Analysis
- max time kernel
152s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
08/06/2024, 16:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
General
- Target 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe
- Size 5.5MB
- Sample240608-vctrxsdd9w
- SHA256 87afe3d6bf659cbfbda1060af18cdf8704d30c85cea0c1f8c5065de4a3880b1d
- MD5 1fd9cc6635d5489ebf076abe80fe9604
- SHA1 3ef79a88036baf5bff71f77cf0c14e39100789de
- SHA512 5826b81e6b9bdc09f478d57bd83a22865af04f5bf0bb1b502b313034c1873f4bd3cbd07a03d358bfc53267a81e2d7f3b80022612b294b4127b6758a3c281685c
- SSDEEP 49152:qEFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1Ln9tJEUxDG0BYYrLA50IHLGfs:AAI5pAdVJn9tbnR1VgBVmiQWdO
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 1080 alg.exe 972 DiagnosticsHub.StandardCollector.Service.exe 5320 fxssvc.exe 2644 elevation_service.exe 5944 elevation_service.exe 5484 maintenanceservice.exe 216 msdtc.exe 3332 OSE.EXE 2200 PerceptionSimulationService.exe 2952 perfhost.exe 2484 locator.exe 4040 SensorDataService.exe 2228 snmptrap.exe 3376 spectrum.exe 5988 ssh-agent.exe 5472 TieringEngineService.exe 340 AgentService.exe 2376 vds.exe 1484 vssvc.exe 1436 wbengine.exe 4164 WmiApSrv.exe 2912 SearchIndexer.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Windows\system32\AgentService.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\5f0d5858b3e2edcd.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Windows\system32\spectrum.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Windows\system32\msiexec.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Windows\System32\vds.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Windows\system32\wbengine.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\locator.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Windows\System32\snmptrap.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Windows\System32\msdtc.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Windows\system32\vssvc.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files\dotnet\dotnet.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_156609\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080d75735c4b9da01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e93bc37c4b9da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008a4afa32c4b9da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d33a7935c4b9da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d2ee9436c4b9da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed0b2934c4b9da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091d6b133c4b9da01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 532 chrome.exe 532 chrome.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 4996 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 2868 chrome.exe 2868 chrome.exe 972 DiagnosticsHub.StandardCollector.Service.exe 972 DiagnosticsHub.StandardCollector.Service.exe 972 DiagnosticsHub.StandardCollector.Service.exe 972 DiagnosticsHub.StandardCollector.Service.exe 972 DiagnosticsHub.StandardCollector.Service.exe 972 DiagnosticsHub.StandardCollector.Service.exe 972 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 676 Process not Found 676 Process not Found - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 532 chrome.exe 532 chrome.exe 532 chrome.exe 532 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3296 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe Token: SeAuditPrivilege 5320 fxssvc.exe Token: SeShutdownPrivilege 532 chrome.exe Token: SeCreatePagefilePrivilege 532 chrome.exe Token: SeShutdownPrivilege 532 chrome.exe Token: SeCreatePagefilePrivilege 532 chrome.exe Token: SeShutdownPrivilege 532 chrome.exe Token: SeCreatePagefilePrivilege 532 chrome.exe Token: SeShutdownPrivilege 532 chrome.exe Token: SeCreatePagefilePrivilege 532 chrome.exe Token: SeShutdownPrivilege 532 chrome.exe Token: SeCreatePagefilePrivilege 532 chrome.exe Token: SeShutdownPrivilege 532 chrome.exe Token: SeCreatePagefilePrivilege 532 chrome.exe Token: SeShutdownPrivilege 532 chrome.exe Token: SeCreatePagefilePrivilege 532 chrome.exe Token: SeRestorePrivilege 5472 TieringEngineService.exe Token: SeManageVolumePrivilege 5472 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 340 AgentService.exe Token: SeShutdownPrivilege 532 chrome.exe Token: SeCreatePagefilePrivilege 532 chrome.exe Token: SeBackupPrivilege 1484 vssvc.exe Token: SeRestorePrivilege 1484 vssvc.exe Token: SeAuditPrivilege 1484 vssvc.exe Token: SeBackupPrivilege 1436 wbengine.exe Token: SeRestorePrivilege 1436 wbengine.exe Token: SeSecurityPrivilege 1436 wbengine.exe Token: SeShutdownPrivilege 532 chrome.exe Token: SeCreatePagefilePrivilege 532 chrome.exe Token: SeShutdownPrivilege 532 chrome.exe Token: SeCreatePagefilePrivilege 532 chrome.exe Token: SeShutdownPrivilege 532 chrome.exe Token: SeCreatePagefilePrivilege 532 chrome.exe Token: 33 2912 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2912 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2912 SearchIndexer.exe Token: SeShutdownPrivilege 532 chrome.exe Token: SeCreatePagefilePrivilege 532 chrome.exe Token: SeShutdownPrivilege 532 chrome.exe Token: SeCreatePagefilePrivilege 532 chrome.exe Token: SeShutdownPrivilege 532 chrome.