Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
09/06/2024, 20:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
General
- Target 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe
- Size 5.5MB
- Sample240609-y8vwmsfc76
- SHA256 5c8c159e417750b61cc4957ebb7e83cfe4d1bdd02805ee4c40405a53ac4fb66a
- MD5 fa9da2e23a7d783ba5a0c0f182461146
- SHA1 e7c14c895dcda36f5e81d1d0d56aef7e3a1f05f3
- SHA512 27709c853a44cd50e3d1e7239c5ac563f99d523056f3e42bb0fafcc0c9f4e3cf784f3019bc36da4fd3f624ba4d42b5b6e42df03705003992e6ef84047ae420b5
- SSDEEP 49152:NEFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1cn9tJEUxDG0BYYrLA50IHLGfN:xAI5pAdVen9tbnR1VgBVm9U023W
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 26 IoCs
pid Process 2824 alg.exe 3276 DiagnosticsHub.StandardCollector.Service.exe 4984 fxssvc.exe 4620 elevation_service.exe 3716 elevation_service.exe 916 maintenanceservice.exe 436 msdtc.exe 1744 OSE.EXE 1056 PerceptionSimulationService.exe 5020 perfhost.exe 2968 locator.exe 3876 SensorDataService.exe 3448 snmptrap.exe 4880 spectrum.exe 4080 ssh-agent.exe 4980 TieringEngineService.exe 4280 AgentService.exe 4896 vds.exe 4824 vssvc.exe 1232 wbengine.exe 3108 WmiApSrv.exe 4248 SearchIndexer.exe 4064 chrmstp.exe 5608 chrmstp.exe 5696 chrmstp.exe 5784 chrmstp.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\System32\msdtc.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Windows\system32\vssvc.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Windows\system32\wbengine.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\fd449e11293b476c.bin alg.exe File opened for modification C:\Windows\System32\vds.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Windows\system32\AgentService.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Windows\system32\msiexec.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Windows\system32\locator.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Windows\System32\snmptrap.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Windows\System32\alg.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Windows\system32\spectrum.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{878BCDD2-1ABC-4948-8DA1-C8645DF0F833}\chrome_installer.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{878BCDD2-1ABC-4948-8DA1-C8645DF0F833}\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133624385108667127" chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001fe81d9aabbada01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000078f24499abbada01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000034299d99abbada01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0c69a99abbada01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ chrmstp.exe - Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 1968 chrome.exe 1968 chrome.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 884 chrome.exe 884 chrome.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1968 chrome.exe 1968 chrome.exe 1968 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 400 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe Token: SeTakeOwnershipPrivilege 1700 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe Token: SeAuditPrivilege 4984 fxssvc.exe Token: SeRestorePrivilege 4980 TieringEngineService.exe Token: SeManageVolumePrivilege 4980 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 4280 AgentService.exe Token: SeBackupPrivilege 4824 vssvc.exe Token: SeRestorePrivilege 4824 vssvc.exe Token: SeAuditPrivilege 4824 vssvc.exe Token: SeBackupPrivilege 1232 wbengine.exe Token: SeRestorePrivilege 1232 wbengine.exe Token: SeSecurityPrivilege 1232 wbengine.exe Token: 33 4248 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4248 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4248 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4248 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4248 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4248 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4248 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4248 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4248 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4248 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4248 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4248 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4248 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4248 