Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
30/06/2024, 17:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
General
- Target 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe
- Size 5.5MB
- Sample240630-we2e8a1gkg
- SHA256 0d5ed89b1af2e3c85862ee2fb835a5cfbe7612a694da39fa5b3e2e8256422fbe
- MD5 30ac24d3740109299a5226b3b7282887
- SHA1 8870b862b3d7dfc6fd00e67e193733ae1b158319
- SHA512 b661ba111446b0aa70f29847608bdb6aed21cd4e8e700f25722c1c4576401aefe753fdd4e1a70f0a571b36470206a690ea5d40183cc901be5ede40a66c816dc1
- SSDEEP 49152:VEFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1Ln9tJEUxDG0BYYrLA50IHLGfl:JAI5pAdVJn9tbnR1VgBVmEUtq
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 26 IoCs
pid Process 4904 alg.exe 2248 DiagnosticsHub.StandardCollector.Service.exe 1572 fxssvc.exe 1692 elevation_service.exe 3248 elevation_service.exe 4724 maintenanceservice.exe 1088 msdtc.exe 4668 OSE.EXE 916 PerceptionSimulationService.exe 3772 perfhost.exe 4080 locator.exe 2880 SensorDataService.exe 3824 snmptrap.exe 3668 spectrum.exe 4128 ssh-agent.exe 4928 TieringEngineService.exe 1932 AgentService.exe 3168 vds.exe 3888 vssvc.exe 4796 wbengine.exe 1644 WmiApSrv.exe 940 SearchIndexer.exe 5916 chrmstp.exe 6100 chrmstp.exe 320 chrmstp.exe 5144 chrmstp.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\system32\spectrum.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Windows\system32\wbengine.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Windows\System32\vds.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Windows\System32\msdtc.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Windows\system32\msiexec.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Windows\system32\AgentService.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Windows\system32\locator.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Windows\System32\snmptrap.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Windows\system32\vssvc.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\bf522891c8648821.bin alg.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zG.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{14DF0EF0-439C-4CF1-9E8A-D1E954BF645B}\chrome_installer.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\java.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000025e35e1516cbda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f84eca1516cbda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000237a901516cbda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d5ff7f1516cbda01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000675c951516cbda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b513d1516cbda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec4d771516cbda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d023c31516cbda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001235fc1516cbda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000042923a1516cbda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b23531516cbda01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0edad1516cbda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ chrmstp.exe - Suspicious behavior: EnumeratesProcesses 41 IoCs
pid Process 4224 chrome.exe 4224 chrome.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 4224 chrome.exe 4224 chrome.exe 5220 chrome.exe 5220 chrome.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4224 chrome.exe 4224 chrome.exe 4224 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4612 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe Token: SeTakeOwnershipPrivilege 3228 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe Token: SeAuditPrivilege 1572 fxssvc.exe Token: SeShutdownPrivilege 4224 chrome.exe Token: SeCreatePagefilePrivilege 4224 chrome.exe Token: SeShutdownPrivilege 4224 chrome.exe Token: SeCreatePagefilePrivilege 4224 chrome.exe Token: SeRestorePrivilege 4928 TieringEngineService.exe Token: SeManageVolumePrivilege 4928 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 1932 AgentService.exe Token: SeBackupPrivilege 3888 vssvc.exe Token: SeRestorePrivilege 3888 vssvc.exe Token: SeAuditPrivilege 3888 vssvc.exe Token: SeBackupPrivilege 4796 wbengine.exe Token: SeRestorePrivilege 