Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
08/06/2024, 08:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
General
- Target 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe
- Size 5.5MB
- Sample240608-kjg2labd83
- SHA256 3a1feb3d3c6491c529e7a4505cdc3dfb35fa63bb88c5403b6b62ef086a05f4d3
- MD5 e0bbebf1b6420cc0257589cbf8215c07
- SHA1 0b99696c1b2718c0fee74d4fcc22d6f723741c46
- SHA512 5a73cc12594435e158479aad32bdb72c43ba5803165c1fe174bffa9ac6e31b6b158e4cf275fe53f268ccd4f9cb50d808588314e95664d9e9b8a5502c9b6ab4e8
- SSDEEP 49152:FEFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1Ln9tJEUxDG0BYYrLA50IHLGfS:ZAI5pAdVJn9tbnR1VgBVmclI7K2mF9
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 26 IoCs
pid Process 428 alg.exe 3464 DiagnosticsHub.StandardCollector.Service.exe 3944 fxssvc.exe 996 elevation_service.exe 1016 elevation_service.exe 2364 maintenanceservice.exe 1040 msdtc.exe 1836 OSE.EXE 2064 PerceptionSimulationService.exe 3252 perfhost.exe 2876 locator.exe 3720 SensorDataService.exe 4800 snmptrap.exe 2900 spectrum.exe 4588 ssh-agent.exe 116 TieringEngineService.exe 4444 AgentService.exe 3316 vds.exe 4996 vssvc.exe 4980 wbengine.exe 868 WmiApSrv.exe 4892 SearchIndexer.exe 1148 chrmstp.exe 5356 chrmstp.exe 5476 chrmstp.exe 5716 chrmstp.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\SysWow64\perfhost.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Windows\system32\spectrum.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Windows\system32\msiexec.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Windows\System32\snmptrap.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\System32\msdtc.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Windows\System32\vds.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Windows\system32\AgentService.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Windows\system32\wbengine.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Windows\system32\vssvc.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\2d7541cdc3136770.bin alg.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\locator.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\java.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{372EF552-D8CF-402C-B62E-CA3A4C643A96}\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003eaf8d2b7fb9da01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a165c82c7fb9da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008fb95a2c7fb9da01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000adb5b72c7fb9da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ffcba2b7fb9da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e2fad92b7fb9da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ chrmstp.exe - Suspicious behavior: EnumeratesProcesses 41 IoCs
pid Process 3296 chrome.exe 3296 chrome.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 3296 chrome.exe 3296 chrome.exe 4304 chrome.exe 4304 chrome.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3296 chrome.exe 3296 chrome.exe 3296 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4916 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe Token: SeTakeOwnershipPrivilege 4316 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe Token: SeAuditPrivilege 3944 fxssvc.exe Token: SeRestorePrivilege 116 TieringEngineService.exe Token: SeManageVolumePrivilege 116 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 4444 AgentService.exe Token: SeBackupPrivilege 4996 vssvc.exe Token: SeRestorePrivilege 4996 vssvc.exe Token: SeAuditPrivilege 4996 vssvc.exe Token: SeBackupPrivilege 4980 wbengine.exe Token: SeRestorePrivilege 4980 wbengine.exe Token: SeSecurityPrivilege 4980 wbengine.exe Token: 33 4892 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4892 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4892 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4892 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4892 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4892 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4892 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4892 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4892 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4892 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4892 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4892 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4892 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4892 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4892 