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4248 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4248 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4248 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4248 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4248 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4248 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4248 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4248 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4248 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4248 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4248 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4248 SearchIndexer.exe Token: SeShutdownPrivilege 1968 chrome.exe Token: SeCreatePagefilePrivilege 1968 chrome.exe Token: SeShutdownPrivilege 1968 chrome.exe Token: SeCreatePagefilePrivilege 1968 chrome.exe Token: SeShutdownPrivilege 1968 chrome.exe Token: SeCreatePagefilePrivilege 1968 chrome.exe Token: SeShutdownPrivilege 1968 chrome.exe Token: SeCreatePagefilePrivilege 1968 chrome.exe Token: SeShutdownPrivilege 1968 chrome.exe Token: SeCreatePagefilePrivilege 1968 chrome.exe Token: SeShutdownPrivilege 1968 chrome.exe Token: SeCreatePagefilePrivilege 1968 chrome.exe Token: SeShutdownPrivilege 1968 chrome.exe Token: SeCreatePagefilePrivilege 1968 chrome.exe Token: SeShutdownPrivilege 1968 chrome.exe Token: SeCreatePagefilePrivilege 1968 chrome.exe Token: SeShutdownPrivilege 1968 chrome.exe Token: SeCreatePagefilePrivilege 1968 chrome.exe Token: SeShutdownPrivilege 1968 chrome.exe Token: SeCreatePagefilePrivilege 1968 chrome.exe Token: SeShutdownPrivilege 1968 chrome.exe Token: SeCreatePagefilePrivilege 1968 chrome.exe Token: SeShutdownPrivilege 1968 chrome.exe Token: SeCreatePagefilePrivilege 1968 chrome.exe Token: SeShutdownPrivilege 1968 chrome.exe Token: SeCreatePagefilePrivilege 1968 chrome.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1968 chrome.exe 1968 chrome.exe 1968 chrome.exe 5696 chrmstp.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 400 wrote to memory of 1700 400 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 82 PID 400 wrote to memory of 1700 400 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 82 PID 400 wrote to memory of 1968 400 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 83 PID 400 wrote to memory of 1968 400 2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe 83 PID 1968 wrote to memory of 1032 1968 chrome.exe 84 PID 1968 wrote to memory of 1032 1968 chrome.exe 84 PID 4248 wrote to memory of 4968 4248 SearchIndexer.exe 111 PID 4248 wrote to memory of 4968 4248 SearchIndexer.exe 111 PID 4248 wrote to memory of 760 4248 SearchIndexer.exe 112 PID 4248 wrote to memory of 760 4248 SearchIndexer.exe 112 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 3724 1968 chrome.exe 113 PID 1968 wrote to memory of 4384 1968 chrome.exe 114 PID 1968 wrote to memory of 4384 1968 chrome.exe 114 PID 1968 wrote to memory of 1576 1968 chrome.exe 115 PID 1968 wrote to memory of 1576 1968 chrome.exe 115 PID 1968 wrote to memory of 1576 1968 chrome.exe 115 PID 1968 wrote to memory of 1576 1968 chrome.exe 115 PID 1968 wrote to memory of 1576 1968 chrome.exe 115 PID 1968 wrote to memory of 1576 1968 chrome.exe 115 PID 1968 wrote to memory of 1576 1968 chrome.exe 115 PID 1968 wrote to memory of 1576 1968 chrome.exe 115 PID 1968 wrote to memory of 1576 1968 chrome.exe 115 PID 1968 wrote to memory of 1576 1968 chrome.exe 115 PID 1968 wrote to memory of 1576 1968 chrome.exe 115 PID 1968 wrote to memory of 1576 1968 chrome.exe 115 PID 1968 wrote to memory of 1576 1968 chrome.exe 115 PID 1968 wrote to memory of 1576 1968 chrome.exe 115 PID 1968 wrote to memory of 1576 1968 chrome.exe 115 PID 1968 wrote to memory of 1576 1968 chrome.exe 115 PID 1968 wrote to memory of 1576 1968 chrome.exe 115 PID 1968 wrote to memory of 1576 1968 chrome.exe 115 PID 1968 wrote to memory of 1576 1968 chrome.exe 115 PID 1968 wrote to memory of 1576 1968 chrome.exe 115 PID 1968 wrote to memory of 1576 1968 chrome.exe 115 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exeC:\Users\Admin\AppData\Local\Temp\2024-06-09_fa9da2e23a7d783ba5a0c0f182461146_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2a0,0x2ac,0x2d0,0x29c,0x2d4,0x140462458,0x140462468,0x1404624782⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe31beab58,0x7ffe31beab68,0x7ffe31beab783⤵PID:1032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 --field-trial-handle=1872,i,17917680210421071996,17052591493955910104,131072 /prefetch:23⤵PID:3724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1872,i,17917680210421071996,17052591493955910104,131072 /prefetch:83⤵PID:4384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2164 --field-trial-handle=1872,i,17917680210421071996,17052591493955910104,131072 /prefetch:83⤵PID:1576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1872,i,17917680210421071996,17052591493955910104,131072 /prefetch:13⤵PID:4864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3064 --field-trial-handle=1872,i,17917680210421071996,17052591493955910104,131072 /prefetch:13⤵PID:2484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4308 --field-trial-handle=1872,i,17917680210421071996,17052591493955910104,131072 /prefetch:13⤵PID:5352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4432 --field-trial-handle=1872,i,17917680210421071996,17052591493955910104,131072 /prefetch:83⤵PID:5444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4588 --field-trial-handle=1872,i,17917680210421071996,17052591493955910104,131072 /prefetch:83⤵PID:5452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4676 --field-trial-handle=1872,i,17917680210421071996,17052591493955910104,131072 /prefetch:83⤵PID:6076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 --field-trial-handle=1872,i,17917680210421071996,17052591493955910104,131072 /prefetch:83⤵PID:5200
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings3⤵
- Executes dropped EXE
PID:4064 -
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae684⤵
- Executes dropped EXE
PID:5608
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=04⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:5696 -
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x14044ae48,0x14044ae58,0x14044ae685⤵
- Executes dropped EXE
PID:5784
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4528 --field-trial-handle=1872,i,17917680210421071996,17052591493955910104,131072 /prefetch:83⤵PID:5344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2356 --field-trial-handle=1872,i,17917680210421071996,17052591493955910104,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:884
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2824
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:3276
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2672
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4984
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4620
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3716
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:916
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:436
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1744
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:1056
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:5020
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2968
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3876
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3448
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4880
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4080
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:4084
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4980
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4280
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:4896
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4824
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1232
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:3108
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4968
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:760
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
- Size 2.1MB
- SHA256 0e5fcc062c2bce562bbe0627d758da6c31639503debb4cee6be09a5488eb8052
- MD5 ea227e91f0d0a97d9a4907803566ed6b
- SHA1 3ff00c8c6c3f958a518b8cd791fedfa87a8f48db
- SHA512 f247cc61a087b1be794152a43067580aab39b814c3ee198edaa72bf7e4121bf302cbbbce8d77eba87f77cc25f3947322755e43aa555ce93a49ef5d17739dc9e1
- SSDEEP 49152:kuYk3H5koUafTqkkYLO/W2buywzMbOX+T7z5Me30jaNf1TWbdz:kCfTqi90bgU023W
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 797KB
- SHA256 a030e5abade89a2c2a9ad120447bf7b52397b6c787361b19f16a32858259c9e6
- MD5 acfeb43bb925200541308e138a93d130