4796 wbengine.exe Token: SeSecurityPrivilege 4796 wbengine.exe Token: SeShutdownPrivilege 4224 chrome.exe Token: SeCreatePagefilePrivilege 4224 chrome.exe Token: 33 940 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 940 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 940 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 940 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 940 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 940 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 940 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 940 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 940 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 940 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 940 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 940 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 940 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 940 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 940 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 940 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 940 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 940 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 940 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 940 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 940 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 940 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 940 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 940 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 940 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 940 SearchIndexer.exe Token: SeShutdownPrivilege 4224 chrome.exe Token: SeCreatePagefilePrivilege 4224 chrome.exe Token: SeShutdownPrivilege 4224 chrome.exe Token: SeCreatePagefilePrivilege 4224 chrome.exe Token: SeShutdownPrivilege 4224 chrome.exe Token: SeCreatePagefilePrivilege 4224 chrome.exe Token: SeShutdownPrivilege 4224 chrome.exe Token: SeCreatePagefilePrivilege 4224 chrome.exe Token: SeShutdownPrivilege 4224 chrome.exe Token: SeCreatePagefilePrivilege 4224 chrome.exe Token: SeShutdownPrivilege 4224 chrome.exe Token: SeCreatePagefilePrivilege 4224 chrome.exe Token: SeShutdownPrivilege 4224 chrome.exe Token: SeCreatePagefilePrivilege 4224 chrome.exe Token: SeShutdownPrivilege 4224 chrome.exe Token: SeCreatePagefilePrivilege 4224 chrome.exe Token: SeShutdownPrivilege 4224 chrome.exe Token: SeCreatePagefilePrivilege 4224 chrome.exe Token: SeShutdownPrivilege 4224 chrome.exe Token: SeCreatePagefilePrivilege 4224 chrome.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4224 chrome.exe 4224 chrome.exe 4224 chrome.exe 320 chrmstp.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4612 wrote to memory of 3228 4612 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 80 PID 4612 wrote to memory of 3228 4612 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 80 PID 4612 wrote to memory of 4224 4612 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 81 PID 4612 wrote to memory of 4224 4612 2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe 81 PID 4224 wrote to memory of 1860 4224 chrome.exe 82 PID 4224 wrote to memory of 1860 4224 chrome.exe 82 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 2900 4224 chrome.exe 91 PID 4224 wrote to memory of 3884 4224 chrome.exe 92 PID 4224 wrote to memory of 3884 4224 chrome.exe 92 PID 4224 wrote to memory of 5016 4224 chrome.exe 93 PID 4224 wrote to memory of 5016 4224 chrome.exe 93 PID 4224 wrote to memory of 5016 4224 chrome.exe 93 PID 4224 wrote to memory of 5016 4224 chrome.exe 93 PID 4224 wrote to memory of 5016 4224 chrome.exe 93 PID 4224 wrote to memory of 5016 4224 chrome.exe 93 PID 4224 wrote to memory of 5016 4224 chrome.exe 93 PID 4224 wrote to memory of 5016 4224 chrome.exe 93 PID 4224 wrote to memory of 5016 4224 chrome.exe 93 PID 4224 wrote to memory of 5016 4224 chrome.exe 93 PID 4224 wrote to memory of 5016 4224 chrome.exe 93 PID 4224 wrote to memory of 5016 4224 chrome.exe 93 PID 4224 wrote to memory of 5016 4224 chrome.exe 93 PID 4224 wrote to memory of 5016 4224 chrome.exe 93 PID 4224 wrote to memory of 5016 4224 chrome.exe 93 PID 4224 wrote to memory of 5016 4224 chrome.exe 93 PID 4224 wrote to memory