee05e31c4fa2e8857af705f49a6b13
SHA256dca971b0082f34c4f4975487ac3273095095909751a587e8004d526e1fe9ac02
SHA5124f875f8dfbc0fdb3d50d2058c480e57ca44957aa66c314ed6e5c7aa8becdc3dc06c381f5d0430dc134d76c86ffcdd6716abec13c7a21716f49fa1ab94a22c60f
-
Filesize
1.4MB
MD5b498da9e25e10e76b5818220d1b24203
SHA1db1fee1a508574fd757eec18882b40abd2091c40
SHA256cc0e17e85f6a10de1180f8fd2923488f1d975e1d32d58db9bf4b7185478926d5
SHA512635f6473d7802e0d0b0c0e8c62b45c771de2c41746c0430b53a7101189ae7c3a24f08129d51eb0645c4264c9744016eba39e6585ac32e1a85746a9674d18bf9b
-
Filesize
1.8MB
MD577ab86471085cc66e1fc7a67cb3418d6
SHA13dae994ba37899d133188799c381ed8ab3efecd7
SHA256da31676257cb1c02b666001da697d0991e5a3cb2ca2c8b07ef77004bbe688130
SHA51264016d2972d561ad029162f03d22e182aca9f8bb6ee5999882854e909f5c44fc7b993e2923f13ef46cb293559a34662e09fc02d301ebf76de7c938359b07296f
-
Filesize
1.4MB
MD5a65606d5f9d83d106ab9948b50568b35
SHA174ed90a6e3f1f3217cf9481bbf4527dc01e1af93
SHA256b6d9429fa402d1fc61cfad184667715019beb2490ae257640976838e9159e016
SHA512813e0ce192c4a60c4110cab7d62a7182fcbc348509658059cf95d815a4f6faa5495b5638ecd2730e7a30cd7f3138b1c851ea4f0632f26d39c3c5847546c5470f
-
Filesize
885KB
MD535ed7179f88a55e2f153df6389f1a086
SHA1f191dcf7a671c471c7d288ed4601678d6e9ad03b
SHA2567f9cd88c3642920806e0300291d25f4340231a9228fea014fb53fe6bebee5e36
SHA5129b85b6b32a4e73d0aaadd220bf1082ccbb9783fd36ae9c9f41b0868bfc148f0a45b83dd68305f2bcf64e5666868d9895b0e9f602b89437074009100057f2fa74
-
Filesize
2.0MB
MD502b9c63bb3c6c3f0c9f5095f296445f5
SHA14c5d2ee12dc90abfe9147dbaacce04cd70618fc1
SHA2562e028dfaf8beba56d6026f4071660f2702ad3cfa5808faad3056f8f2b0221398
SHA512e7f17c84e4a96901f1b30d1522decbfd19b6e84c5d5c61825cc68047aef95da96e2696bba26b90f5f29ef5fdcaabdc8ccb2069680582521f5fe2a3031358397f
-
Filesize
661KB
MD5c9cef92a92548ad68ba2afff84d6d090
SHA18da5266dab68a28885a4f35e0ebed96a9a159935
SHA256c965321a599ac8efb6c28a16881c4e732cbe7f2801f02939a2664d764b720c6a
SHA512e8639a1a25606337bdfb86e1a38fd8b82edc27a678c95b3ee929d0894304fa29145bf22f6a21fb940b31661ec85e27ae2cdb2a92ff0db85b0fe88bd358da0590
-
Filesize
712KB
MD5163a4b51784a57a1eb8e9e26a49b49b3
SHA17125156ee52d3fd8321377862b1207352005896b
SHA256460104f7bd4dd97f30ba73c14d30b2a8535a707047f978d8ce5ef1db064840a7
SHA512ed706d0efd2105822192e3c2e1a1e12b9749d16b1457015710a7f5d080fd47eaaf49615556ca9292ceec61fda24012e4965ca63859833dd9ebc840c82c669b97
-
Filesize
584KB
MD5b9eadd12fdb4f27b80eafca38506015f
SHA15ad98f03bc2db9bef4b7880dc25640eb975e2518
SHA2563493295e7aa98fb76a432b8255fac46a5992fdf8fc740a113e839cfa779b4ebc