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 532 chrome.exe 532 chrome.exe 532 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3296 wrote to memory of 4996 3296 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 91 PID 3296 wrote to memory of 4996 3296 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 91 PID 3296 wrote to memory of 532 3296 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 92 PID 3296 wrote to memory of 532 3296 2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe 92 PID 532 wrote to memory of 1976 532 chrome.exe 93 PID 532 wrote to memory of 1976 532 chrome.exe 93 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 4680 532 chrome.exe 102 PID 532 wrote to memory of 5268 532 chrome.exe 103 PID 532 wrote to memory of 5268 532 chrome.exe 103 PID 532 wrote to memory of 948 532 chrome.exe 104 PID 532 wrote to memory of 948 532 chrome.exe 104 PID 532 wrote to memory of 948 532 chrome.exe 104 PID 532 wrote to memory of 948 532 chrome.exe 104 PID 532 wrote to memory of 948 532 chrome.exe 104 PID 532 wrote to memory of 948 532 chrome.exe 104 PID 532 wrote to memory of 948 532 chrome.exe 104 PID 532 wrote to memory of 948 532 chrome.exe 104 PID 532 wrote to memory of 948 532 chrome.exe 104 PID 532 wrote to memory of 948 532 chrome.exe 104 PID 532 wrote to memory of 948 532 chrome.exe 104 PID 532 wrote to memory of 948 532 chrome.exe 104 PID 532 wrote to memory of 948 532 chrome.exe 104 PID 532 wrote to memory of 948 532 chrome.exe 104 PID 532 wrote to memory of 948 532 chrome.exe 104 PID 532 wrote to memory of 948 532 chrome.exe 104 PID 532 wrote to memory of 948 532 chrome.exe 104 PID 532 wrote to memory of 948 532 chrome.exe 104 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exeC:\Users\Admin\AppData\Local\Temp\2024-06-08_1fd9cc6635d5489ebf076abe80fe9604_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2dc,0x2e0,0x2ec,0x2e8,0x2f0,0x140462458,0x140462468,0x1404624782⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd94569758,0x7ffd94569768,0x7ffd945697783⤵PID:1976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1928,i,3594762485108539124,1949863417656235391,131072 /prefetch:23⤵PID:4680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1928,i,3594762485108539124,1949863417656235391,131072 /prefetch:83⤵PID:5268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1928,i,3594762485108539124,1949863417656235391,131072 /prefetch:83⤵PID:948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3216 --field-trial-handle=1928,i,3594762485108539124,1949863417656235391,131072 /prefetch:13⤵PID:3804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3340 --field-trial-handle=1928,i,3594762485108539124,1949863417656235391,131072 /prefetch:13⤵PID:116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4612 --field-trial-handle=1928,i,3594762485108539124,1949863417656235391,131072 /prefetch:83⤵PID:2960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4852 --field-trial-handle=1928,i,3594762485108539124,1949863417656235391,131072 /prefetch:13⤵PID:3404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4856 --field-trial-handle=1928,i,3594762485108539124,1949863417656235391,131072 /prefetch:83⤵PID:1640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4872 --field-trial-handle=1928,i,3594762485108539124,1949863417656235391,131072 /prefetch:83⤵PID:5212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 --field-trial-handle=1928,i,3594762485108539124,1949863417656235391,131072 /prefetch:83⤵PID:2472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4724 --field-trial-handle=1928,i,3594762485108539124,1949863417656235391,131072 /prefetch:83⤵PID:1588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 --field-trial-handle=1928,i,3594762485108539124,1949863417656235391,131072 /prefetch:83⤵PID:2056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5512 --field-trial-handle=1928,i,3594762485108539124,1949863417656235391,131072 /prefetch:83⤵PID:1104