of 5016 4224 chrome.exe 93 PID 4224 wrote to memory of 5016 4224 chrome.exe 93 PID 4224 wrote to memory of 5016 4224 chrome.exe 93 PID 4224 wrote to memory of 5016 4224 chrome.exe 93 PID 4224 wrote to memory of 5016 4224 chrome.exe 93 PID 4224 wrote to memory of 5016 4224 chrome.exe 93 PID 4224 wrote to memory of 5016 4224 chrome.exe 93 PID 4224 wrote to memory of 5016 4224 chrome.exe 93 PID 4224 wrote to memory of 5016 4224 chrome.exe 93 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exeC:\Users\Admin\AppData\Local\Temp\2024-06-30_30ac24d3740109299a5226b3b7282887_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2cc,0x2d0,0x2d4,0x2a0,0x2d8,0x140462458,0x140462468,0x1404624782⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb2a9ab58,0x7ffbb2a9ab68,0x7ffbb2a9ab783⤵PID:1860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1948,i,14872697946614609202,10171596861665329348,131072 /prefetch:23⤵PID:2900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1948,i,14872697946614609202,10171596861665329348,131072 /prefetch:83⤵PID:3884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2208 --field-trial-handle=1948,i,14872697946614609202,10171596861665329348,131072 /prefetch:83⤵PID:5016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3088 --field-trial-handle=1948,i,14872697946614609202,10171596861665329348,131072 /prefetch:13⤵PID:2944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3080 --field-trial-handle=1948,i,14872697946614609202,10171596861665329348,131072 /prefetch:13⤵PID:1364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4288 --field-trial-handle=1948,i,14872697946614609202,10171596861665329348,131072 /prefetch:13⤵PID:4896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4648 --field-trial-handle=1948,i,14872697946614609202,10171596861665329348,131072 /prefetch:83⤵PID:5784
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings3⤵
- Executes dropped EXE
PID:5916 -
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae684⤵
- Executes dropped EXE
PID:6100
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=04⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:320 -
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae685⤵
- Executes dropped EXE
PID:5144
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 --field-trial-handle=1948,i,14872697946614609202,10171596861665329348,131072 /prefetch:83⤵PID:5924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 --field-trial-handle=1948,i,14872697946614609202,10171596861665329348,131072 /prefetch:83⤵PID:5388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 --field-trial-handle=1948,i,14872697946614609202,10171596861665329348,131072 /prefetch:83⤵PID:3212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4664 --field-trial-handle=1948,i,14872697946614609202,10171596861665329348,131072 /prefetch:83⤵PID:5480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2628 --field-trial-handle=1948,i,14872697946614609202,10171596861665329348,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:5220
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4904
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:2248
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3976
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1572
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1692
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3248
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4724
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1088
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4668
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:916
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:3772
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:4080
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2880
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3824
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3668
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4128
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4928
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:4332
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1932
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:3168
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3888