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4892 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4892 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4892 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4892 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4892 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4892 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4892 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4892 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4892 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4892 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4892 SearchIndexer.exe Token: SeShutdownPrivilege 3296 chrome.exe Token: SeCreatePagefilePrivilege 3296 chrome.exe Token: SeShutdownPrivilege 3296 chrome.exe Token: SeCreatePagefilePrivilege 3296 chrome.exe Token: SeShutdownPrivilege 3296 chrome.exe Token: SeCreatePagefilePrivilege 3296 chrome.exe Token: SeShutdownPrivilege 3296 chrome.exe Token: SeCreatePagefilePrivilege 3296 chrome.exe Token: SeShutdownPrivilege 3296 chrome.exe Token: SeCreatePagefilePrivilege 3296 chrome.exe Token: SeShutdownPrivilege 3296 chrome.exe Token: SeCreatePagefilePrivilege 3296 chrome.exe Token: SeShutdownPrivilege 3296 chrome.exe Token: SeCreatePagefilePrivilege 3296 chrome.exe Token: SeShutdownPrivilege 3296 chrome.exe Token: SeCreatePagefilePrivilege 3296 chrome.exe Token: SeShutdownPrivilege 3296 chrome.exe Token: SeCreatePagefilePrivilege 3296 chrome.exe Token: SeShutdownPrivilege 3296 chrome.exe Token: SeCreatePagefilePrivilege 3296 chrome.exe Token: SeShutdownPrivilege 3296 chrome.exe Token: SeCreatePagefilePrivilege 3296 chrome.exe Token: SeShutdownPrivilege 3296 chrome.exe Token: SeCreatePagefilePrivilege 3296 chrome.exe Token: SeShutdownPrivilege 3296 chrome.exe Token: SeCreatePagefilePrivilege 3296 chrome.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3296 chrome.exe 3296 chrome.exe 3296 chrome.exe 5476 chrmstp.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4916 wrote to memory of 4316 4916 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 81 PID 4916 wrote to memory of 4316 4916 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 81 PID 4916 wrote to memory of 3296 4916 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 82 PID 4916 wrote to memory of 3296 4916 2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe 82 PID 3296 wrote to memory of 1804 3296 chrome.exe 83 PID 3296 wrote to memory of 1804 3296 chrome.exe 83 PID 4892 wrote to memory of 2100 4892 SearchIndexer.exe 110 PID 4892 wrote to memory of 2100 4892 SearchIndexer.exe 110 PID 4892 wrote to memory of 384 4892 SearchIndexer.exe 111 PID 4892 wrote to memory of 384 4892 SearchIndexer.exe 111 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2164 3296 chrome.exe 112 PID 3296 wrote to memory of 2060 3296 chrome.exe 113 PID 3296 wrote to memory of 2060 3296 chrome.exe 113 PID 3296 wrote to memory of 1544 3296 chrome.exe 114 PID 3296 wrote to memory of 1544 3296 chrome.exe 114 PID 3296 wrote to memory of 1544 3296 chrome.exe 114 PID 3296 wrote to memory of 1544 3296 chrome.exe 114 PID 3296 wrote to memory of 1544 3296 chrome.exe 114 PID 3296 wrote to memory of 1544 3296 chrome.exe 114 PID 3296 wrote to memory of 1544 3296 chrome.exe 114 PID 3296 wrote to memory of 1544 3296 chrome.exe 114 PID 3296 wrote to memory of 1544 3296 chrome.exe 114 PID 3296 wrote to memory of 1544 3296 chrome.exe 114 PID 3296 wrote to memory of 1544 3296 chrome.exe 114 PID 3296 wrote to memory of 1544 3296 chrome.exe 114 PID 3296 wrote to memory of 1544 3296 chrome.exe 114 PID 3296 wrote to memory of 1544 3296 chrome.exe 114 PID 3296 wrote to memory of 1544 3296 chrome.exe 114 PID 3296 wrote to memory of 1544 3296 chrome.exe 114 PID 3296 wrote to memory of 1544 3296 chrome.exe 114 PID 3296 wrote to memory of 1544 3296 chrome.exe 114 PID 3296 wrote to memory of 1544 3296 chrome.exe 114 PID 3296 wrote to memory of 1544 3296 chrome.exe 114 PID 3296 wrote to memory of 1544 3296 chrome.exe 114 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exeC:\Users\Admin\AppData\Local\Temp\2024-06-08_e0bbebf1b6420cc0257589cbf8215c07_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2c8,0x2cc,0x2d0,0x29c,0x2d4,0x140462458,0x140462468,0x1404624782⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcaaf0ab58,0x7ffcaaf0ab68,0x7ffcaaf0ab783⤵PID:1804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1832 --field-trial-handle=1556,i,5151660991227964757,3938184402655736138,131072 /prefetch:23⤵PID:2164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1556,i,5151660991227964757,3938184402655736138,131072 /prefetch:83⤵PID:2060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2208 --field-trial-handle=1556,i,5151660991227964757,3938184402655736138,131072 /prefetch:83⤵PID:1544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3076 --field-trial-handle=1556,i,5151660991227964757,3938184402655736138,131072 /prefetch:13⤵PID:5076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3096 --field-trial-handle=1556,i,5151660991227964757,3938184402655736138,131072 /prefetch:13⤵PID:2844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3592 --field-trial-handle=1556,i,5151660991227964757,3938184402655736138,131072 /prefetch:13⤵PID:5248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4152 --field-trial-handle=1556,i,5151660991227964757,3938184402655736138,131072 /prefetch:83⤵PID:5560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4520 --field-trial-handle=1556,i,5151660991227964757,3938184402655736138,131072 /prefetch:83⤵PID:5572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4624 --field-trial-handle=1556,i,5151660991227964757,3938184402655736138,131072 /prefetch:83⤵PID:5992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4508 --field-trial-handle=1556,i,5151660991227964757,3938184402655736138,131072 /prefetch:83⤵PID:6092
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings3⤵
- Executes dropped EXE
PID:1148 -
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae684⤵
- Executes dropped EXE
PID:5356
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=04⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:5476 -
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae685⤵
- Executes dropped EXE
PID:5716
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 --field-trial-handle=1556,i,5151660991227964757,3938184402655736138,131072 /prefetch:83⤵PID:5364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4564 --field-trial-handle=1556,i,5151660991227964757,3938184402655736138,131072 /prefetch:83⤵PID:5592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4592 --field-trial-handle=1556,i,5151660991227964757,3938184402655736138,131072 /prefetch:83⤵PID:5816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 --field-trial-handle=1556,i,5151660991227964757,3938184402655736138,131072 /prefetch:83⤵PID:2160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1896 --field-trial-handle=1556,i,5151660991227964757,3938184402655736138,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4304
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:428
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:3464
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4520
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3944
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:996
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1016
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2364
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1040
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1836
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2064
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:3252
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2876
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3720
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:4800
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2900
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4588
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:116
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:4744
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4444
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:3316
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4996
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4980
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:868
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2100
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:384
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
- Size 2.1MB
- SHA256 f3ae6ec90bd5554c16094f9e1559b52ed518a7938f2509f3b2c3518db995d226
- MD5 79dc6fca36d54c71f82414ebe6337cbf
- SHA1 a0e942f0a362e5d9d494b36f999f9fb07bd73a2e
- SHA512 680f6b601eee8c9db8acd5a4061c5a8fddb09111e35618d28dc4b52569454f762ddfb37a48063386a2f2ee240050db6eaa804f8d23af060b365e5130ecd49a5e