- SHA1 cb04ddf51c2590ea11d715b4750a2020f28a55ab
- SHA512 3a5e307262c4ede4c02fa552ff09bd1ed78735ab0139cd3db8b486c38b034c294a2047f518989f7b3240de77fef1867041704f208dbefbe7725ea2d94879026d
- SSDEEP 24576:KiPnBsuEagXe4i7ojhsP5Lgrk1TWb4AN5:vSuSe30jaNf1TWbdz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 f9f63087ce6c04666f0cd5d9b39eeca4982fbb2e9e9d81f12a2943bb4fd01e05
- MD5 e6a0fb6a2b37d29de98904927c6b42e2
- SHA1 4b8ed4ed0172cbc5c6ff6af0aa525a7db503e770
- SHA512 cba25447fdeb3922927a7f5761f662e597886b59a59cf52b0225532d3800370020e1d6154a7ae3ddefdfdb9f535ab251e3ca56de0cf7645b49a7485b146a112f
- SSDEEP 24576:D+gkE1fh4Co2gXe4i7ojhsP5Lgrk1TWb4AN5:agkERS/e30jaNf1TWbdz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 cffaa52a38aa0ca36fdf69e50e6a5c9ff36affeb1d6b9effa6fee81c62194715
- MD5 373e7fdc5a6507b8273266299cc93917
- SHA1 ff679b7baa09c780631f8ceeffd13c5cab7d2b36
- SHA512 7e2cdc5a01ac04279387f1fbf5ec8457d07806e92eed7c17116c059b5a19be2d5239ed9cfbe6c0049ae27ec6c63a907157940ca156f79495716bd2db55115f10
- SSDEEP 24576:TBpDRmi78gkPXlyo0GPjrNgXe4i7ojhsP5Lgrk1TWb4AN5:1NRmi78gkPX4o0GPjse30jaNf1TWbdz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 3aedd6a7293f65cf9f7b1833e10210a72ddba078a770b0751cb2111f37e32ac6
- MD5 3bb5e10b5677bf1072e49a00a57dc9e7
- SHA1 8d4207bd83a15aae830115a5a281e3894c7679a5
- SHA512 6b5ded74aa14c2caab7ca2f10199285654e6e885783f47cd12b76af0814cf6c73b5e786bb8072aef51c89641924eed293f6e3805055490f4901a9c7bbf9b894a
- SSDEEP 24576:ZLOS2oPPIXV2gXe4i7ojhsP5Lgrk1TWb4AN5:j/PEe30jaNf1TWbdz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 722230862535d1f233c2722cb96c63f5c3756a559f05c3954fb6075f96be970d
- MD5 38ae6619078731f31a36d94314a3931a
- SHA1 389f94eefacde9026f2283dd82c6f5e9e174d7bc
- SHA512 3e0086d6addc6291b99c5a7aeda12ffbf90a554fe21ccfbc6415ce7fd37f01bb6db3694ce0af89292368ae39c7c0e884cc9fe0eb5ae56da4c6337f4e642f11ad
- SSDEEP 12288:9ZL0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:9ZogXe4i7ojhsP5Lgrk1TWb4AN5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 fe6f1c9edc68390b92975f1feb68258ef43d055bd30ff07e1bf19b08fd630fd9
- MD5 f719e72eca085b3f542b0667f099fe78
- SHA1 13ce2371d8d54c7b5f8f5933f5f98df282106fe8
- SHA512 5631ed8f3fe1129acd42e0277b30e9cbaef8f1b2b07f557ecc46fead18f491f318c4bfc8e928c876994ea0e84ef8a697254c598853d085bde0cfa44b49331927
- SSDEEP 12288:reBNUbTVO86U20DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:rJIUvgXe4i7ojhsP5Lgrk1TWb4AN5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 d8cc61feeb557cbecc9af9918509df8ffde4734658e259668390e9885849b322
- MD5 63872bfc03e7c1e66d54939d67ad6e95
- SHA1 f27bc50bee6514194f7220e8e12b65da251de1c8
- SHA512 3378a92063a90d86076e788b911034ec36621e497e390b899f65512d14683843b00b866e1747e75832a1fe10ecb28c0d481f97166ed1323e96b1c0e10ed4f54b
- SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3TH6:pQvGAdlCEL8c/RRNw5C1U023W
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 d8f7040d53126a5361bf4242369fa6bc6d21d0e3a306b17cfb1baa4472a3f86b
- MD5 42af463df23c1dd73b91ef594d36f673
- SHA1 f0b56ee4845b3a8f7ae94e5a13fd271dfd341ad8
- SHA512 52a39e26cfd503a252551c383429badeee79abcd75770158d7ef365753a9784361b3c24c28b10b0be6a86301e5b648173f89bbda86be95c597be307a527df995
- SSDEEP 24576:MSewsAj1gXe4i7ojhsP5Lgrk1TWb4AN5:fljge30jaNf1TWbdz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 4beb54a75917b0e6f21f6ba489b1fcef1ab46f7ed259aae048b6a6ff5baf8eb0
- MD5 596f102d04bc0da3204f1f96e6e66633
- SHA1 957e31bf913f043d0981a9620339e16eecc772b7
- SHA512 d98356989421487f29297425466893b1788045905fcac547e67059710adfcec46a25aacac9525a7adbde083398b17e4e8b910dcfa5fa77f01fe5b5f9499835b4
- SSDEEP 196608:VUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHYp4W:VUEtQevvqc2W1cpV2RI32o4W
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 7c9170304e7c2ed6a38f5baf109e5e21ed64a9fea2b6eaa07ea7b6ca7bdc0051
- MD5 4db8abcdab40bf2ee7ba90b703c3cee4
- SHA1 f8ba6d1332f84631c3082f1394b75d4854b885b0
- SHA512 922d19a1829a41908bdeaaf3a8ba0ab3f07c0066f40eade3c83e02f924c5217e6983dfea465caf62ad8a7ca609f82b3f871d068ea77f5a9e34f5bedfd09e7b41
- SSDEEP 49152:2CbRquA/m2yL5zifFiV+XenmE3/zAe30jaNf1TWbdz:7oqHVjnmJU023W
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 e8d922324cc64f45672d17cb325329d3d41532a7e23f7fdb35e0920576be2b6f
- MD5 c8918660c79c347393e63b1ee5465440
- SHA1 fc19d2093ec44e68099a696c9c186b59790c0046
- SHA512 3a3219188f8bf0a169c5c9d429867ae2ea0d5ec39963be313f8b2369be6ef9b2f840ab5fb38d93833f97a39d58ccc5436cdef5e9e904ea31a3ca35d901b6b257