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4796
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:1644
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:940 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5644
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:5700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
- Size 2.1MB
- SHA256 2d40c28cd1caac3f91359bea4a3eddd2148f265140461e7b4cf5fcf7a9084fe0
- MD5 eb7c0973add55012da13432222c5b943
- SHA1 8a67ae863a1f52d6dce8afaecd4ab1a8ba2174a7
- SHA512 0679a5c5c4e90d4c9b26bc6b7c774cd82b5df6d1d1f880ce17d11a87ffdf8fb47d206745ee80733f883e8cf51700ce9743cd9c4ac02d668e205d60e5489cd60a
- SSDEEP 49152:quYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5nUpLei7dGy:qPfTqi90brUtq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 797KB
- SHA256 cf1ec59363b9f3a22e5714aba216842afe5422ca17cd227cbebe2cf5b927fd48
- MD5 8e3109b6ed2109f0f059ebcfa9b54f38
- SHA1 196c30c0df5c7328d334403f38dfb6268691f35d
- SHA512 dbba6b77e614d6042b615cebc8015940507fe9a1d2d700a19260d5ea1b0ac3a3519e09e2f6a966de3f22850402a5ef74717296178cc9d202c4acd3e46796236b
- SSDEEP 12288:0cQiQmNJLBsunEFeSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:midnBsuEFet/HU9zPjeidP1Yi/dGyA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 01dc5570e4f35b4cd9f057505ca80554b8641dcd9b8307a96aa256aec11e6895
- MD5 87793882e1d0cdb9940d53f4d865508e
- SHA1 ed952595f29d1f50081773d936119f2f431a0955
- SHA512 6ffc0d7c64b459efd2fbda74ffec6a03e3eb1b5da9e76ab65e3ea71d7be516a375e013f0aef0ce730ea6c31d58cb29193694c1027cc58056c2597e51fd9732d6
- SSDEEP 24576:w+gkEVfh4CoJet/HU9zPjeidP1Yi/dGyA:dgkExSOUpLei7dGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 a8bbb6cc5c785df1cb7cc78290cfd7221a267c721df3bbe54bf8c13cd64c15cd
- MD5 9cdd438b6d3973766d3bdfb27d3ccebc
- SHA1 dd19a8439ea4096d43e5870c196a382dddbe6bc6
- SHA512 5b8792cb7cf9ece7ec19757ce3d306fd86af8a0469472c4321c805b304a9c09d6c66e9e179cbbbf1e5abb312825cce8d3e6e2e1708970356616a994722292d7d
- SSDEEP 24576:1BpDRmi78gkPXlyo0Gxjruet/HU9zPjeidP1Yi/dGyA:/NRmi78gkPX4o0GxjHUpLei7dGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 b4b4c85aef14e1411c880b32d053db1c1615c9c10dbb03874b94fbff1a0a89a2
- MD5 3ca3ea6867991bd0a0da2f373bc60905
- SHA1 f28862f365e8ac0361cab51fa850ebc761a31f32
- SHA512 6768c09abf0a55b4dd79bece7823e8a5d85917bd9b8c97c410d18c40f7ff2d84c879743ce68a4f1b1f5f42db8e4e3a8d3c672f3019613ba809862cb9102b3046
- SSDEEP 24576:ZLOS2oyPIXVJet/HU9zPjeidP1Yi/dGyA:j/yvUpLei7dGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 bc4226a4b2a3d1dc3694e6c24a36fc5c2524132247a1fa3e99ffbbd2f5c1f3b9
- MD5 d74670f6265904bb88dccff0704fc887
- SHA1 8cc5a8f19d938ef7041c20b5d6e7e679f01cb898
- SHA512 1876866fb86a1459b7e5befe2d2308f6b6ce0331dc2590340f85626c409281f1243aac059c0f7aa2bdf83ca1e094d725d9647d6198785819ca1714476c3f964f
- SSDEEP 12288:2f/eSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:2f/et/HU9zPjeidP1Yi/dGyA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 239607f6df783e13982f2dc36aa631302511a0a82a45e203163fdeea488e4d5d
- MD5 d6270d82cd6960e1af5d5970c22e7c00
- SHA1 882c6dea10d7afccfe102d5056f4f746ecb343ea
- SHA512 6c1da45a99f1f954a06a3a5fca387f42d886313fe3e41f63d404cb27d1bf5cf4dead79525fd8f6849025784a26324b0ec6436b67ffdcd1d62529c9b0b07b221c
- SSDEEP 12288:neBNUbTVO86UkeSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:nJIUket/HU9zPjeidP1Yi/dGyA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 5f8bf675f053f2a58cf3a4b7e83a6959ac9e4438e2927b695fe9147311cb78d4
- MD5 802a254faa44393a753ad4e6ef479490
- SHA1 105945c0f3aa3442faf3b2a230ccaffbc5c9e160
- SHA512 bea88ac1df11c59ac88df19bdafb6acf0c48272c84dc18efd806899f30796d033ee09dbc88e76d19e3ecb44ba7a8186748affba1e32fe6aa21af2b42e11a8864
- SSDEEP 49152:hQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THQ:hQvGAdlCEL8c/yRNw5CwUtq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 f91134defedca46a9ba4a90926e494fea84d46d6728eb4ee3de8c2788e10addd
- MD5 5f77282c4f0ed83173a49d92b83d37d3
- SHA1 333434e003620f76d3dc69f345a08d312bc02baa
- SHA512 df9930d044c10d62810bb96fa5fdbf4a94c37571c34b2718c182255435ff2df980d8599ece02f94bda0b2d3e4da8e7a59a2ae4a207f8c65008a4b16818f2be9e