SHA51250fbb3bbf4434b05e319ef99d927d902689833f630f9d46b232432aaf642dd813d8e416b5725a0f6e5843dae4e46e3d4577880fbc8d7b618b12cdf407fab7dd7
-
Filesize
1.3MB
MD50dfeb10c875ed08c7df6df240b65b9b4
SHA13ddef733be65d571435f905921115d95e0007610
SHA256580a2e877fa34dc43968f9ec8ee844c8d973835d8cf58dff08c30269f16826f9
SHA51299d7181beb3614126de6b5bf6292741d55a88d5a8573c50e08ac80405871bcdf6cfaaa15b8372ed88edccbfaaf66121aa7be9b0ea47e53dc7c4e70c886faf30a
-
Filesize
772KB
MD5d24050588a1df26d94adfaa0e3a279cb
SHA19fe4774abb04360c53eedd1d983574810435545e
SHA256fe711fad3b03de966338dc3fba8e549e3ae49bf36193a1e0f1ac72381f4b7e6c
SHA5125d79e4b0c3d1ed636740b42f2c5aca82068f3024ea5a0ade7a1cb29776e8b206e3da2aa204e1892e9c2ea8f66934352d4e2b7a8fd82fe4f7be1cbfed95f6f362
-
Filesize
2.1MB
MD52437cdbb874ced1b32343501afc511e1
SHA1e4324bc3d4561dcdaf609aeae1d31f1dc100f8d1
SHA2567c8a9e9f4de1dabb70dd2862ac9a80691f0018455f2a269b4c5fd3fae64b4da6
SHA5125a9391e250f531b641b821084f73009b54e6ff89500551a2c5e02381d0b9be34569e5435574008d7bd48720422b0860bc2c247a15d51dfd970e0cddd752ba372
-
Filesize
40B
MD50e1a0df5323f02fa141b11070035f203
SHA14662c48107aebe02429f78dc0ab4328f88ea9e8f
SHA256169bdddd028372b9c8dc1bbc8bc1a48dce9089467cf7c3b5967ebc20713b1bb7
SHA5125ef418e1f48b459f21f15f8462fceebbe5da2e16ff4cd02a614a6a508c1a9e28527c0d0778840600c85ba60d412de91e754b3aa0173ac4db70460367a2abc6e5
-
Filesize
1.3MB
MD5f7c4f0c6fee0660fb385ffeadbfe8b8e
SHA1e26dd1425369516fdc67deda1a7762b76effe971
SHA256d45aca8ba927dc006dd8e7ae23e3131c9b05745d6f14be594abf3732fd52081b
SHA512a1ffc1424e3642d9cd7638c92130b952a2112d99ce8ed8d8365da40941a9bfded7276f6e43c33ce1bdf1aca94f07de71414f745056904284877aae13a7219fa8
-
Filesize
877KB
MD59734aa668c9d65ce5d0c165105671001
SHA1c251a846399060f873d46a087cc9a1a8678006a7
SHA2562004c484e0a93d34349a9d79be7a84382d64861465105d84b98133128edf56e8
SHA5123dcf5ebaeb0f92a67cac7ab528a890334c39d7579f6b8952565edb731cf7503943199698ee85fb15cca6c2035f95680f24f144bb74a2da661aae9168fba1a472
-
Filesize
635KB
MD52d148d4be5f2fab29b94043ec5e81adb
SHA1ae92298172fe71a219d3102ec6697a4118124bd6
SHA2563745329df4455a963cf6c66698598acd086fb50ac9ecb59ef83b3e98505dd7a3
SHA51294796927bff9e68f29b65a0d01ff26b225e2e0735e46c0e9a01e11fc91a0d9764319d79109bec5cf0cd4f0d68c461e9ef385e9c976669e70e14495bec6b2ef48
-
Filesize
5.6MB
MD5d57476f543a0b3bb4d5540821281d52b
SHA12c09d95733962845cacf47e02f37fc2ede2c0d21
SHA256b1e6f121e79b7f76dbfb6af943811325c006821952c744fd1ed459596f05ea72
SHA5123804579aed0bf3d265cfa24fe3ed1a88908e16bec6fe9519340c76954669b42b74d0518f228ff8953d923e30e4371b7ccd49a760b57344df75814b7fe9e8c3c4