- SSDEEP 24576:0AhGL2IFoiwtA5l7S53mgXe4i7ojhsP5Lgrk1TWb4AN5:0AM1Foiq55e30jaNf1TWbdz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 28ad93fcb30fa7b1ffa59101313932ab93c07a5ee2a5b9edb52c371f63b92966
- MD5 72579aa2a99076b01fb8aba07fa97150
- SHA1 d4dbcc07016c3a3586280ed8733054930adac171
- SHA512 2334359d8a99c14a7f974428f48c835e73a5812eda02c5f449ae09ed703abd2a0e03fa4706d2cf67eb059f58c26410a863d43e9aad961fa8ba3bcc8ee8cad5cc
- SSDEEP 12288:bmw5HEjsChNSBFgl0WDm+CF0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:6wuXOW5gXe4i7ojhsP5Lgrk1TWb4AN5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 7fb156bbf171c27915ef9b5a6ddb583bf6aba522987824221bec132eeb0fa3e8
- MD5 452cef23570623d3d404d56d31bbb029
- SHA1 b49b65e4e7f8832c288c16e284a54b7d1fc78d34
- SHA512 507eeb47e56dbd6e96141592fd3ba12909e16f0481b59c4eda943b8480938bde3c00847ba8d86c29bb415bd6958c637ee0df42818f69d7b4a6f74f229198bb72
- SSDEEP 12288:0/Z1IyE0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:oZuUgXe4i7ojhsP5Lgrk1TWb4AN5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
- Size 5.4MB
- SHA256 96ff6482bb8a27cee95b99df2e2589dbb83d53ce06647d7918eec1cc5523a874
- MD5 66f0d1e9623741e28a7cef040ce26027
- SHA1 ae3eb51c38b77a6fb7adc0a77c4167404ac0bf35
- SHA512 5c2afda8d4da1a9d57e82d6255bd5707ded1b48d3f1d3770a5fc7d9bb46f792ab8bfe2bed90cddf01c00f8ec5fa1e2aa4eee0691a6788a899a31a5621f895e52
- SSDEEP 49152:z0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjS7yY7BHi3u7L/gBUUWLq:fwfhY7g/rLe7yYA3awr341gxU023W
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
- Size 2.2MB
- SHA256 58606fbd94db9a9833cd331d62ffa0e16f03872f60715bb402183fd797373b07
- MD5 3a68c335245da3bc07a613d047680164
- SHA1 c74a60c47fddce25ca50fa5d25ce94912aa68392
- SHA512 8f47870f48e09caaec83cace2dd9fbca50d2d6842a671d0a694c8bca09a6177ce3935bddb8f3eaaaff977a70adbd666284a3069bfb787c2c970485c7aaab66d4
- SSDEEP 49152:4y7mTd0GxN8jyynSHjXKUyn4GVcbDSKrNTxge30jaNf1TWbdz:nmYeySHjWjMTgU023W
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\SetupMetrics\7e18a381-3544-4c07-b5de-ddfdb5f4c8de.tmp
- Size 488B
- SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
- MD5 6d971ce11af4a6a93a4311841da1a178
- SHA1 cbfdbc9b184f340cbad764abc4d8a31b9c250176
- SHA512 c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 3057649e69d0c5138298232c7cbcd45733e6ed6d09388337d3653c0ee3ad759c
- MD5 e74d962cabe3487c4a6ee1163c95ae11
- SHA1 888dcdca464bee685890c15ad74ec480dd15955b
- SHA512 1c2043236d6caf07f009bfda3407bb70409d35d108af7c0fe2392f57618cc0268daf68926c8155e0bd43bba4d446708b0ca631e5b880bbcb44b7942ebc0ea171
- SSDEEP 24576:ncP4mcvIjkGOxhKP2l71SNKbrh/8KBMgXe4i7ojhsP5Lgrk1TWb4AN5:cP4m4IpOO67N8K1e30jaNf1TWbdz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\dotnet\dotnet.exe
- Size 701KB
- SHA256 ae73e2b063ff8046adfcb814d4c1d7d593452006732e45e551a107902422f733
- MD5 b7921f3777e2511dcd679685e8b14cb6
- SHA1 fff0d606b4f96425e3297067a9eb4e6e7cdb316d
- SHA512 bedb1928b4a8ffee513b9e307ffe90a6acb3f4c283c552c6e25c67c0ca0990f8283eb0d0336bdaee0e7dcbdf9bdabc9984c7107dcbfe61f9478f1bb7e50aa69d
- SSDEEP 12288:OUFmDDLq0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:0jgXe4i7ojhsP5Lgrk1TWb4AN5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
- Size 40B
- SHA256 62d7beeb501a1dcd8ce49a2f96b3346f4a7823c6f5c47dac0e6dc6e486801790
- MD5 23e6ef5a90e33c22bae14f76f2684f3a
- SHA1 77c72b67f257c2dde499789fd62a0dc0503f3f21
- SHA512 23be0240146ba8d857fc8d37d77eb722066065877d1f698f0d3e185fcdae3daf9e1b2580a1db839c1356a45b599996d5acc83fda2af36840d3a8748684df5122
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
- Size 193KB
- SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
- MD5 ef36a84ad2bc23f79d171c604b56de29
- SHA1 38d6569cd30d096140e752db5d98d53cf304a8fc
- SHA512 dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be
- SSDEEP 3072:HXm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4g2rJBXCy9enoN:HXUMCm4U6q62MEBi99g6JVCvoZhhl+No
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 7e142de641c1f3302fa7d66e576a8474d5ae0c06f238189b451bdbc58cf4cfe5
- MD5 a66766ab7f14b381f2be23b45c55c634
- SHA1 8937038f0787195b0cd606e0219913a92630aeea
- SHA512 551d123675f852c1a389458f7bef9ea3f52aebf12da41f3c53c7bc14b785e7412d7d8278601da3e315601c2404860646d1a83af308fcba2f2368438f78efc4e5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 356B
- SHA256 98b8c83a36ebb19623c74085ada9f1ac1514333d0ba98516cb647baf1ad937a0