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings3⤵PID:6096
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x238,0x23c,0x240,0x1f4,0x244,0x7ff706957688,0x7ff706957698,0x7ff7069576a84⤵PID:1104
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=04⤵PID:2472
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff706957688,0x7ff706957698,0x7ff7069576a85⤵PID:4532
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5592 --field-trial-handle=1928,i,3594762485108539124,1949863417656235391,131072 /prefetch:83⤵PID:5904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5464 --field-trial-handle=1928,i,3594762485108539124,1949863417656235391,131072 /prefetch:83⤵PID:5888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5472 --field-trial-handle=1928,i,3594762485108539124,1949863417656235391,131072 /prefetch:13⤵PID:6748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4052 --field-trial-handle=1928,i,3594762485108539124,1949863417656235391,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:2868
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:1080
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:972
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:5436
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5320
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2644
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5944
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:5484
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:216
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3332
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2200
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:2952
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2484
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4040
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:2228
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3376
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:5988
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:2220
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5472
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:340
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:2376
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1484
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1436
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:4164
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2912 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5172
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:3800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3716 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:81⤵PID:6648
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
- Size 2.2MB
- SHA256 4c45118834590a1b9e31f141891d41fc669c0e9de4b09e996a73f2f9e072e1c4
- MD5 c88100df7180c239590f2b36dab20185
- SHA1 5f178afbf77377b557ab8802723dcb80fef893d4
- SHA512 530110091c621646e6fc11e95af24619d78fa8ceda744375f700df9444a08c1b4dfc69f65425a17d95716cdae6fc68677035ad6250ccddcdee65ae08b6720b23
- SSDEEP 49152:07T3mwzb/iYlzGQMebksutsKSFEjhMjSax84:07Df/hKuzFQWdO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.3MB
- SHA256 e6c1a092b5977f3dc95c5e72caeace22c326dbbdc56fadfa51241d06cc573c67
- MD5 629ad528c986c3406d39f531df03e543
- SHA1 04df69a8753df24a60a295adbe905460119086ff
- SHA512 1e3c5fe7594366dd860b471e2ef2599abd4cdec22b47b58552237449299b8f0bf893aeb7d43de9c9eed1277490e98a03b7e8f83a83a38fc2d2caa88129aba895
- SSDEEP 12288:VCSP9Q/JcuifCwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+0:lPsJcuiTsRjhm0Ijr/eax8JXO02q3A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.7MB
- SHA256 1fce22c03f7aed756e4e34ed3fbd0f8ac3267a086b982635b9e462d5fb87472f
- MD5 680992718163110e9b6f0d32369762c3
- SHA1 a126e4aef2c99b90bb7770623cc9c9d4699b7465
- SHA512 9067667c23863971712bcfb04cebc58b25a87c08abf4f5d44f1d448f14693f8548b1e1418411d2c321cbab6711376cf962f0cfed0d1b6ffe0bbd01fc4ce1b7f0
- SSDEEP 24576:P+gkE6fh4CovsRjhm0Ijr/eax8JXO02q3A:GgkEmSpEjhMjSax84
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 6c3f7e303a92d4210b2f76d6b140187ffaec4a35a2a173e6b0cff31717a18d4c
- MD5 8ff3fe92a9b8705bbbcfe3d496abf741
- SHA1 e4cb31e1705a8c63ec4e7259264b36494f21b0dc
- SHA512 d5677fd5777c3756ed2ddab16be365d61ef4788cce63905f567b482f568b7a1ab9aa0934a170e47f12454ea32be40adab4f969bc4e67620f5dec7cb436c9ef4d
- SSDEEP 24576:yBpDRmi78gkPXlyo0GxjrAsRjhm0Ijr/eax8JXO02q3A:GNRmi78gkPX4o0Gxj0EjhMjSax84
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 0fe2459cdb00500110cc03b29f5cf4b97ac5014bfdb006222f8ab1b4b27ee140
- MD5 16d99cd2d7473a1e82695e2c605f3970