- SSDEEP 49152:/uYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5EblI7a8K2mFhbrr:/PfTqi90bklI7K2mF9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 b8a8f3073a33e51605fed80a8dc0fa4549f4762d95b50496d05ef455855aeaef
- MD5 d2b4d8a3e7ee40e5cc9a22b431f43ce7
- SHA1 bc8742dd81d530d4cf088a3c225ed7d42a32ff5d
- SHA512 74e19c5aab78eadcf08e2083dc7f90b9c44317de9b0d0d8c3daf214f502edeb5711a1d4dbf456f76ddaf2f3d76a5f784188c311556c6d1035c80f4890c890e06
- SSDEEP 24576:2idnBsuElbl0fitGbna8FLk2m1X2D4brr:tSu+blI7a8K2mFhbrr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 6b8dc6042fac0a6f2862b74ea3d377357e362e12b60ccb90554fbf3b17faf2aa
- MD5 42099c19fe6c25a66c2703322a950198
- SHA1 18e402228169a49249ffc3e88531ff3a246bc985
- SHA512 2c1e7eac3d2f654e0d1b47fbf6c515a9a97a74a190f4aa94f742e7aa4cffd99301b80d017d7fad7e7d583c80210eac839909e05b7d1a386252ab5ad33252a892
- SSDEEP 24576:u+gkEVfh4CoZbl0fitGbna8FLk2m1X2D4brr:jgkExSrblI7a8K2mFhbrr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 442187bc4a29d7f9ed38bdd5ce1aaccdfb4673c5f6769011394797e958405721
- MD5 8e2a736d9cdd18fd8f7b3a87dbbeb076
- SHA1 acaf4c890290754856229002e3fe8b49d7a25e9f
- SHA512 a245762c37024e441d6366db3254bc39587c8b9e96d2f3550bbd20477c5de4f895a6feda689ad0b36b4caf4f71ecf342b6e7fdeda3a0e5f4559b4259e23aaf30
- SSDEEP 24576:yBpDRmi78gkPXlyo0Gxjrobl0fitGbna8FLk2m1X2D4brr:GNRmi78gkPX4o0GxjkblI7a8K2mFhbrr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 a143d0141923c0638c8cfda93ec7c0b7b0fc692c9e8c51eb780b3ea13c34e7b7
- MD5 07f1c36c9561b24b29755e13d9df126d
- SHA1 ff424bd9a7f75c8db08ccd51c9b55bdeef7c0477
- SHA512 0323615a29b9ec4446bffba3004e62361b232e31865388c12555aac40ec6843d55539857329c2df8ab36392933e2f91bbea67278def3f7921d78e5b5ab0b9ca0
- SSDEEP 24576:YLOS2oyPIXVZbl0fitGbna8FLk2m1X2D4brr:g/ysblI7a8K2mFhbrr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.3MB
- SHA256 09cf7a94b6f74f11afc94ff6f462bd21b569dc66c503fc39ffcdf1b96633a738
- MD5 c1e89981db3613146f02f53159b818fd
- SHA1 ad18261e7c75e91561788dafab2fcbbf405e82a8
- SHA512 48ad45329877a8ca33c0b3b311fdbabb07124ba922aab709057af47da5b015fb828195a449436c3b645072a969d1118e5949e02b81020c6100920502b6d760a1
- SSDEEP 12288:kfaSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:kfLbl0fitGbna8FLk2m1X2D4brr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.6MB
- SHA256 9fa3bc7c9fba59e2639e509e9545da98e435c6f0c0bfdf090a44bcd905fbd01b
- MD5 31a5ba6a4fadf14eba75f451e536917d
- SHA1 f978b23432da1f30db032809ec9d0eebfe5d386c
- SHA512 f502511d515f2dd8c1e38c915ab0487c2182194e59db5bca5e1ba96f462084b77e5a0b32a3018b7c5491617c32c2e5411e070535deadc702ff507c517c06c417
- SSDEEP 12288:IeBNUbTVO86UPSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:IJIU6bl0fitGbna8FLk2m1X2D4brr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 454198d6e501a0c91c1b3057817ea7560379863d32a0c32694f6f93a85eeb76e
- MD5 782107656e0f7fd09040a7b2eb656fcf
- SHA1 8fbc082f2635535ca3e360050b7b04dcd92dc423
- SHA512 f11b828133e4d20419b9b805db1bda25e025ed8f2ce3aff8196f0ec025efa99ab10746da8f5db48e83dbc985ee44075b6c771b157eabb2a0b089bf2e24c38c7c
- SSDEEP 49152:kQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THa:kQvGAdlCEL8c/yRNw5CRlI7K2mF9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 2b364fe89f7f72ae3e48f88149e0062a5bf861d08168a87d8fd007352b8e3dfc
- MD5 579676f8a9b70372fd8ee0047265b180
- SHA1 326ce56250d4ed3ddd31410ce3c941d3072ccab1
- SHA512 ce65953aaddddbd6493efdcc31ec6742adc8f455a7f00e9ba35c14150c43dd0ef6fe675ec5ee3ce0003318215fce2523afcf59ccfe9b94d9c996803a20939471
- SSDEEP 24576:9dewsAjwbl0fitGbna8FLk2m1X2D4brr:zljwblI7a8K2mFhbrr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 a910ea3a01a6cacdc08d5c60c5fce67cb658f18ca519c0164295bc35cc83ad4e
- MD5 209262e3b5c3673299d0a2bad598cb12
- SHA1 33b0a19b6e1742a26e05e8c1ac3f625e88b52577
- SHA512 ad586962523120d9b8da1f8ccece63ac01e4905bbc30fc1cc8e8da1db5a5d1346881c44bf66648bb3a7b516b0b2cc06b9f741cf3f5709fbef25bc9ca3108d9e9
- SSDEEP 49152:oCbRquA/m2yL5zTfFiV+XenmE3/zQblI7a8K2mFhbrr:BoquVjnm9lI7K2mF9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 9dcbce96c51ef883776cdf20f46428213e43fc27de85c10ada95c3cac9c585e9
- MD5 c1aa35a19d09b6fe5ba73118309086ab
- SHA1 64231a931e5cb83758b274ad374f228f32f946bc
- SHA512 4b55ad9181bcf23cbd2a4094b37c2639800feaa0afac3aa0ef3cc63750b1c42831ec4cfb589743001798d8266e4f9c9ab1485d952c6d6aff56612c74a216096c
- SSDEEP 12288:8mw5HEjsChNVBFgl0WDm+CUSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2co:5wuoOWsbl0fitGbna8FLk2m1X2D4brr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
- Size 5.4MB
- SHA256 a687c9ab531b3da7fcb0590f063c10d16eba16e1c60cd97bc0ba16c442b2371c