- MD5 9b6ec61355f9a489f4175155181c7fab
- SHA1 8276aa585854d8b628cd7a91e1f9edfa15367932
- SHA512 a2188de8e6960550b73ae3a432d9ed728240bb691f0e2482818bcbdc7706625c6876e33aff37c118bf696655a1eb33a5307d1647824d3f3d943531b0436b527c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 5KB
- SHA256 161ada61b4cc0d21ea0a43ddab5465caff33b378a9fe1742747b908091030bfb
- MD5 b40501c41cee4ef346a030ea233d168a
- SHA1 e4995bff4ae2c817f3d4761412a124f2771e6dc5
- SHA512 755cb0400089144f9d3f0a5bcf9df11ba17f8aa46ed869ecb32234a0214446c7e73446c5ccdefdcd0589a90b9ca0fd975532c06d69e998c4c4475a4769669490
- SSDEEP 96:iXfIgEKQXYeVkJ6yd8iZRy7Dx+6MSmueABOLDBhu2MEVMup:iXHFQRaJ6Q8syh+FQGBYPU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe577a60.TMP
- Size 2KB
- SHA256 975c8308bab1dce91143c9ad18effdd216bc367fccb3195ec2d4fd50177d2158
- MD5 8441fa327ce1f6c12f371a1535e655be
- SHA1 7ccca62179f1eb9a2d47c3886ad8ad4bf5b15071
- SHA512 986088d4595dc5a9e166ecc0b439a878a24d512f236b2756e377050c0cc7423143d3aaa3033ba5163b28fe8551313ff985d6df2ab109117186e878ca4a98d0a4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 114efa52bb66c48a6a1dfd8836a915bad7e01914b34b82ddb75de7d8d0673d13
- MD5 c5e26424d3ff953b41c4ff6dc6b826cf
- SHA1 bf1270ac7d7dd4b04b63b380601b11ea1bebe2ff
- SHA512 802cb7815944443b4ee8deb9283b54715ba2c7f80650ee323842f670094430a8c9b7bdae65e4b87a97f04e7636df1b08c6ed430206ccfb903148f58aa16e443c
- SSDEEP 384:qK56LPLedbXjV1kXqKf/pUZNCgVLH2Hf9SLrUS9HGKXO3RY:qy6LPLQDjV1kXqKf/pUZNCgVLH2HfUL7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 263KB
- SHA256 1ff26d51cf65de49ba4144c50ba148bd3d4c0a4ee61583c7a482d044a17b36a9
- MD5 7fd9fb6af782fe1d6ac4f0316deb3670
- SHA1 d6847c459e0c0b04b3136dea65e012c2614cb07c
- SHA512 3729db702445cc4bf620530c2d7982fa356685a2f0b66e62096e98a859726e4a261c90a7d4a12a2dd32c0c7de80fec193ae0ecc61bd722ffa6d89adba041394a
- SSDEEP 3072:vvgv+JSSB8EYIq1P2jxX5rIvEZmz5q1ScEqETt1D72NoT0oRiyksZkF3ZiC3aXZ+:oG8t2jQMcAPNmJZ5IZXqXHjTdCP3y/M
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
- Size 7KB
- SHA256 3c6a71f3591972a9084b1e68e812f1cda93477fd7a535d40a3701183cfa396c6
- MD5 2fbc51cb56435e93192adf07dd2a3e55
- SHA1 20ed427872d5d5119ac3901cb88f1f5302a1492a
- SHA512 3f25457ea280544ab16393b71a84bfc12a6242e31d3cb3cb5c033a2cc4755366f94b5fb4711fd6fedf021b1e82c433d5ce3b4c8b0ba68a2e55e9e8bad6cf0846
- SSDEEP 96:a6R6jpO7KCqvPK7gFwK3LK33OhwsHXC50wK24K2ZTPXBBbkA+jj:D04/7PW9nCTypBbkAMj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
- Size 8KB
- SHA256 b34e07de1de7014840aaa94c4d15924f5f4652de26bfea614bfd203af99fa2e3
- MD5 3a422ca38c461f85e3db299c8b268f93
- SHA1 9ae114131c4c232e0b6ca5b618a8debd77d6d0cb
- SHA512 f451b759e38cb5120fa2fd1a8199f6637cf5cfe2c786a7023c5d9845a60ec51361b8b0ae1d55a5c6108e3e5035d931d4ef0c11f1851f6d2550df57f4f25867c5
- SSDEEP 96:a6R6jpO7KCqvPK7gFwK3LK33OhwsHXC50wK24K2ZTPXBBbkA+ju3aT4VwK3+K3p6:D04/7PW9nCTypBbkAMrTvzX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\fd449e11293b476c.bin
- Size 12KB
- SHA256 973a407a1442d11f8852277077877d3f56b1963a60f84b4deee99596eed94a86
- MD5 0b79c01d0c58268a000e907f71a8f6e9
- SHA1 b6f4e31ba7faf1e7ea05eda3aebe239ddc482720
- SHA512 3c3b5545429fe252370028c10ea313a5b48d87315942ee3d11ec0ee73fbfa366168d37064c64d7f082591ebb347de7848e46fc5754c9c56adb1d70336e8d5d3a
- SSDEEP 192:fkdp08sOiKH13nvzbJ0Lh+MaMj42Vn5G8w7qkxcYxjPncHcSk1kMGQp:ge6iSvzbuaMj42Hw7qNYxjPc8Sk1kMn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 f9dde7ff2efceb410237a89234e0c30166f3ddd77185f3c077eeb4cc3975f293
- MD5 eb8243ce42dbc8a529b7c22c1c58503f
- SHA1 e113fce3e76356240f99f6bb52b89d07399ffb0f
- SHA512 367bc7eca5e8e24e67d8d27dadcde605921fa61e82baf6f653ec4567a0f9470118f892f9f5562d0004326083f77370efb77aefa0467e4ba0604c44669e70cd51
- SSDEEP 12288:2n0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:20gXe4i7ojhsP5Lgrk1TWb4AN5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 053e2b55bd8fd9078ed36e2d9746d02eec5be38aef3e6d245618e27a21179a21
- MD5 192c3b23ab82d474ea80823f2e13b0c6
- SHA1 7dc2fee7f623f33484ae26fea79956020bb97400
- SHA512 74067b74f63541982beb203ce9c0fbbb96d158bcebdbf30b056967dd30d8d744a84d4bc4537313cb8e2ed6eeaac56318890f94d4b0ca28f76d47ab45d8c2a244
- SSDEEP 49152:5a0h2GEkuAe73q3pp46zwwQBe30jaNf1TWbdz:5a0hNYG4JwYU023W
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 659KB
- SHA256 ba09f31539f4320c9e7e8d7175f3703fa1f612875f5ceffe8340b1989104397e
- MD5 299b0dda1d7d61b6eff8c0bf1cd646df