- SHA1 6603de3b09cefce95cb1e2840beccfd542427e9b
- SHA512 9f0434219e96c18dd923bed316d884a538fa654335898b8a7b715b594c86b6931d4ad80ad21ed769cdd8e510bcc7c51983b1047fffe97956cc2d95b72ca1557a
- SSDEEP 24576:5LOS2oyPIXVvsRjhm0Ijr/eax8JXO02q3A:D/ysEjhMjSax84
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.1MB
- SHA256 6d0c20181b99ec1d300112d1c554aaee470ad30bf054c9aa188d115e3458a508
- MD5 68a1fe16d5381301bb059da0237ebe76
- SHA1 9f2d332b85d10f3646bed16c1d368bfdbfb9fa50
- SHA512 9e8249bdf71489aa006e645f23430c6db2884bc356dbdc30e85ff388b5271d15c8e59a19c16c02a844cc26110f19ff5e860dda9eb125adb2c750c3d60475afe0
- SSDEEP 12288:KchCwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+i:KcJsRjhm0Ijr/eax8JXO02q3A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.4MB
- SHA256 55262d6b3536ca3de76eca3f702225ea2c2e9106c76e54002f7e30d8267b42f9
- MD5 3db6804ab9134214377e737df05dba49
- SHA1 bb8d27e9afeb1c41885473f05160471fbcb462b4
- SHA512 b993f40aafac4c9e81b035f249bf3df1697e1f7f5321c1348a83dce0c982fd9122a48bfe82d330f990b187bdc556676634964d7b7c64e38fbdbd9cc322a34b9a
- SSDEEP 12288:1eBNUbTVO86U6CwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+d:1JIUysRjhm0Ijr/eax8JXO02q3A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 045de8bd22c782bb0b3fe90dbf2cf1cd30f91b1f9cdfd2c1966648e2a70b4d52
- MD5 06271c05c321765e9e3846f4c3733392
- SHA1 44700936b87df9970b4e2edfbeff41ac0d235f5b
- SHA512 d1ead72d31505e8917650a8206875f7334843c71f24df082608059f785ef035357a770b9937e474516ed37d0de430f298e13282dad23fc0d72dd12415e71a815
- SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THS:UQvGAdlCEL8c/yRNw5C7QWdO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.5MB
- SHA256 8a9e6cd853a2cd67f152be60f77386544b6cee310d58c6c91c16a59ae301bb97
- MD5 0165cf0c0f7e9e1740c32abe2b6c2652
- SHA1 3751b7fa676addb8fb3a53a31ae2def719cb1342
- SHA512 54bf1a77b0cae5fa62f3f542807e42c365c25e291e9c91302ef799a50ba2a4c49cc7f078704d7cdc8189a865febcb6ae75f8bec069241629a62b517ba9ac64b4
- SSDEEP 12288:fAwSfxL/2Dc3ODLLmt0LDQewsAjECwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LM:oHewsAj4sRjhm0Ijr/eax8JXO02q3A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 e1828f92d48c7bec59e9b4730f928aeddd68a70b0f938951ff2eb776771d9454
- MD5 b4fb68fb7bafea6ad23c32f4a5a61ea3
- SHA1 1b2182853dd71a82f13a851855a94e089bf7d9b4
- SHA512 ae8b8d0e4e0821007844023b156c22a80b8722de0f3a568e0b732208dbaaa4d4d12f0076962918b2f35ff5077bfc8f7eda915f3504fcceb204f770fc007abaec
- SSDEEP 196608:VUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHwQW:VUEtQevvqc2W1cpV2EI32n
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 6be672281adbcc0da20867bb6a4cde01dde3578a5b757ad9f17fa6c7d614612b
- MD5 db547a8b271657f0c0a7eeaed65566da
- SHA1 fde3e057dca94e7424893b1fa5ab54f34e08610d
- SHA512 257153e24a0bc10e9d76e0b7b7603b6ff1db5968be3144140918b1b0a80e166b7424793e4944be1dfe6827fa86f405342fe181f9fbfb3311deac9a704967ddf3
- SSDEEP 49152:qCbRquA/m2yL5zLfFiV+XenmE3/zYEjhMjSax84:foq2Vjnm/QWdO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.4MB
- SHA256 960f130901a09ae777dd284ef2845ef86cad769ab4410e872f24fb3834b05eea
- MD5 567cbaf63757c96906b90388d3c82285
- SHA1 e666cea31b4346aa80767fc74a314d526d8afdc7
- SHA512 b00364172409738bf6a02e13d0c00da56d47918e3484b175b9a234961bc01ce8c68891460c352fc3b87bddb71bb1329a3f8f32df3009e2600520d8e67a45867b
- SSDEEP 12288:Kmw5HEjsChNMBFgl0WDm+C3CwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+q:DwuBOWssRjhm0Ijr/eax8JXO02q3A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
- Size 2.1MB
- SHA256 6510b90609610476f9eddb5cc873aa12a74b900a6c82f25af911f4dbe0b703f4
- MD5 a124d094874278deb24611547f588bc3
- SHA1 dc9ea2eb85fdf185fa5eb60e586d6c919c98e524
- SHA512 2b0dd2a116b86b938b82c35cab5a80312561a358ba4d46d1edd514306f1bf24cb0d4b8ce7ded945f11098973f77c0dbece973aa41f7b9de4dd9b81d370fb99b5
- SSDEEP 49152:ba/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4TKEjhMjSax84:rZ4K5MJabfsYNjQWdO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\SetupMetrics\03b14cff-efd6-4c8d-a647-1ddf6dab1e80.tmp
- Size 488B
- SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
- MD5 6d971ce11af4a6a93a4311841da1a178
- SHA1 cbfdbc9b184f340cbad764abc4d8a31b9c250176
- SHA512 c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 4fa548f0ae73d9a74984be9e292fbf6e22f1404a9112a83b09daed5709bee5b3
- MD5 8a50163e473a9d54c175285d9af2c00d
- SHA1 d5aec2b887d4f0c7e39e7e0c91981da4adcc5149
- SHA512 de66d0292deb03ab43cc956c24d124ffd3a719b7a294514e8a6c3a7a215ea437d822f87c2aed025adffac23e1917b64392649c9ca15fdfd2ff8670eadd440547
- SSDEEP 24576:McP4mcvIjkGOxhKP2l71nNKbrh/8KBNsRjhm0Ijr/eax8JXO02q3A:nP4m4IpOO67W8K7EjhMjSax84