- MD5 9f7d0d362af1aa49315a584c1aa1d606
- SHA1 540a02e07bf052fc0882715f745cce3ee016d023
- SHA512 7a4a6f2490addc7c8a4e2d2f49e93db980228846d69249b66c1cb7d5b9a846c824b66410291a880c6c38e7f9bbb826f74eae6913205e95231ca4c19b7f225c56
- SSDEEP 98304:GwfhY7g/rLd7yYA3awr341g1lI7K2mF9:278yh1lqmX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
- Size 2.2MB
- SHA256 8728b47caf4f34ff4ae24eb99a3c9f18d43cda19d9724f44107bb4b4fb167832
- MD5 390e957873d512e1b2365eeacad9d98a
- SHA1 3b76b6bc52d3448b146386cbe5002fa2f5cd2fb9
- SHA512 c6c8f9a7b3685efd589646774f6cb01d82586ecbcb47510c02d3fe5939dce4113f6428581c1a8355fe121d8f567323142870a8a69ab2534df16bd49ca5d3bb9f
- SSDEEP 49152:Sy7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxwblI7a8K2mFhbrr:JmYeyxHjWjMTklI7K2mF9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\SetupMetrics\93260f15-56a4-4fb5-8f60-571c2e8068fe.tmp
- Size 488B
- SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
- MD5 6d971ce11af4a6a93a4311841da1a178
- SHA1 cbfdbc9b184f340cbad764abc4d8a31b9c250176
- SHA512 c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 07adf2d7097a7cf61d8344c3484599af75ffc01cb1364e200a73ee70e6b86632
- MD5 3e1513083a2b2490ff5294a68a561419
- SHA1 58e288d884c362b8988957ea8f897e6a2e74d72b
- SHA512 84dd7d1ca3a31f871818f8c80a300f15c72b72b120c981ffe0f20ee0735b7ed7d212d77ed063c9739808c9c3bd5a325d55a01bf92c4c3baf7451f5f040a65bdd
- SSDEEP 24576:bcP4mcvIjkGOxhKP2l71SNKbrh/8KBXbl0fitGbna8FLk2m1X2D4brr:QP4m4IpOO67N8KtblI7a8K2mFhbrr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
- Size 40B
- SHA256 d0c09cff1833071e93cda9a4b8141a154dba5964db2c6d773ea98625860d13ad
- MD5 757f9692a70d6d6f226ba652bbcffe53
- SHA1 771e76fc92d2bf676b3c8e3459ab1a2a1257ff5b
- SHA512 79580dd7eb264967e0f97d0676ba2fcf0c99943681cad40e657e8e246df1b956f6daeb4585c5913ca3a93fdfd768933730a9a97a9018efa33c829ab1dea7a150
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
- Size 193KB
- SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
- MD5 ef36a84ad2bc23f79d171c604b56de29
- SHA1 38d6569cd30d096140e752db5d98d53cf304a8fc
- SHA512 dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be
- SSDEEP 3072:HXm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4g2rJBXCy9enoN:HXUMCm4U6q62MEBi99g6JVCvoZhhl+No
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 b3428c65f9855806e76aebe6c1e912ba55928e990d8b12e079820df756822f5d
- MD5 95b914aab7659f473fc1259aa2858dae
- SHA1 39792578979735ff06166e4e319ab3afb48e9713
- SHA512 1fcaa4603bad7bd2e31b43f0c0cc29a7a8accad87bee857e68d04d3157a7fc5f665655584be900a3d804bcda216656a9fec344bce691e59d75cb3bc1e481f9a9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 354B
- SHA256 4338ca819aadb89fc4b7c57e41dad53b021a60f447981b156bdc4805fc88df15
- MD5 7318fb4a8c3bd7626be08a9b702ee290
- SHA1 5d7e87fa58bd57f002a9132b4768ac3eaafa699c
- SHA512 8ad4848d793230ac7fc32ef031e2004bb942efbec3120f1ef26b4eb5c8bf980a22fb2e838821ead945adb0d8dab96a4a6cd9d4399417c7ec08e310965ffbf8cb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 5KB
- SHA256 c33ccfc0d6e4e82c652b7e6a091e40bec572f266faa3d077aba0c8f2977941f5
- MD5 e9c7ac5fc1d94eef36e82ae267f325d3
- SHA1 59ef2aedb13e9f735c4aa1f9c83efadee25fc69f
- SHA512 98395f6349a96f7c7be56c90fce0b54f79bc91e26f8a2f51dab67e86f13bb5bc6b661166e783e98f945827918142248677dfc5886df5b059db0e82bde3de924f
- SSDEEP 96:d+LgXMFeXU7+sZPHrSUWkJcD8iZRy7Dx+6MSmueqBO+7TF2MEVMup:d+kXOeQ+cHrNpJg8syh+F6vTFPU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe57830b.TMP
- Size 2KB
- SHA256 d5bb9e1c53b6d6dd67dcfdf3963d7d8b0dd3094ce6a86851e8b8ab7d3d6f235a
- MD5 6c38709f2b92b4197d45f6df3df81cb9
- SHA1 92d1adb3512f085dba8c03ea68d926704ebbbda3
- SHA512 3cc01f22a75c283dd55a4fc9b02211776bc1246ae7787ffeee21a25d0ea8ddaafbb70cbe8d0976356fcff59c9be8e9c178c15264d2a44df3653bb1e03fe41bf9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 4e05269c3bebb7099836cdf9793fa07cb5a220eeb27c99fe0531eb535c7fbf81
- MD5 f95ff0b556626ce65d4c4a49a961f982
- SHA1 33e9e2aaa9bcfcd41b7ce01cfaf5433fec49c9e5
- SHA512 f79c111f32ce74003fecb4615616cb92d54b8153a3a5b2f912b44f0021a56ec71b203995be9391b155c23dde5cbab7d882471786140b90cd799b5159ea66a0d2
- SSDEEP 384:O2TGLPLeR/X9f1kXqKf/pUZNCgVLH2Hf9kFrUi7HGi+k8Z:O0GLPLIv9f1kXqKf/pUZNCgVLH2HfqFQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 265KB
- SHA256 bf5c9f7f299c6bcb4b5c4b4a6aec47dbcefd2747fecca0617f00986b1cc099c6
- MD5 5cbe0e071341d6aecd0829e2fafd92da
- SHA1 80dcb9b62b9ba7d9b0ee04cea0f652d1476eaaef
- SHA512 416cda4bfb02c64d4a685f15268d1ceab37753102577fdc30b34326deef2d701bacd2894b8ab2d0279ef3e24a9623cf96c127cab3d94bdaf9dad808062f3d7dd