- SHA1 4d7ee9774e0161180dab40f6f8fbcdaccbc4088b
- SHA512 49fda607d40dabde8cb949caca8a469c4851dfea1a84993f498c4c5dd956e4e0d1c0985238a3aa54fd2ca6f67344fae67dc48cee81778dcdc8be790ac5cbf1e9
- SSDEEP 12288:0hbHjfXQ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:0hbHjPxgXe4i7ojhsP5Lgrk1TWb4AN5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 f3ecad7bfecf4b20970c3d59feb12e1c6fcb30bc45cfd16970dcca9eba695285
- MD5 76eadf80a45a4d2c5ac2b486bd659fab
- SHA1 1221db448bf48461c4f34fa567e1c63352e7ca1d
- SHA512 56687d43186546333a7393ffe19497cba581feb092740ae470e603c170a11b64fc7e697cb88306727da3996ae032166e9d7651fd0003f08f73dafd5215fc7886
- SSDEEP 24576:Q3YgnJcRTk4yti+R5dpR/5gXe4i7ojhsP5Lgrk1TWb4AN5:QIgnaTk46ppR/Ee30jaNf1TWbdz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Locator.exe
- Size 578KB
- SHA256 ea0c6a088cb48850c2201e2b466eedeba48cfd8ab7a4c9984259374dab861a83
- MD5 ed25cf92ae5acb4c007e0f718a1d096f
- SHA1 9de414e7c64ae04377084691c669f8833146e1be
- SHA512 1fe4f8f72b387cd40fdc1571baaf830dbc2df734fd90a9cf22a401d08b09986bbe443f585fa32ae487146cf1102b7c129a1a7501c64d0e833ef12fe3a8f8da2a
- SSDEEP 12288:Tdr0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:hIgXe4i7ojhsP5Lgrk1TWb4AN5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 940KB
- SHA256 178e53f238e5a660d27de07bd04bc8d63c9d8cb360249cc93b91fbbb13003673
- MD5 950750ae1134f3a9c36f41872736dee1
- SHA1 7ee429fed402adae7788152f15445a6024f733cc
- SHA512 8c8171036e98e72e1e700509e769cab62476ee6a2fd11c05897c9f9ea68c9ccac6251f88f5cbb8bded9ae53be9d98a6e04878701d836b110a996d42d67bc5631
- SSDEEP 12288:cObvA4LWOsvAYFTC0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAf:BrL3UTbgXe4i7ojhsP5Lgrk1TWb4AN5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 671KB
- SHA256 34325be154cfec5915955000f7487566fddb9dd014e22092adbc4c06e6c8786a
- MD5 dbd43bc23abbfa4d80d99c7b08be155e
- SHA1 574c30a933bd3fd051c001d6d979a7f59afb0d8e
- SHA512 09c07f9b98552477aed2af81705db35fa6551b9dff1b44c7236cc38811d1cc5fc3213274eec1917120bd312089ec596def7a48a1ed28cd8d9581394190f63f3c
- SSDEEP 12288:kpFtYOW0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:/OPgXe4i7ojhsP5Lgrk1TWb4AN5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 becb7c08449279d3cb02c99db05e8b1effa9104b350a2f36d98837cd778e15fd
- MD5 c431b6b229a1f0fadf3c0fddc884eab7
- SHA1 dcdd9f38216b4e819ef40147f1c8976048da949b
- SHA512 7e2d65f5e2078bc441ee020b26ae4e972c48b3ceaa120b5f7edc97dacae038410f63f9d96749a634e32ce62784b250c678ee9ced42d42f31484d19f2b9e6828c
- SSDEEP 24576:i7NM9YmZqmWMUkPjZM48Mv6bEhskgXe4i7ojhsP5Lgrk1TWb4AN5:i7cBWMpPjN8DbEhse30jaNf1TWbdz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 19bcdb612832ee1ee8b5ea46974f720575de30fcba0c110b0676d3ca19782347
- MD5 c094271bf9f9f42b9a036641f359d08b
- SHA1 54ae333db75fd7efb48e995d0819ddb34fb72b20
- SHA512 2d390ecb4a2c76cad814de4d71b4d8fc2726ed834e6ffd76dade5aa2e1cb31e5cbcc560d6697b6ab03b3f8e1263d3d0c6c2971496ba59d01fc6e4a658d4c19a7
- SSDEEP 49152:WF2YuHNETovcvNYf8kmre30jaNf1TWbdz:X6tCf8kGU023W
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 3f07decb8112efbd20a942d22977a55aa626377f9d0d8bb767faf471d1f99522
- MD5 8818e1cd51453fdf47d5cbbe52692300
- SHA1 a2a88e25a7461f353a0d51c7644fd9f5da61e594
- SHA512 216585b5a7ff8a42c22a98e685ad968038c6c93aa2c67c5da30860077342799d23c8e9e8b4122aaa02bed576242fb3e847a2c459f3062453b66fe7321ec65388
- SSDEEP 24576:EAFs06+OmlfQNXEbTozgXe4i7ojhsP5Lgrk1TWb4AN5:JFs060lcXuhe30jaNf1TWbdz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\TieringEngineService.exe
- Size 885KB
- SHA256 7bb42edf90e66edf520d2bded61b968d129c51a116466158cc925459d94e4a3b
- MD5 e9a0f1b975cc62c0f3109a5f3d6c07ab
- SHA1 19cc94e45067c6500bdfbee8fa7bbf28ebebbbd1
- SHA512 b52d90f7b654c2488c09731e21f90ff8e18accf84fb3489203f2e45b35dd6d54a25407b14b080fb00d8ecf90439956ad8658cf2d147657a57707266b6bc4c247
- SSDEEP 24576:lJnJ5D3WtugXe4i7ojhsP5Lgrk1TWb4AN5:lJnJ5DGthe30jaNf1TWbdz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 263464ecb8e62cd4b284ae00f379810d2c8c4b0f0749bc7e55c869ea22c5ac4e
- MD5 d607edb1badfa98797c4ea9a3fef902e
- SHA1 2b506f26395c54a8edaacf12d7c0d2f475d975db
- SHA512 deea506ad0967525fd4aa482294fb444796af62369436814484f21d86042b406f1a2beb1c30017e5b99363ec92f536c888dae0aac57bc16fbebf6920e8e313de
- SSDEEP 49152:Fo06DIKdwc+eQnSt65aVHe30jaNf1TWbdz:SdU023W
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\alg.exe
- Size 661KB
- SHA256 906a046d88bc92cef243a0c27cc56aa890d39779ef85624fcee01620cb2d136d