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
- Size 40B
- SHA256 bd34434d117b9572216229cb2ab703b5e98d588f5f6dfe072188bd3d6b3022f3
- MD5 85cfc13b6779a099d53221876df3b9e0
- SHA1 08becf601c986c2e9f979f9143bbbcb7b48540ed
- SHA512 b248162930702450893a112987e96ea70569ac35e14ef5eb6973238e426428272d1c930ce30552f19dd2d8d7754dc1f7f667ecd18f2c857b165b7873f4c03a48
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\06f8b3b0-d455-4d20-894a-d668cfd24f7f.tmp
- Size 4KB
- SHA256 a0bf4736538c23483c7cdbaf61706c7a8a6d2fcd4bcef32d7e96bb4ca5390d93
- MD5 8b0070d4ef89f0392593b73b2eb6afc0
- SHA1 888b7842ccb403476b87a3a99c28aac47aef5ea3
- SHA512 996f7c3d3062d47251b109faa2f2ebfe9c1de0c5e71bf374d0b034059c3f6ac883c6ed6d298ef8b03f6b5d7125f3936777a3596637a85a583c8dd239e785d2f6
- SSDEEP 96:7UDeXIsXPXSd5BZ8iZRy7Di+6MsmdekPOvIjVlVup:70e4m2BZ8syy+FTXjS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\en_CA\messages.json
- Size 851B
- SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
- MD5 07ffbe5f24ca348723ff8c6c488abfb8
- SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
- SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\dasherSettingSchema.json
- Size 854B
- SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
- MD5 4ec1df2da46182103d2ffc3b92d20ca5
- SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
- SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
- Size 193KB
- SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
- MD5 ef36a84ad2bc23f79d171c604b56de29
- SHA1 38d6569cd30d096140e752db5d98d53cf304a8fc
- SHA512 dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be
- SSDEEP 3072:HXm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4g2rJBXCy9enoN:HXUMCm4U6q62MEBi99g6JVCvoZhhl+No
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 53d8fc742c524f7cd53e46998da49778054e9e01712c55f29a9843ef0bb4e8bd
- MD5 022e235cf928e25a84c36743d51b6193
- SHA1 a3dd1145799ed33b3f3619084e898f25e52a7fde
- SHA512 c37887fc3258f0c16d8da631f22bf8b430260316b7ab48304990bca0e26725e3ce230f114527175ac1c2e1f6e202f1f151624ba55788e352357bf97e9ecd9bce
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 369B
- SHA256 9ae3f4422e26d918f0697350948f543195f5bcecdbde662b8bfb3d92429f21ab
- MD5 4c8ab51ec6c166687d589f831cdfbe59
- SHA1 d514a8a0a5218856666dbc9b8ff57ad0e65cc4b5
- SHA512 fa8591d1997efee549298341257189f37ba79e379613656ae4851636f7a9edd9df549a84f34a44924b4650a4ceb362c8cf02ab8fbd8bb17fb0a75d602356511a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 5KB
- SHA256 e62a7fe8c787b65a344dc5886f7bdf498823a8112bfa5ee667a5791e8e5dd111
- MD5 a6c317bc5c816a271f6a9a7e345ddf09
- SHA1 36409d4388c97909f1a3207b2c0a2e2c6074ad8f
- SHA512 c7cd2db30e02ae92c6a94b472310e858a3067b54d25354104edda5abec8528be2544ce5e92d0b5f5238805f530fdf4b680f34e2f2ebb0541526b3e7cbb653b68
- SSDEEP 96:7UDeXIsXPXSd5BZ8iZRy7Di+6MsmdeosOvIjVlVup:70e4m2BZ8syy+FTKjS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 4KB
- SHA256 2eb66713ba354dfa30af8108a160723664fa7d6a91a984572296497a8c7b9e07
- MD5 d68dcfdc0e1e81a7fe616fde814db70d
- SHA1 c63451fce7a171304fa8698c3209d48290b82f88
- SHA512 f26f1072a05ffa6e4c984399973a9a69c7aadb7b99ba75217d97de62a5cedac7312568ccefbf8fdaffbbc72059d0cd2fb19b86db34c8cdcef4536b6677c82dee
- SSDEEP 96:7UDbd5BZ8iZRy7Di+6Msmde1BOgjVlVup:70HBZ8syy+FEDjS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 4KB
- SHA256 a1d9b3d6898c2ac3edbe269f55b315fcb79ea976f9c5e170a351d89a2052d4c2
- MD5 89aeb6eada04fe9c4e2748b71bea5b76
- SHA1 c73798b4360241e54cc68678bdbbd9a78e622cef
- SHA512 7774aa98ea54a7bb0381bde7912596a96a19023dcad13a45d118398da4319075047413cccdc853a01d9956763a5e5ee1dce9b33d1d1bad71d3ae5dd621562f83
- SSDEEP 96:7UDbd5BZ8iZRy7Di+6MsmdekPOvIjVlVup:70HBZ8syy+FTXjS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 4KB
- SHA256 816e22dc5add6eb218a1b29b5b91f6669e4bae18ef45a9fc61c46cd6af80f083
- MD5 4210387030c67a239a3ac58862af0b8b
- SHA1 02e856aa7fda5b2998469f724fc7ec3bf844027f
- SHA512 993847c8118b96fa988c170398b43bd7902f57f3ac741c8bb853348417157b908074bf145d4a92cf910b5b361c05ad060bf76f699fce8e2462f78e4c7bd325e4
- SSDEEP 96:7UDbd5BZ8iZRy7Di+6Msmde1BOvIjVlVup:70HBZ8syy+FEtjS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe583b8d.TMP
- Size 2KB
- SHA256 0bc76b0a74faa8d4d25cfa28127c42750e86004af7a10d590e07a33a89726b51
- MD5 04695aadffdaf28b5be826d27d48721a
- SHA1 ce79df7c80926a86b0e1a922a05bcab16c7620c4
- SHA512 aa3438c4a09ea9c0c52dccb6cba636ac99c11b47a5b78317869823d6c39bfdfa304f40e67867b8ca9c4269efaba12431ae59a1d54c671f38acb9e4fe3d23da54
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 13KB
- SHA256 3b0e9ae66d3dea276e97ad02c1181acd683e0f01bd333c82bc1aa7e095e1c67a