- SSDEEP 6144:Fd9KG8t2jQMcAPNmXrI1Qo5yzkpeXjnJFzXsWi:EkQMc+NmXEjCkpeXtFb+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 257KB
- SHA256 1d53ff0e64dc30ebcf212cfe439a3fe3265851e4abbbda0ae17975b45bca21fd
- MD5 2e857799d79cde1d864738a6b72ebed8
- SHA1 e95670a0af3ff1d25275555f1bf3ada23993179b
- SHA512 283ffda4af250327b9d63b51d22f0921def1707566a85f23b3ed0b93f1f57ab4a7485eec690b2a05b186e89296069a66e64f35e61126680310c0a1c084104e73
- SSDEEP 6144:HrI1Qo5yzkpeXjnJFzXsWuQYRPILxZnhLMJjX0EeGzY2rLL:HEjCkpeXtFbaQ5fnReEFsLLL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 285KB
- SHA256 ab09f6f95a0e4d6d5cb0f18eb5762fb12aabbfe99aa301865ab4f8abb93f02a4
- MD5 2c70dc71fc9455653bcfb09de22bc1e8
- SHA1 f5c8d67b28850e17c4b521541ff5aafa7cb4662b
- SHA512 87cab7b72164e8d8989a0bd01bf10ed256ed178d83d395bf7be8abcb5e5ddbd17fb91cc8aad76220b90df6065e3d65beafd878b84c8d5289d87af10f0c287548
- SSDEEP 6144:985dqG8t2jQMcAPNmXrI1Qo5yzkpeXjnJFzXsWi:93kQMc+NmXEjCkpeXtFb+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 265KB
- SHA256 a872459ea809867937de275f269d11fedc0997b1f1b738718d8dd7c475d043d0
- MD5 cf4ebdbeb818e2a897feac718aa6fa95
- SHA1 1b32c6b56127111175d7ec1e7d4d257a50269ee2
- SHA512 1912c982a4edbbbe2d0f8ea9b38a1e5c462f5f15befdb40b9cab0f6f0251cc23d96d7546dd51a4e31cf70ce7135c5afce6e59fb946f49b87fa6912c029821c24
- SSDEEP 6144:RG8t2jQMcAPNmXrI1Qo5yzkpeXjnJFzXsWi:hkQMc+NmXEjCkpeXtFb+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
- Size 91KB
- SHA256 19925faaf687aad92bf1c1a193f8dd50fb2b26732151a5522659677c39af26b5
- MD5 a5a0e5819250d28af85dec43783171e5
- SHA1 c5c31d2d6b04a2c608600bc96804ea973b4d939f
- SHA512 e6c74756b6f000ab8e7e9f0e79669592939570883b04ec6db53dbd6c2977df975a3908658fe6787724fdf28d6d2d8684c10c95e1ec91e1a815e1671830002c18
- SSDEEP 384:39ubxEQTDzDjlTgimQ6LHFPqpLXuYjEV5pEN2ddHxcacbyfNTMA2v15JzG+XR3XX:yiQKMPbyhgxQ3JkWKOOVl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57f879.TMP
- Size 88KB
- SHA256 b5fadef2882018e24b1ed46f023eacde8637962bf7707acea52d76b330f88b77
- MD5 034c5a2b77071c5514239f8c50d5296c
- SHA1 bb9b6a534da2a7fa8a20d6ee471608c623c0499a
- SHA512 e9cd93862fce37393ff3955707908ce3d69c0ad9db29f7dc77c276ce2060d7a3b41b2cdc4b86244fafaad743feedd8f45d6be0cb85857a27c7a468e4c730b8e4
- SSDEEP 384:h9ubxEQTDzDjlTgimQ6LHFPqpLXuYjEVgEN2ddHxcacbyfNTMEv15JzG+XR3X9hK:0iQKMPVyhgxQ3JkWKOOVQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
- Size 7KB
- SHA256 8b8861cf91033de4487137e65250f3c54371ec15e527bdf32c9c2727f2b9a68e
- MD5 7b42d858c297f5ff97348f3fa3af5fd9
- SHA1 39ee64ffbb204bac8452a14b7157dfdd66e607bd
- SHA512 4a6876f6069fa6ef7e514430de038d5972d1bafdb8f37fe7260580f17722b845d3a319e299d6789d6815b6209df16a7552afb40e99ecc74c742d92a80b47be05
- SSDEEP 96:X04v+feybLGNAwK3yK35EIU4UTR8nsXwK2wbK2Wl+SyfnLjyq:IbGn/gU98nEhjR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
- Size 8KB
- SHA256 1481a4915b693d4da9be0b95ca9c8a6a9fbb188a9aaa580de4d744f8503918df
- MD5 8679166160bcf27f220cef9c0966800c
- SHA1 42f4c07f0771a120de749072c37477ca1926134f
- SHA512 c82f40760b1f6bf8d331243f031f33b2e77c49553c480ae5c87f8b06c6191651c49160c050b27eaf5004a1972e9836a57f6cd82a88e3c7e6de7f09c44c0dcdb3
- SSDEEP 96:X04v+feybLGNAwK3yK35EIU4UTR8nsXwK2wbK2Wl+SyfnLjyj38Ne/wK3vK37h:IbGn/gU98nEhjJNDqq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\2d7541cdc3136770.bin
- Size 12KB
- SHA256 91a28e328a03ac863c370a2ffb361251355b02ca98517ff3136e1f8432d9dba6
- MD5 4cfda4d17f03d328d76236c2c56a4c7d
- SHA1 5b348832cc7b2bd25dceda256b2df3170955d7a2
- SHA512 16b29bcffaa4f11a809da4d33f3e180b4b3ce97997ac4465bab4f8ddf3bda9df454112699b38617453634cb36ac5e2533329e7570dd67f3e66d5c315862036af
- SSDEEP 192:uFJNv7bcn7fJC4VdHJmPULRC7kP9syl+YYz8eV8xQ0iCo6zh0qBGxvcn:ux47RCC8Pygs9r3YW1zh04
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.3MB
- SHA256 df6e8d866a0dfb87608c928072beadd1eaabc6976800c5d2a606cc061b00d440
- MD5 5185e8f3ca99aa8430c87c2d9e44a7e8
- SHA1 026e600e157437b5970bd193a92ccf6bbae38f4c
- SHA512 b8d8b2d6f3f358ef884d3b6a7e057c7476d78b2c558e81cd2e725bf7f3119853625b0ed58ae20d1efbc3fdd5fc759d4ff2aa454359534741d0ad581522c461ef
- SSDEEP 12288:YmSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:Y/bl0fitGbna8FLk2m1X2D4brr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 5a1b88a6222fe74a74c2da1ffb0aee468ca9c3ceb73e500154fd5c9b05e9f970
- MD5 1e30b438b391065118fd242dd89467ec
- SHA1 381682db8bd2cb8fdb0ce45ec6b3fd281661dec4
- SHA512 cdf30e0cbf6fa677c3750fdbab4ae58add67a454ba4376595699cd73d4adef575c5a1cd9e465818f5c65cf5e9d51c6739cdd0f890dde699df8f48fe015865dc8