- MD5 add29667467f1e6508457efe3ad10f7a
- SHA1 2ff096027675115b036a110a8981954b76ef206b
- SHA512 7b35293dbe621e73e09bc834cc5a378509b4648d4e82ba9f01710121514e20a734c89728e116066b7c172de3791f23b0945bb8711b2b054eaa7766fe865343cc
- SSDEEP 12288:qEP3Rre0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:JrXgXe4i7ojhsP5Lgrk1TWb4AN5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\msdtc.exe
- Size 712KB
- SHA256 747598633efab4a4eeca5497f2eb512c08355531a9726265855eb27f789c37d6
- MD5 d8b59f9662fd5473a664f77108a72d68
- SHA1 3da4fe9108ff361ff33086be5be206e756ef9a2e
- SHA512 20f1b8cf897cd0a3165d47cc84d322836436b70430a83367d03ec19c19894884b9a4788224e106ed99896cb877aa2a7fc1bc12a0e6f226dcd6980e95f9c666e9
- SSDEEP 12288:vjkyA0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:vIyBgXe4i7ojhsP5Lgrk1TWb4AN5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\snmptrap.exe
- Size 584KB
- SHA256 4e0b41c4cd3f9001470bf6993a939f931ecac4e42a91f0a16648ae2db1c2cf10
- MD5 7f3f92c2f3711bbce602fe81a666134d
- SHA1 854b75c3bb6ff04b9bd9a37807d1ac978378c877
- SHA512 a6c78d959f9ef18000a01461c5ae3257140fd3b8fbdee7b1dc121132c887f9971d4039ba4447231419ea075fa2d27831605e9f210070db104dcaa2647c083313
- SSDEEP 12288:xFG0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3fgXe4i7ojhsP5Lgrk1TWb4AN5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 a28013cc3cc312d73aaf68cdec4986e1785d4a9489e41d31693158191a7db00a
- MD5 37d63e676db76754014ee66997c171f9
- SHA1 134599b99c0c00fe587ff971088e563ecbc224bf
- SHA512 b857e376da95d3e92ce3169528b80b22763ba15cd40640ecbb97c429a0214268dcaae175c72effbcc1252c684dd2c2ebf864ab7a96b872003c7394a8548a4267
- SSDEEP 24576:MQ9MxZKdcz97w38gXe4i7ojhsP5Lgrk1TWb4AN5:MVKXTe30jaNf1TWbdz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 772KB
- SHA256 cbd7dbe989af9db3cce97572f8c24169ea4cb433accd73ebecd6d18e3809234d
- MD5 1a6604a280f590ab2b035b2ebf221310
- SHA1 6024b6a948d756a79997b16987f90e15ac05caaa
- SHA512 a6bb25b64e1db71da5929d252fc03d890ee485c55b7bd7fd56f27b1cd22b2864a7756a7d02520fb5f8fc13ed9476c5be8fb82fbc7c60be0f79c0cab1612c3c84
- SSDEEP 24576:yyocxAp1gXe4i7ojhsP5Lgrk1TWb4AN5:vocxApge30jaNf1TWbdz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 987655351d77cb4b1f1038882d79ec669b95f01156ad00e8b99cf7a7ab81a08d
- MD5 6c323140328ccdc8ae4d8c0ad2d4aa57
- SHA1 ae888de2b139854c44ccd48f60949b14b693a25a
- SHA512 1bc9ee6a22408c239a9ee27fdc4010dd6db3c7f06b360a0debde80e68d59f448c826958fe3ce7bc70b267f747323e48ccd37b9b77a99faa39010c3de9776fbad
- SSDEEP 49152:wWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKge30jaNf1TWbdz:i0zuNI0U023W
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\Crashpad\settings.dat
- Size 40B
- SHA256 fdf37f8111f0fabb5be766202a1a0b5a294818c4c448af0fec9003242123e3e6
- MD5 440112092893b01f78caecd30d754c2c
- SHA1 f91512acaa9b371b541b1d6cd789dff5f6501dd3
- SHA512 194c7b90414a57eb8f5ba0fc504e585ab26b2830ed0aae29cf126d5a6c4888d508c22984aeedec651c8644fb1f874fa558b2090488516b33165fe7985d2815ea
- MD5 SHA1 SHA512
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 9d3e0ce4befb3fd11e0152ee28875cba3cfef8ee02c9c7a7a7736b7bc2418116
- MD5 2aeef656b2cb3531027a6e1438efd066
- SHA1 c170c3230677ca0fbbddbece59254a8108d1a6bf
- SHA512 86c92baf7c592641e7b57a5e0cb0f1f3b462c15f0e0178b70909dca39c0107c11d446695290617ff492bf82c68ae0df5817cb5e7b9c0fd4ddf3077a9018a0089
- SSDEEP 24576:g1QT7EcpfxR+N5AWAz3ooiYsjMqbygXe4i7ojhsP5Lgrk1TWb4AN5:dTDxR+N5YzTujMme30jaNf1TWbdz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system32\SgrmBroker.exe
- Size 877KB
- SHA256 3d91b0124b1f898e53866e77e1083fb91029908ec744ff8d3a6ee0724ab07c92
- MD5 3c6069198bb13166f272c2f624b7d024
- SHA1 be436aa60d7a32be8c4e9d7d18714a1842a2291b
- SHA512 9e91b156b6df8571a033a8bf97123866c414faef4567149ac6615b43e102da5992ea9e643053bdff3e2e82fc33c7417beac833608dd5aa20cf9777741eaa37d8
- SSDEEP 24576:cTMdOz0FFS+hmSLGgXe4i7ojhsP5Lgrk1TWb4AN5:00K+hmSLJe30jaNf1TWbdz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system32\msiexec.exe
- Size 635KB
- SHA256 664dfda4a9382d8dac8a28e738bcc306de9c1c8f068ba56154b9ed4435aa110b
- MD5 072d17480a1e5e715b7350a00cd574f2
- SHA1 ecb0f855ff68ddd147708a8d31767f3aba60e7a2
- SHA512 c35ff488301dfc8401985e7ce05b138726942832fffcf94bb60fca1533dedcd92de5f04ca16d64dd59681fed7d92791c1732cc286c7732bf9b84f98504008e73
- SSDEEP 12288:c47C0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:LbgXe4i7ojhsP5Lgrk1TWb4AN5
- MD5 SHA1 SHA512 SSDEEP