- MD5 fb27c7d34c1f6cbd3a4dcb3a7d100da6
- SHA1 d0393d9c536ed725ecba75b05a1d967a0b661bd6
- SHA512 085fd5b1d1cd128021ff424d1a5b69d09c972e73ec9fba53194371de379f40a9480017894b61f189a73273c0fd84ba70ec157e1b306ce4d03d0d599a1e218db0
- SSDEEP 384:1yLPLe0XF1kXqKf/pUZNCgVLH2HfkorUfb3zE9U8:MLPLJF1kXqKf/pUZNCgVLH2HfvrULp8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 10KB
- SHA256 df1d54dfa84251ac64d0535559fcac6d86bc5f54cdb8dc9b00e360564a825559
- MD5 0cf0a4b2347ad29d17f41a52045e3e27
- SHA1 64fa6ffef3e4d85978060bdfe6586e24fd5f4ea6
- SHA512 d6fcebb282e29441d86a26c3e446e9e2637008921e8ddeb404acccbb776e0f5ecd09fc0a0d255a25c5e610eefd4db970f6c8e00000a851b760675ece022b724c
- SSDEEP 192:144XX+m1kXqK4I40pUZNCgVLHrKHfFyorUKKTJMkidcesBH/JzzErY9QbQnzC:15XF1kXqKf/pUZNCgVLH2HfkorUfB3zs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 272KB
- SHA256 11e53b755a085f0060ac25db7b6ea911e98b55a5bd08028af30a8ddd711c5ca4
- MD5 3e3e5ec0874493c7b508468def08ba34
- SHA1 de5e976e6202d50f040334c18ead400ab0c70721
- SHA512 0965bb95f73709e95bd11b8d5613b530ad50dbf961189e391fa2e54a982a01d4eed8d053e977a949e09342f91c9275bcfb6037da6c97e5c80c2c0d5dc5568609
- SSDEEP 6144:72rF8A9t3AOtzdjsG1Ea8HASNdvXCNpbMHtCMpSJ:7G9yOt54GSZHASNdpHtXw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
- Size 4KB
- SHA256 b9984aefc4dd6d0ff847f6811aa62826f9a7d0ab7c111613eadefdda057fe689
- MD5 1b8bad45cc875e9eb288c6c1bd1adf85
- SHA1 870c5a5b27d8aae7709d62add8031906d81bd790
- SHA512 ced7d46b1dd8841256b8b249eb950a079908a3673efb98c714710aac2c2781348698c5dfa170f446309478b615a81d18f2e0f7011766d42c342344bfcd3ab5d0
- SSDEEP 48:qiZli4qHFuO+CS2frngD1HMDOjc4OWOdquCngDtD02AngDtD028H2uOtMojdDY5i:ZW4cKRw4Ne9xK2rK2b1JzMCAVtzi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
- Size 6KB
- SHA256 98a0d410a25c2a5d976dac79ecb9ab4e76fe10792095ec4f5cdd9080e6bd55f3
- MD5 55f16d7822ffb1c5e6a8db001e273542
- SHA1 5401a47ccb63ddba2b1e10f470bce05a648c0b16
- SHA512 0bf50577ec7a95ad08b6200d51aacb1c3efccb833303e4ad3c97326baa40fb069103abda566833e26435615db63dddab6c77c88d867fe8b3a8e20092e1c0bf35
- SSDEEP 96:ZW4cKRw4Ne9xK2rK2b1JzMCAVtz6OIdPqKbKbBqpxK3KTK3E0wj:x5N4BZ4CAVtz6TdSKbKbYHPTz0wj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir532_769867239\68d30b6e-6e00-4299-be8a-0c6350d681ca.tmp
- Size 88KB
- SHA256 d412fbbeb84e2a6882b2f0267b058f2ceb97f501e440fe3f9f70fac5c2277b9c
- MD5 2cc86b681f2cd1d9f095584fd3153a61
- SHA1 2a0ac7262fb88908a453bc125c5c3fc72b8d490e
- SHA512 14ba32c3cd5b1faf100d06f78981deebbbb673299a355b6eaec88e6cb5543725242c850235a541afa8abba4a609bb2ec26e4a0526c6b198016b08d8af868b986
- SSDEEP 1536:bCwdkDMb+jCnnSGIdfT9zcbF6gNoLNdN4XhCJQS1pOn5IJ1pD:uwyAbvShdf5CkgN6nmkOup2oLD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir532_769867239\CRX_INSTALL\_locales\en_CA\messages.json
- Size 711B
- SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
- MD5 558659936250e03cc14b60ebf648aa09
- SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
- SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\5f0d5858b3e2edcd.bin
- Size 12KB
- SHA256 660121206a900ff68d0075e66fe7ed4af1d46b6b53c0be725d45a5d03023bf0a
- MD5 d046ab076588db12d440b15f227dc6d0
- SHA1 6220e58ddbc66b95cec67c6c621f413423a78387
- SHA512 84e56587ff8d04192c104ddcaeb5d665b84da2e2d9565c54758d33f71ee0b9dda91c6f07d9142449b87a117217ac47f4f2c36cbdeba72d6d26a7624592134609
- SSDEEP 192:K843A6JvXkRyXk93TbLPhYQWMcRkAysNUAiFfYA+U6Yp+DY1x:KK6dXX+/LhYrMakADNOFAO6Yp+DYT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 695ce32c598455dce2fbfd51bfe276cb6679e5980a2c11ab7d49c204e47b4153
- MD5 a1d2b1f09493f48d8d6fad467e1044ba
- SHA1 6437bff85a104439d96f604bdc06ba53ec9a95e7
- SHA512 4f098588abd798be5a2c85a5f8347c0d1877f1796daccda40dd7aba6d938e95f32c94b1f205b423b5b77b077492d680d0c0b7116402ee3af551b8b51b7e4c2e6
- SSDEEP 12288:iNCwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+nj:iFsRjhm0Ijr/eax8JXO02q3A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 e936536e17a24982b0565977fe6ee59bebf257545ba3929c37d54994da830a33
- MD5 0ecff90847e94dc2bc3ed32641e65684
- SHA1 f12dabd6b84d93ad16794c6251f09feb6663f844
- SHA512 607988ef404e95e7917f37f7c1c2245646aba65a6727521791e23a4db92ac7b9d80acb8a4f5a7c17d007bc5d7fa050b64e6481fbcf7154cb0cc759f58bcb10c4
- SSDEEP 49152:2a0h2GEkuAe73q3pp46zwwQXEjhMjSax84:2a0hNYG4JwwQWdO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.2MB
- SHA256 e89d24798d928f323ad518623c06164b765c5097f70f4b119e1fb842e70c3410
- MD5 798ad39b4668b2d448177db8238fca42
- SHA1 4b58502e96f7df7e5597ba488d0f0233e6941fc4
- SHA512 e80b3953c8b2754df512750b2edb00e99b2271afbcf1401981415efd65afbc116771e13df097f6392e2dc0b86ac83c1d96abb7222f7d745e68236e408096b7c1