- SSDEEP 49152:qa0h2GEkuAe73q3pp46zwwQRblI7a8K2mFhbrr:qa0hNYG4JwMlI7K2mF9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.4MB
- SHA256 0e34ba0c008c81ddf53fdeebfcc0031770e96dbd5ff49c858c0fa3d91eeeff76
- MD5 1bb5abb1e0d157ad3f022ac84bb2ab34
- SHA1 a808deec7bd8578deec42c41d9801d36c02aaaa6
- SHA512 ddf0f9f6f3cc0a775b59eef220b55b31648c82904b264f9fe6dfffd039d6831bc207cdae9637afc05df4195c424b891e53bde2853d69504706fe1fdc4b528793
- SSDEEP 12288:7hbHjfXJSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:7hbHjPEbl0fitGbna8FLk2m1X2D4brr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 e61b6bdb1337df2aa8df5a65f01b2e014fb3a14182272b21c6d6902baa75ec93
- MD5 f3d60480479212050a3d7512dd46d650
- SHA1 e601812ba626815e15815bcdd13560fadbca60b9
- SHA512 28260d5e92b65b575784cf0edbeb4508890f2a981e096f4532bbc614636b616b7b3d8de055f0d93df3408963f24f4b786f2148fac26beff727b971c6dc659544
- SSDEEP 24576:Q3YgnJcRTk4yti+R5dpR/sbl0fitGbna8FLk2m1X2D4brr:QIgnaTk46ppR/sblI7a8K2mFhbrr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Locator.exe
- Size 1.3MB
- SHA256 44273729ac13c74ff5a4dee7b597c83f6efd9a2284865228bfc8bd13b57f4414
- MD5 0e7059659337d1799496d79d5c0cc816
- SHA1 a3e6fdb2b7a565ea77bb96d3f3476a6f8d1a992f
- SHA512 d7adae2c496314fd4a7d512dfa746947923162b6fac05772b17312591cec9315b4ae787491804983547853a64e4fc10f572cea8dd2d8395f33af1141eb7d8da6
- SSDEEP 12288:X6Sbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:Xrbl0fitGbna8FLk2m1X2D4brr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.7MB
- SHA256 f78326c9bf10b9532196dfc32a9f98cf35cbfab6772fa262d65f4661c7a4de75
- MD5 19a9a2e5627a0b2e62d21c41a2a6a70c
- SHA1 5a59bb67f1c02bdc3ff316e3382a48405378a3de
- SHA512 b2c10fc4a449122e1fdc0616e81693699b98818c146577676101c8f84cd0ff4fd29b145ab5222b2ec4e99685494daf8250de10bffc8b0b75680b6fc6fbd23a10
- SSDEEP 12288:jOb9A4LWOsvAYFTbSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:MpL3UTubl0fitGbna8FLk2m1X2D4brr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.4MB
- SHA256 4442fbbf4198860f84462d7f8f5939becb49089813c168a24823a25f2b2d528d
- MD5 034f0279ccc0b9eb56a15d3b3d4617cb
- SHA1 3cea5f597796c48a969d658ae116d09b507ea1f5
- SHA512 514987d1029ed736b5000515ea14b7e6867474f831139ab9893b9a4998ab1343a082720c0e99998b3d572328346770c05df85b9256462a6551b7f108287a127c
- SSDEEP 12288:7pFtpOvSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:HOabl0fitGbna8FLk2m1X2D4brr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 766da90bf0299fee1c86fd5a6c069d0bcbac787265b3a2331864797fb8175788
- MD5 ab11c5d1e83b71ef5d0b78c3de16e190
- SHA1 cdf87804968311255657faefc65a56536f14f303
- SHA512 21db6befae048e6c6562ba4f099c3e0600eef73f11742e99b02956a28d9e65e9bedf2dafdbf0c38ccf69482105d44ed16e1351006142236586344ffca44b9af2
- SSDEEP 24576:77NM9YmZqmWMUkPjZM48Mv6bEhsPbl0fitGbna8FLk2m1X2D4brr:77cBWMpPjN8DbEhkblI7a8K2mFhbrr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 4dbd0657c3a26568dfb1358aad3575cd56575b52cad307002cdd7a261cd1f250
- MD5 0263050662fd182e668124d7b85b476f
- SHA1 02ee72acbe5ad4d49e745f21e4882c3c090bd924
- SHA512 78f46e4db866e7357fc0978b4198f7d398476f9954d010c9ab30c704ce5e0e7c7ef35a2e71a6b41498bb8ee8336716a273282a02449692c05cbf6a1f0bec23f3
- SSDEEP 49152:pF2YuHNETovcvNYf8kmvblI7a8K2mFhbrr:c6tCf8kOlI7K2mF9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 b5543b028bb83545e7205395f193137e53bbbaba28ed5fc771d8bbb8915b370c
- MD5 f7f4e137a4532b329fd8d72a78a9b4ae
- SHA1 1eb87fe33f20fd06fc866cd4059bc960cd89cfe7
- SHA512 76ac878efcadabfad3a02a2e8a772a719c956b251a7b79337ed6a9bddc38061aadcdd0e6c8e9796562a07c7f0e22de5f63e8f61dab3047c4f4d7a053e7968bc5
- SSDEEP 24576:yAFs06+Omlf3NXEbToGbl0fitGbna8FLk2m1X2D4brr:rFs060lVXuxblI7a8K2mFhbrr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.6MB
- SHA256 3ca635aeb32d056b69cd6890852ac596456a868069976712a53a5da7020be0a8
- MD5 6ac63e3581e09e7dbe23ba5d9fddaa4a
- SHA1 e1fe0a06249bc11ac3c275b17fdea4696873cd75
- SHA512 f473989380d41b25397102fb8f663d850075bc035a2f4043e4c8baf775f92f7760f70105fd512c39674c9a92bbce36c9123076c304aa61ed799b446f3fbeef1f
- SSDEEP 24576:4JnJ5D3Wtxbl0fitGbna8FLk2m1X2D4brr:4JnJ5DGtxblI7a8K2mFhbrr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 1362748391f0f0ad8ab3e32de34012d08832aa06ae6eb009d3b64b5d93b04ce9
- MD5 d63ac61c5f8a8d1123c3b09077c614a8
- SHA1 fd9d4e2e756a2e0b88b5726a01a611f0a507a3fb
- SHA512 ce80d0e896794d283753471621b3b003de5ffbe354e99b24a4bb4d00e903a8217fcf4e2ff08b3d2b9c24ac6d7f63b105c2f1e2e3998182f97ccb751fdbc7540a
- SSDEEP 49152:Mo06DIKdwc+eQnSt65aVDblI7a8K2mFhbrr:BJlI7K2mF9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\alg.exe