- SSDEEP 12288:0AwSfxL/2Dc34DLLmt0LDQewsAj2eSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVU:JdewsAj2et/HU9zPjeidP1Yi/dGyA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 789b404cad47d812d821895fff4e9e4729055133204234aa0c63a6c6e9b9aa59
- MD5 879d8d3b635ef8d4a718cb8514bbae1f
- SHA1 6871bc82030bf1cbaf9326846109c71574fd056a
- SHA512 d8dae9dcd561700633ec9d4ee6c16254167f100b88e77fb4f8cb3756a94451549e236da301ad910cbefc114c312a14c9936984b86db730bd4519a783f7d1f902
- SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHzUtq:2UEtQevvqc2W1cpV2EI32zUtq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 1afa68fc67811932a6af3224f4fde7d37304e74d9b406d18fb4ccecbb31bf2e3
- MD5 b7567aff28da80a8bb669624db96ea84
- SHA1 575f6e3ea0fb6b8628da378601ff94899e5ebed3
- SHA512 7e66cbb6193133cd1ef72754e99470cc30d6cee2120cf10f712bb79f42bcc112e629412c17f8fdea90a37ff293a52504dd8374cea3c80a727d06bc0740e195f8
- SSDEEP 49152:6CbRquA/m2yL5zifFiV+XenmE3/zLUpLei7dGy:PoqHVjnm0Utq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 abf330267afa2cf55ccba6f1459f2e0f3e5d17af83608f471e23c54a6604c084
- MD5 c5c881a400b773654a0c9299a1215044
- SHA1 9d94ad8ef10c9518183c06f2d85617e12468b4bd
- SHA512 32f21aa91cff15d4367b610b16b3d1c6c11b9328cb371c23bc6c000fbd8e6d32a5346722882ee4f7855795683ded41fb70cd9a0b9fee1c516ec2cf4f9e294cca
- SSDEEP 24576:PAhGLJIFoiwtA5l7S535et/HU9zPjeidP1Yi/dGyA:PAMyFoiq5EUpLei7dGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 9c94ac8a0e8c7f4d746bd9f4a6c20af42294bf817f0e24884df866ef3b165d54
- MD5 b293e86d1f909630c17b49f25165da6b
- SHA1 b77c7fefdf73ad3856edbe5e635873f9aa8a45be
- SHA512 1863bbdd855b327cfa51521c56d74a93cd8542e841b90a7c06c170bf4433beaf6d449e568d1e995b239b67a0676372e0d110a29c5dc828bb3f5931fda99c5517
- SSDEEP 12288:2mw5HEjsChNVBFgl0WDm+CdeSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX1w:vwuoOWiet/HU9zPjeidP1Yi/dGyA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 61b4cd8487c8ef4af2c5379480f7bf75f824041d08bf16cf68090892871b02ea
- MD5 9ec7afb20b966dd6d139ccade0644f01
- SHA1 fe2de2b6ddadb52d28c7e932e15ef3490c361df5
- SHA512 855fa1405651cfd9389e2a895ef97154d85cd781a9d5fa143b2534f87ae16f8fb667aae43083ec9eee90c777d10a4f6b842fcfc0c0b79060b2d5346d7501a5bc
- SSDEEP 12288:jBZ1IyGeSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:NZujet/HU9zPjeidP1Yi/dGyA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
- Size 5.4MB
- SHA256 33ebfdf6a1d36f4721bec3173becd26797801d03c2a5fae8bafd7cdbbb060d18
- MD5 57a08bc247bb3b09aaaede6ae687b56a
- SHA1 e015aedff37991623567fce4b27063a3b73b8505
- SHA512 c6a2b9fdcf99b942499fdc7aaf5b61d36f04f6e4b7090a2bc1fefa85ede43231ebb847c6ab629febad0cc518ec1612849ff0e639045940fb9232dc66b83ec9b7
- SSDEEP 49152:y0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWLg:EwfhY7g/rLd7yYA3awr341gsUtq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
- Size 2.2MB
- SHA256 6b2a341a0395fc22846e7db6ddcf774b944c767a82dd84bd9c0a19eaef206293
- MD5 59356162b53cb060811e6be89d8033e6
- SHA1 c05a4630c0a0d5e16f6081fd3e49e7acd5722c74
- SHA512 b83beb5a1bfa0fe47f0ef2845599d05ab68e2e6cf91595ad7190d922dd4739768189dc8721b35b563b710a3012d9bac67d1efefba600e790f69f25ae4a236965
- SSDEEP 49152:By7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxrUpLei7dGy:cmYeyxHjWjMTrUtq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\SetupMetrics\82519739-a701-4db5-b692-77306ee88b88.tmp
- Size 488B
- SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
- MD5 6d971ce11af4a6a93a4311841da1a178
- SHA1 cbfdbc9b184f340cbad764abc4d8a31b9c250176
- SHA512 c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 48b42b8cb41d1decf3b3e5e0590a2ff5707fe80edc307bf181956addd06a472f
- MD5 0662003d09ef314fb3f74213368bcb1d
- SHA1 deeef3b411acbc854ed38a91367c1172d614e295
- SHA512 a7d27f46a87d729adde6f40aa6c93c25cbd71e5aeea0a5b9a8962f2886c72e0f17d62b341adaaba67d45033e4122c12be5fb168ded4bbefcfe46e03604c48ada
- SSDEEP 24576:BcP4mcvIjkGOxhKP2l71SNKbrh/8KB7et/HU9zPjeidP1Yi/dGyA:WP4m4IpOO67N8KwUpLei7dGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
- Size 40B
- SHA256 f36101d056932eba1217b54d3ee1c54e0c6c4120087bf1e1e0781625d2be6fc9
- MD5 89f55681cd116518c116754e0407b2c8
- SHA1 f5d4aeb85e94ba181091d6a1ebca93915919c9c6
- SHA512 8db0dc249a77703508e63c8314af4bddcf54ac4f887b26409f743b344b94f9afe762d266cbac8b8097ffb28870d40841c7f64ed60acd087dbc1768db15b1c0cf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