- SSDEEP 12288:3hbHjfXwCwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+R:3hbHjPUsRjhm0Ijr/eax8JXO02q3A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 f9c902897fed8bef64e37a08a7a4daddc62f7def23158fc779875e0589e5ec0b
- MD5 1189b5268bf579f56a7ca65a1f5e6f51
- SHA1 1aca42e6f8243f67856c94a7277f526c6debb8bc
- SHA512 8427d5f64b97ff2706f7d3c8dce3f5a0ab50f9594ea42d7077cdff366af321bce1dc8beb27fb764275fc3fcb636201a005fe365eaf9dfa7782d8121db3a95e3c
- SSDEEP 24576:u3YgnJcRTk4yti+R5dBR/ssRjhm0Ijr/eax8JXO02q3A:uIgnaTk46pBR/sEjhMjSax84
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Locator.exe
- Size 1.1MB
- SHA256 4dc89e7370aed8485217df40adb8ec93a0ee56ee3905aba1306575d9acbeae20
- MD5 28a608ecc990868eceeb8885d69e645a
- SHA1 ff1d9375209cb07961b91a4daa1a086c5c218de6
- SHA512 b2cdb98a5685aa16eb287606b34db887b316aac651b7002a616d7e41bfec908a11774d9ec7b0e6f162c953ed33673e0c826915273b94fc113250d8e740aa07c1
- SSDEEP 12288:SBCwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+y:SpsRjhm0Ijr/eax8JXO02q3A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.5MB
- SHA256 deaae7264b2069a7ceef2d87cfcd0faa1dfa55216a28214308cddab61ac05117
- MD5 329cf29a66c364ad6fd83b96aba9db29
- SHA1 8d3fd1a46ef34f0cf677b9f17c8d20556537ce19
- SHA512 3cc91b222011cc0514ada4efe57b05f5d8ae1827ef277ec186f74d91d5eba8da01fd249801784df5cc5399c9d34614bf3983aea79d17ee619dd9b234bf0b3ebc
- SSDEEP 12288:TOb2A4LWOsvAYFTGCwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+T:8GL3UTusRjhm0Ijr/eax8JXO02q3A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.2MB
- SHA256 7b5d8c18b722d10051e33980f3824317c66b84b1c7d215c2cd6c78697c51d494
- MD5 b360cec36ce532da86c6484319a5a5eb
- SHA1 d07a23cde7539652074780e0d98b42f875f4426b
- SHA512 867a261a03289422aa2dcb29eb8e6175df237d0d5c24184df1f9bb8669b292874c199640f13e1d35eead826a9a7132f15d02309dff81566b2a85a960991bca7e
- SSDEEP 12288:9pFt4OaCwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+o:0OSsRjhm0Ijr/eax8JXO02q3A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 01f7c10afdf890fd0f2fbfb62ac682cf01b421ec6ff415aca2225ec0af2b7ced
- MD5 50b8fb1ab2ac704c874659454bd14604
- SHA1 355e3705acef9ffdef16ebed7df21b039d838646
- SHA512 0796bb7d77046c336b6bc7e8875c70acd752c0e4373ba1201d84c97577fe2ff4967b367ed63aa847c04b2dd6e87dae64aefc26f89a38d91f006d1472be78248b
- SSDEEP 24576:t7NM9YqZqmWMUkPjZM48Mv6bEhs1sRjhm0Ijr/eax8JXO02q3A:t7cBWMpPjN8DbEh0EjhMjSax84
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 55068df6e42d893278dd4e1df00f4fd1ac7f5c02c02baa4ede25a410467347a6
- MD5 7b92a653640ff3a19c35ab34a97e35ea
- SHA1 a440b069343533819d0813861a84eacc6ba9156a
- SHA512 0c19b87f0cc36d35e66d788d0198926906962702be294447f1e875f47080b2fee64c7f2ff2337fd3f8b2e48c19f00809bac60b184c5f22c4d1a4d9fb3e6bbe47
- SSDEEP 24576:dW6BApg2YuyuNDYTabvcdvNYf8km1DsRjhm0Ijr/eax8JXO02q3A:dF2YuHNETovAvNYf8kmVEjhMjSax84
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 eb87a2db7a7b61aae69640ac95af4feb78bfedcea718a7e970b42fedf5b0e637
- MD5 14fae945250b4a6fe3b0784273ff3e10
- SHA1 013fcabacb59bfc71f23bc8e480d3f4d621f4e2d
- SHA512 494adf94fd714163c7378b421066637a0c0273193652ea21017fc1ca011d8ef0fbb9b195f1cf8729a320f6dde04e5540bc1e182019f8387498862238b4696e06
- SSDEEP 24576:fAFs06+Omlf3NXEbTo2sRjhm0Ijr/eax8JXO02q3A:oFs060lVXu3EjhMjSax84
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.4MB
- SHA256 1aa44d1d30e3523637ad9151471144c2b97f82f20af5c010bb590752738c39e6
- MD5 54f1cb64764813d2377ffb637defa2ec
- SHA1 d3d56b50334f0dd8beb9022b20a56d96780739a1
- SHA512 e6d96e2cbb8c75f21f8e094882992cb252afcc96dbea6e3c1f34d395bf51d9fd253bc4ce2da4c0b739ae907463cdea57f9ff96a7abe9617d8986c3e8cf77bb31
- SSDEEP 24576:jJnJ5D3Wt3sRjhm0Ijr/eax8JXO02q3A:jJnJ5DGt3EjhMjSax84
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 f0e954399f40ce87577a50b9fc865ec138f1e1d697d80942fcf35530824aff9e
- MD5 a91f9ae824f6503532e1199afbb6a9fe
- SHA1 572111fee77cd51a955827b118e9e4bd900d0933
- SHA512 c6e547e4b0483714ddfbc0e51bc34bdc21e753fa917effb39d419bf7f89106ba2f09229e99e7b2fe51f5241f851cebaefabacd2ef6653001d11a4ab2b7d2d52a
- SSDEEP 24576:/EPghm6/7IIXdwcXrif7qQncjlP65i3VussRjhm0Ijr/eax8JXO02q3A:4g06DIKdwc+eQnSt65aVREjhMjSax84
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\alg.exe
- Size 1.2MB
- SHA256 7ee9bbf8fa167858ae7fe783a5226fe914aeb4331e54ab22299f5f5ce5c48eb7
- MD5 ae14cfa0cdd027e276c09733d520dde8
- SHA1 495dd669892cf6ac711f8de1187c00c45f7d15f6
- SHA512 94422cf289f1459b3ceeb091edd3d7c0464e33af590b37f227d010e957eca372c51814ebe6ba837834c8c5c438cca32ae8099badef51daa30031dfee5ad5d7f9