- Size 1.4MB
- SHA256 e382a648b9104a67b00efc812ba8ca5f3d95cf6c0d82f31b47fe01f49ab15fad
- MD5 abbcb235cfb423243818a34e206f481a
- SHA1 12153e085dd2433ab0ffd225ae40abeb409880e8
- SHA512 1cab3e1ae83e4b8a5ebbb7debfa6308fb650eff365aedea53e93355a218e9288462aec89eed7e6fc4463165b59d0d94da1ed61f213ae1ae63898ce51021c3d01
- SSDEEP 12288:SEP3RrvSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:Rrabl0fitGbna8FLk2m1X2D4brr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\msdtc.exe
- Size 1.4MB
- SHA256 80181a9bdbae48e857bd2d2a18cc3e3c068b8d5444b58fcad8d7c4c4dda4f68f
- MD5 a2b4a4eb99138ffbc462770ee2b2aac4
- SHA1 42733029f794a8dc92afba617379c111dca87f66
- SHA512 2d8c03cd18b15053322a877ac8036cd90b6f68d7c5a033f4f4e35944a5f0f657c458d0ce9915a174feb956c5339c2f2aa4121e13def23ed005e9aa036044dbc9
- SSDEEP 12288:7jkyZSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:7Iy0bl0fitGbna8FLk2m1X2D4brr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\snmptrap.exe
- Size 1.3MB
- SHA256 8d8ab9ad61f61caf48705d37350295c37aecc4703b6d3157f5a955523839deea
- MD5 d16e0160a4dff23f3ee94457ed65a472
- SHA1 1a6c6fddec7442bf53d7a289e45f038bfcf9b551
- SHA512 c9711d5bf06a5f2420867ebe78845b16d01d5073e195ad3de55fd60115fea180610491fb0d3a4a4794f3a9d3105b81d902cf1b70d7ad1af3d73f53cb37faadae
- SSDEEP 12288:0F/Sbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:yKbl0fitGbna8FLk2m1X2D4brr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 3b7c26eb13f5d6f10c24fc271e09a21caa59b2f574b63af8e6e674b362d6ab56
- MD5 041b477af085e05308bc640b4d4bf64a
- SHA1 0a2b45bd31eb6a055b654ae75bc692f8221b30d0
- SHA512 95eb61fcadbe099b5d2abfe48c2a3c123b1e21cd2b8e027cb3c38698ace8d3c508dede44f1195e9617e0b2b78304da6499042599e070b49ba7ba196815a02170
- SSDEEP 24576:WQ9MxZKdcz97w3nbl0fitGbna8FLk2m1X2D4brr:WVKXnblI7a8K2mFhbrr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.5MB
- SHA256 3ec440571e378a405aa26ea66117f9ae9077b05b7bbb7d77ce304829f449dc2f
- MD5 4145f5d3caf2ebea0ec6517667c85076
- SHA1 0f15f01866bc5c7246d28ee3f3de1316f9c51ed2
- SHA512 52df24551c96a49aad1d5fd841a82617676926404f4d308c7c5631131fd8691305a17a12dcbafafaeb4f409c3326617929aa1b4b6bdac9fa285651596cc353f9
- SSDEEP 24576:gyocxApwbl0fitGbna8FLk2m1X2D4brr:tocxApwblI7a8K2mFhbrr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 e9037075a5aeb60e39e2d56b80a98c5063188364d33557899bf21e8a7d4ff9d2
- MD5 202a7cf4fee2ed80be5921292feb8040
- SHA1 efd5aeeacb1392bb0da068217b4f07f751789a4b
- SHA512 3c8724f894ab17ae361a6110ad96a673ec2c7d9729dbbade8ddf445d8c233779454bbb5eafe6c5ed18646cacc4b0c7d244a148630e0e6189a78199f77b0f9489
- SSDEEP 49152:UWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKwblI7a8K2mFhbrr:+0zuNIAlI7K2mF9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\Crashpad\settings.dat
- Size 40B
- SHA256 b04e4a8229ad76f418899a184586a34f1da04653efdd8f0386b76fe7282bd7c4
- MD5 8323eb783d4b3475bc1107f7b22fe30a
- SHA1 8b61ba2d4ceddcce64913e45b0b3aaedba641153
- SHA512 a6e5fa59549dd9f848741b7c5e0e99e3efd1ac639e61a1a430fe7a62e6f13bf625fc22d619b29e9319f0bddd46eda6bd61057d4afcde7c846a72bf6e4ef79972
- MD5 SHA1 SHA512
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 3c098e231e1275607f2735d2d9738eb83edfe653386de5f2e542a3e1fa029cd7
- MD5 ca44d330628c891e7ac9db885be0d0d5
- SHA1 798e41012fd8c95bb261cf5d0c71e51df4efc545
- SHA512 cd380a976aca101575b52f05a5b46d3552daeb75a5f5d9682f16b7186821982c78727e81224ff3582ddec4e0ffffc634402cb8072cc52b08a914c53cbc9b3615
- SSDEEP 24576:p1QT7EcpfxR+N5AWAz3ooiYtjMqbdbl0fitGbna8FLk2m1X2D4brr:8TDxR+N5YzTfjM6blI7a8K2mFhbrr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.6MB
- SHA256 f766984635eecdc5e4a1215185949d0c19b351d956a69df4e73d8ac52f170950
- MD5 64d6c084cbfa713f875a5b79691da301
- SHA1 c45751fefe60151a7ca9353e810e9556cb968ff1
- SHA512 4dd063eb3e565c38b469ffe2c1e18c6ac7dea11ca74b8d4d43674309a7835eaa7d272d491fd63e763c21ad6c15fa84410c7b123046b038d4ed5fac3fb76342a7
- SSDEEP 24576:UTMdOz0FFS+imSLJbl0fitGbna8FLk2m1X2D4brr:c0K+imSLJblI7a8K2mFhbrr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system32\msiexec.exe
- Size 1.4MB
- SHA256 20bc9bdb236cf5821243d840c2d80a700e52ce78d10b11975bbcd797fbd64af1
- MD5 1768530c4ff4ed7191a489635b0212a8
- SHA1 b8287fb33b719961fca9aaac069250b3a70785f1
- SHA512 47a3c1fcefa9bcf6c3db4d7964480b8848162d23c52778976bc07474e62dfbe9da168e728b8c0ff460fe5621878a46063376fd88684de04ffbf8142230e3ca8d
- SSDEEP 12288:P47bSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:6ubl0fitGbna8FLk2m1X2D4brr
- MD5 SHA1 SHA512 SSDEEP