- Size 193KB
- SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
- MD5 ef36a84ad2bc23f79d171c604b56de29
- SHA1 38d6569cd30d096140e752db5d98d53cf304a8fc
- SHA512 dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be
- SSDEEP 3072:HXm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4g2rJBXCy9enoN:HXUMCm4U6q62MEBi99g6JVCvoZhhl+No
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 5KB
- SHA256 90a429cfb9fcb71a2a9b1137e569c6cf70e422e398a267f1eee8e941fc474997
- MD5 0400864504a63ce9ea6ccb99248bc6c7
- SHA1 8e1aac105f877af0729ca9afb722ed2226bdb15d
- SHA512 0bff81936017e7e6cb536a9f41907b99a46f293fa283d12e2d4ddf342fa3c2bddb093800adc9058ba24fb3b9760fee00dadbfd6c96274ca121077959a43a57d1
- SSDEEP 96:CpETMLgDoIUQikJcTxJ8iZRy7Dx+6MSmueBO3HpU5MgvSv5oMMF2MEVMup:CpETMkDofQFJcb8syh+Fs6+gvSveMMFs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 5KB
- SHA256 1a66cf4210e360e8e0d3d2fa905ae3792dcae7aab123f941740750512bdfa43e
- MD5 76a19393d4c35926f58d8da634ca5ab4
- SHA1 8677d31a8fbaef3735ecc9751ce3ab7fcb43200c
- SHA512 52a6d71d3a4416bd5430e12c8b97640d6c17bf17854b891cdf0b70b0323ef5f31b674640f6960bd263ff519f8bcbb02f727eb4edb7e69f95883b244890aaf0f3
- SSDEEP 96:CpETMLgDoIUQikJcTxJ8iZRy7Dx+6MSmueyBO3BU5MgvSv5oMMF2MEVMup:CpETMkDofQFJcb8syh+FCcC+gvSveMMi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 5KB
- SHA256 db6782cbcce45b6fdc55f2d93c96a2a8b4c5a104eda9da5f344943c754574704
- MD5 6bf077f8c0750438a7afcaac947cdf12
- SHA1 5fbe62b4c874bac8de301261c5167043ac693d7b
- SHA512 c7d65f59370e29793627954812b1046a146314bf8d95e9166ae3d45011c459bfb553e274c4569995506ee3d2c492d07af46c38cd164dcd55a89acf42bf07a5a0
- SSDEEP 96:CpETMLgDoIUQikJcTxJ8iZRy7Dx+6MSmue2O3HpU5MgvSv5oMMF2MEVMup:CpETMkDofQFJcb8syh+F36+gvSveMMFs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe57762a.TMP
- Size 2KB
- SHA256 88575950e262396bd009db3c75b18b3a1cd44b7b869b90f9b2c961ce9b74c1ad
- MD5 8e5632bb5baca5f24f88c9e2a8eb2b6d
- SHA1 71f7dee86640b602595b40c6a65d7ed4498cf00d
- SHA512 def476d83ba944f2fe83839108072677672a230218192751dd5e37305d42816e2db59b6f368fe8d3ca8848542ac3e3732dea3a58187c1e14f372ff2f721dffcc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 257KB
- SHA256 b9febba487da45f0492f22fd708b1d1a0a0e20f7655a0e72803cd9a94479c503
- MD5 0df402b9f19fdf37f4e73fd8c5eacf50
- SHA1 8c32b473d8913364c99f52200549e337d9430dec
- SHA512 23c7cb2fcd1d4fba99742429824e6a05c0df27ccef395a04b5b0bb7a500ea549eda263b2dfa098f16e921944e78cd7c252a8cd6e208fe79a289dbe32ae85d0e3
- SSDEEP 6144:unrI1Qo5yzkpeXjnJFzXsWQQYRPILxZnhLMJjX0EeGzY2rLu:MEjCkpeXtFb8Q5fnReEFsLLu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 257KB
- SHA256 3452d9edb646850caf96ce9b79d34637a868ad9a8ced80605b9bd2b74f6ce407
- MD5 3177b6f03b19a02c02b4f7ae3e050504
- SHA1 12b6efd78fba53c7d5a752d215ef89b3791255d7
- SHA512 77bde4ccc2326681be5db78d802bf6534033dadbaa3ca90a4cccb3a5775075c63f0274d4891c8a809af8ccde32cb050e70a857a18fbcabd2ef41299de98422bf
- SSDEEP 6144:uLrI1Qo5yzkpeXjnJFzXsW5QYRPILxZnhLMJjX0EeGzY2rLu:gEjCkpeXtFbFQ5fnReEFsLLu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57eb89.TMP
- Size 88KB
- SHA256 57ef364373cd9e5e5c758e1eedaa43e44d20b1a85e6170c240c06e4153227cbb
- MD5 f84ce220710fdbe9745d3416e8e464c7
- SHA1 928fc732c612be017f9c3cf630d2709a7cd2e342
- SHA512 7bf1165aba4a20ae0e55592446c90c11090e8ba1bcb273984bff267b303a70818da9e7befaa4b45f76885bf1672237a2539b7f943e0048f21f374029cfee5bed
- SSDEEP 384:AOZWxEQDSUqUShHbR3sHQK5pGCnBKEAhBcjkUy4NXjbbOoSFpOosWz7PXA6i4scO:wiQj7mjPuhovjSdKKZSFg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\eb9f2eb4-1cf5-471d-8caa-5c678763c2f7.tmp
- Size 91KB
- SHA256 c50da144dd477f59192f2e0b285ec5965ec515158add2dddb2f3ff57b4496abf
- MD5 c27f3678a0694d21a3c12071e6fa9405
- SHA1 de3407aa205543f13c00cc872ea0cde66c3ff2d7
- SHA512 0d7aed069b5e0eaa7d9b868d9fb1e174ae832d98905e9d20c33958727b719a0c1606620178b048a8f643577b18a76f61a58795cbf8514b7a3c981b0f465f3227
- SSDEEP 384:iOZWxEQDSUqUShHbR3sHQK5pGCnBKEAYsBcjkUy4NXjbbOoSFNvOosWz7PXA6i4E:WiQj7mNPuhovjSdKKZSF+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
- Size 7KB
- SHA256 50e1281974b55ce31495e9c319632cefd5d6fa7538be8a9425f1779dfa0efd1b
- MD5 c499dd8f0df225484f1a119756095112
- SHA1 6ff5e93748c540a1321a1541e42f94de10226826