- SSDEEP 12288:CEP3RoJwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+d:Bo4sRjhm0Ijr/eax8JXO02q3A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\msdtc.exe
- Size 1.3MB
- SHA256 0a6c8212ef03a79918824595581d6d0323a825ac0292e00079216314efc2b9ba
- MD5 4661d2953939bfefbb9da338718b12eb
- SHA1 b87a56f6c22d890051b75c87c671326dfaff105d
- SHA512 1425c38614b1436cd4fcd1fb4222d48738bba6e1432cdcf9d839f06d37c55248ff492271deaba278615beff6ca8cb76153cd17254c02e4dbb17b99e2368de87f
- SSDEEP 12288:+jkygCwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+m:+IyksRjhm0Ijr/eax8JXO02q3A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\snmptrap.exe
- Size 1.1MB
- SHA256 ca971dab17e3cecbb61375277b88f4b0af01d62aa3a219f80e6a80edbe153491
- MD5 f8af1ae7886b559a59be80ca7e84644b
- SHA1 5626b01fe62abf3c72812692d390e423e1e0ffe4
- SHA512 4f9dcfd916fbac59a7bba717a32c243f64ce6298aed84b6e91ddd56e230f581577fab959f882b2d0e2ffdb3a174aa6f3a79d14ca20f12b3a918aa070561702ad
- SSDEEP 12288:IFKCwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+h:yisRjhm0Ijr/eax8JXO02q3A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 083128e0bdc654d48d3e02f5b3a9f9c46e065b7fbc83cd10d359745d1b3081c4
- MD5 08d80af961348dd7b787850e416e4780
- SHA1 be96a2c2808d8f435d346efe5273b0068f493cbe
- SHA512 ef23592e98fc734c4187f84d0625ee315418e3a92cb4b0cf171040a8e37aa75be316661c4ff64e9727b4344fc7d3bad9f257e2888a22196bd5b322f262f5efdd
- SSDEEP 24576:5Q9MxZKdcz9dw39sRjhm0Ijr/eax8JXO02q3A:5VKZ9EjhMjSax84
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.3MB
- SHA256 79abe426e6be7e06dbe2777231465dd4251b295fff387b6987b644c9b62ac3cc
- MD5 f647e09a0202be209b1656024a331693
- SHA1 36b9c732c599baa0ca03e84c6430d133daae174f
- SHA512 dd725a88ad44e629fc761027a3e48cdbc248f80942659cc682f47483989125783833200f491c54cfdcaa1bea5477fa574d028eab3361613b1ed6eb710f435927
- SSDEEP 12288:1yoKo2uRple9pECwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+4:1yockAp4sRjhm0Ijr/eax8JXO02q3A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 1aaef8867cdbfbebfca4828ced0d42ca24aa7c62f298920d81263077a08615e1
- MD5 1314864ecbbdc184a88521ed6c74e73d
- SHA1 87b45171992ab8159aec8ef0ad981454317e0476
- SHA512 36feeeeffe2af083df3ef027434b22ee9b8ed0d81d9ace19f80b07bd887f97f0ea31e74ea35a75ec40f7ac5fd0feb7796abb8bd78eff26c807d6c2e15176de07
- SSDEEP 49152:TWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK4EjhMjSax84:T0zuNIuQWdO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\Crashpad\settings.dat
- Size 40B
- SHA256 169bdddd028372b9c8dc1bbc8bc1a48dce9089467cf7c3b5967ebc20713b1bb7
- MD5 0e1a0df5323f02fa141b11070035f203
- SHA1 4662c48107aebe02429f78dc0ab4328f88ea9e8f
- SHA512 5ef418e1f48b459f21f15f8462fceebbe5da2e16ff4cd02a614a6a508c1a9e28527c0d0778840600c85ba60d412de91e754b3aa0173ac4db70460367a2abc6e5
- MD5 SHA1 SHA512
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 4dfdf006a28124473aa14c2ceeeb739bdbfbd39a2d31f8ab7becb3f26f355d1f
- MD5 14c0bbf366cc1654f3a1f790d803b7ed
- SHA1 b4f63759f6b1deece83becde27100fae38b279ba
- SHA512 fa7a465ae80e4918fb0303bccfc2f534291ccaeff9ee8908ba699a3fc74645c1b191ace23903895a8e4b556ca10a2041a491678774fee26d2c580ca04c002cea
- SSDEEP 24576:B1QT7EcpfxR+N5AWAz3ooiYtjMqbLsRjhm0Ijr/eax8JXO02q3A:ETDxR+N5YzTfjMyEjhMjSax84
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.4MB
- SHA256 c6c32bc0ec337a1d3c71ac792a144706c1680992417817027706ddb3f735e95f
- MD5 90d5f03978021e72e075fcbe3977ded1
- SHA1 1adb165fe11ec578d6c003b76095e3e3f9f99e03
- SHA512 7d44982abd8a9dfaf152b387e88c6035016a25fad9c79acbd4ae68bc796c9820dbbcb3b697f83642c7d2eda3576b9f1c34bb5fba24bcaf21edf19ba958ce0921
- SSDEEP 24576:5TMdOz0FFS+fmSL/sRjhm0Ijr/eax8JXO02q3A:T0K+fmSL/EjhMjSax84
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system32\msiexec.exe
- Size 1.2MB
- SHA256 bf6919d6a7dc9663b6113bcef9eec5219b064f6614814389c14684239804ca84
- MD5 573a9db0ccb89a4b90a9ad3fa703321d
- SHA1 aada705ff30a91ef750667fe331ffc6613444648
- SHA512 3f88657a39df58c2068c23a2a28a04c84556c234ba6ab4de0d74356a48ffa34438202c40d50f8ee29676262d72fc4319a2e5c0c74fcb175917dfc09ae064714a
- SSDEEP 12288:t4tGCwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+H:WusRjhm0Ijr/eax8JXO02q3A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\odt\office2016setup.exe
- Size 5.6MB
- SHA256 023b564acab0c6693c2c226ea110d0abf9cc777272882a1d7fdead9292394a25
- MD5 ce7a482e205bb8351dbf71e68ba8bcff
- SHA1 cd511eda04fcfb67a7f22cf90bf17bbb4954cf73
- SHA512 29463538c927c85eb54940f6a1f8f52f916a11ade104750e135861c8ab136985ac3fb7d058c6d57c4fec25c2cd4befb1202ae28a92bfbc920438d572b9c734fe
- SSDEEP 98304:S7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGL/QmvD/cTwY2h3FMQWdO:8M7pTXexZPGzURnBh6gGLF+W3CQW
- MD5 SHA1 SHA512 SSDEEP