- SHA512 cc2a7616e4791335b3cc7a7b4ab936ab8819faa8e84494d15b79c6a53f3d79c09f159f7ec18cb29f4e3ef5e7411fc542dc00b9896036b01f9995041b4e37d91f
- SSDEEP 96:vHUbPM3kIHS/0dwK3jK33m7P2cvmT45wK2pKK2D9fH/4z2AOBEyTD:93q/ni3zUTvOAy3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
- Size 8KB
- SHA256 ebc2aadbe975ade3a556b07b933b0787b7e51feaff84cce40efe92f73303c137
- MD5 fba548cb1b90c921b077d6df164f704e
- SHA1 8d8234cdabbae670dba2f9c0adf5f4e120c1a951
- SHA512 9fdaa6ab2711d8402ca060d0ad20dd679270dec675fc80126d75c82fb738580c23d5363bbdc4f1690264f1770fac784469a122ade219e2d167c85fe65e3639fd
- SSDEEP 96:vHUbPM3kIHS/0dwK3jK33m7P2cvmT45wK2pKK2D9fH/4z2AOBEyTqbJ8newK3FK/:93q/ni3zUTvOAyQ8Toc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\bf522891c8648821.bin
- Size 12KB
- SHA256 2929ca44d378ecfa31686941fe128c36761373ebb26086b959a6e02029feb46c
- MD5 ac8c8c7c7be7a1d4ca1bd0aadb69bd57
- SHA1 0137960aae22e9328adff5bf0a9edc3150cf1822
- SHA512 d35bcdd0a3393986d5f3b28106dc18e92f07e6a0101208cfe715408a2ff3fdb6dc823b7d0843f117a3bb301ead80f28080021ad53cf530f0f8503adeca056df6
- SSDEEP 384:EzCdTVqXEoLgCyVt4tWFv2UwWnIqPVRbBw/V09Q:VvqEocht4tc2UwWIm9w90Q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 e1bf0fa56c83154e1fae5d2940a6d42ad910eba9d79a0f5477605af5af6dcc3c
- MD5 efad8814cfaaf4d823bc92b96a6e925a
- SHA1 465faa5b04e8fb4812e46c8d1ac6d293df911839
- SHA512 1e03753e77f8d749bb44ee11e028f4ec1e6dec3836e22aafcb0a3a7c3343e83ace21a1bf48ac1c0ea323bf14bfcf6d90bdfee258e777bfe62e765f340ac1d386
- SSDEEP 12288:ZDeSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:ZDet/HU9zPjeidP1Yi/dGyA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 1d26450464814b6f7d55fe8fa97eef78a8504097c3b0d78f566cfa0fecb089fb
- MD5 799a7a12339634d1eb010a5bb1cd2818
- SHA1 ab324361a12faaca1d080a568ef2493bbf933e58
- SHA512 78b1aa2df941652de6f82ec7c60e3b3c18984ac79862d29485a347b14bc8f5496bcda4274e8c21509da36e1e3c15907fcbf0842684a26cf32dda8d73c2ee462e
- SSDEEP 49152:Qa0h2GEkuAe73q3pp46zwwQcUpLei7dGy:Qa0hNYG4JwzUtq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 659KB
- SHA256 3531023461a38ff975cd57d58d0a90c6f61b12122e348ded689564abebbe3dcf
- MD5 ddf54e7bf4ec061a700ee6e4e41e7a88
- SHA1 a063779c34563e3930173423ef736e493f7aefee
- SHA512 a181a712bc0765bb8f16debbfada83dec4a9e5554e3d0912df171b89d94695ed4730bb56646a2a346b65f645712b725b01d11d8362e0b185e16f1cbad33a6297
- SSDEEP 12288:rhbHjfX6eSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:rhbHjP6et/HU9zPjeidP1Yi/dGyA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 38951d32dccbbc5cefc58bb9df741020c5b739ff323dedc514a831748215a2b0
- MD5 63dd9a2373a3f84ccc503ec9b7a33893
- SHA1 0f41eaf34692a26d3b771bcaf9fad6e7ed526c66
- SHA512 a3d47e00380965b10f9232a9a2d27fb1cef31bfd60f8ead6ca01a6f39a87b2cd1935f18a0e5ee5f018e3cf1859a8bb57548f5e9d4019b148429fff27e1a26ab7
- SSDEEP 24576:J3YgnJcRTk4yti+R5dpR/iet/HU9zPjeidP1Yi/dGyA:JIgnaTk46ppR/vUpLei7dGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Locator.exe
- Size 578KB
- SHA256 57b2980a4c801858b6d6c4ff623e0cd620cbaada0b4e828b4d095210655c6815
- MD5 a847382f33bdf91ec153f17a1dd55963
- SHA1 0e9131ad885a876b01fd0a997935faccd7c5d700
- SHA512 1ccf1130722e6138eeb619ac3059f5a498ddc74ea4aaa6d12968c09beec1070c68bb7a982723701ecc235d473b1865bff6ebb1ca44805775651ce6c8cef94228
- SSDEEP 12288:CfeSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:Cfet/HU9zPjeidP1Yi/dGyA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 940KB
- SHA256 a4d13025595c1752924ef8ce81e541297733a3f3b111b9dd19cec9931902a7b2
- MD5 e9fdb635cee36a304d1ae957ef20c6f0
- SHA1 11f41d06502cf6919ef2f2a3ca9fbcc9e036edb8
- SHA512 324a4a0f7d87a5e2dbbbe32930d6d20a9b38e8755a6d1d1df89fff128fc395cef99774824099a80854d6cdc34440810692e046f04fcfe0657492553aa9eaf7e6
- SSDEEP 12288:1Ob9A4LWOsvAYFT4eSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:ypL3UT4et/HU9zPjeidP1Yi/dGyA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 671KB
- SHA256 303e6c753da0ab97f026189c4897865864eb727bdd577da631e1b7e34de2f272
- MD5 4609216a56ef4db31efa402118bfd9b8
- SHA1 9519e13f4fdc7d12ddaf1642f49f95a8aa00d43f
- SHA512 28d39429c885ae14848eae8c8dc44bb4abe6b7ecd59c1b99024de8e474d5ade5e5881479fd8f1ae18591f9891d0ebe87953a86a5f3d30f5a1b5756aac5c7389b
- SSDEEP 12288:ypFtpOEeSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:gOEet/HU9zPjeidP1Yi/dGyA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 db6cb74c00c2076dc67bdbc28787f436956fb1d6856e6c96683c3f133fd60fa0
- MD5 3016c7bd07eff82c0f5fd1101cdfcb61
- SHA1 26908ef5877a592cf8abd5335a3506e27c6a6521
- SHA512 f6a6f67d24ee46f8eda8ccba3086b839bcaa629134dfacfec195aa00e1bbc5883366e47fcb2a438e34cc8af36517095ebbadfac09ccb3776ee988caff8e1d3ca
- SSDEEP 24576:57NM9YmZqmWMUkPjZM48Mv6bEhszet/HU9zPjeidP1Yi/dGyA:57cBWMpPjN8DbEhHUpLei7dGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 27a884c3f3796c3e821a3d2fcfd705b6c27c6098bce57044982cb00955a23298
- MD5 4f286d55dd34bbe633c526ada6a30852
- SHA1 36f5d2d92ae5f052b8de04a041b54f4f7ae50d43
- SHA512 24df31cc575943d7f682912205c9cba44d3060b2f802e3814ffddaaeee215b934d1250e29c0ae6a69720032538827156f6deb120d306a808306ca0749dd4b6fd
- SSDEEP 24576:nW6BApg2YuyuNDYTabvcRvNYf8km1let/HU9zPjeidP1Yi/dGyA:nF2YuHNETovcvNYf8kmaUpLei7dGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 050be8753bedb4a669446f82efcb09aff05cebdf5d3d3e59566e1a816dcd7eca
- MD5 00c94fae7cf81b675f8313812363c205
- SHA1 90083f6c9880f3a7d11ef2a979bfdd335493a68f
- SHA512 830aa50600a3767c2e675e07e8744e779ba82c2e3a5841b03a79f748aaa26a2a22aa6847e08d8121a797ca4a4007c20770966f5010540b6ccf99973dd25ba7a4
- SSDEEP 24576:oAFs06+Omlf3NXEbTowet/HU9zPjeidP1Yi/dGyA:tFs060lVXu8UpLei7dGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\TieringEngineService.exe
- Size 885KB
- SHA256 b2cd8d729869393443a90158eba9e8f10cbc3b35340b73c220bf0b18b0ad494e
- MD5 d5f73075ae70215f7904a3787efda0e7
- SHA1 fdbaccaadadfe3272e99921c56b7a05b474ef8a0
- SHA512 fae29f0ccb785baeaef7e50a4c4c983f5fba6fb8c5ad1bc7d9fa56f006bfadd34e2cff4d278839812ae5714529d5b17d132f43f1fda10756a7f712b24054084e
- SSDEEP 12288:iCJnJ5D3VkrlzxTeSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:jJnJ5D3WtBet/HU9zPjeidP1Yi/dGyA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 bfd56af9061a1de331cadb82ea9bbee222b927b225f97965cdbbe651244f53cb
- MD5 ae686c5e0090917528035b2f37d83b0e
- SHA1 532186031bddc84ccb2efd3a7f11793b1cef1fa0
- SHA512 920d50688f9d481cc0f2304719321014840b5b757fb8ed573347b15eb2f4e1bd87f4d3a613b62823699eef3aa7056e7b2dd549810d5a7466775ef67fe45b9e7d
- SSDEEP 24576:eEPohm6/7IIXdwcXrif7qQncjlP65i3Vuiet/HU9zPjeidP1Yi/dGyA:5o06DIKdwc+eQnSt65aVmUpLei7dGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\alg.exe
- Size 661KB
- SHA256 06e16e5dd53dee1aad4a9d978951cb5f06bd7b437b7f44340aea92afabb6aa27
- MD5 c6c3b81fa6e166d72fc95f433ef03251
- SHA1 44b7b221eceb92cc2a0f5e09bda498f2c3f1eab2
- SHA512 cf81dd4c92791794b8b78a3ea3bb7d9f3e6bf551cdce64cb56a3089f191da4bf2ada9fff2b28b7d9dcc11c27f5f8054cf1d3c295f28e14cf9586c528219c2425
- SSDEEP 12288:REP3Rr+eSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:Cr+et/HU9zPjeidP1Yi/dGyA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\msdtc.exe
- Size 712KB
- SHA256 497c626b371dc2fa8ea0aad26d94e7fec069f3f05544a25630d0a57718390887
- MD5 c55530abbcd7293063531bbb44e972bb
- SHA1 6cd94f81f611371c33ece9b25987f27ea2ead622
- SHA512 484265ae4a336ba1da87252b7f1a3fde6150d50d2338f0541a05dc1aa69128dbf4d7ac8ed9e3fe1e68421de72c7c2b4b6dc8a5a059ea38f2b7be5b9d50a9dd36
- SSDEEP 12288:NjkyKeSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:NIyKet/HU9zPjeidP1Yi/dGyA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\snmptrap.exe
- Size 584KB
- SHA256 7c808b53851b543a03c4787c19c799d505600ef3f5d4e2ce6353a1475a7a6990
- MD5 b04e0dd934405d4afa17cef85ed52383
- SHA1 ff727e898608a4f773646e9435065c82536ddd67
- SHA512 5090b999a49fd6caaf34c47ef1156f5f96b05c341a89214d96b2046089c51fd032e06331bb693f031bf645018a721ac9a7a2ced807b910dcd9d3044bb551ae70
- SSDEEP 12288:MFUeSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:aUet/HU9zPjeidP1Yi/dGyA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 1ce188ecef3eee33f7f600448d7039b708117153c45e8eeba8fb7dc888c200ee
- MD5 176180bd67798689740f86ddf07c3c1a
- SHA1 b343de7265b4a3dee1d26d1a636b9dd81fb70d77
- SHA512 896bd98b4b1a1e72d18fbcffd039fc9f2cbd7a140a581db25adba8f9676f0b6716ba0b61e3ebb3d5c73272a92fb87ef4e7755b5eb130c9c5501ec0624432da9a
- SSDEEP 24576:SQ9MxZKdcz97w3ret/HU9zPjeidP1Yi/dGyA:SVKXSUpLei7dGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 772KB
- SHA256 9d007e9d2e0701fe7bf3b2f7b37494d7264d4128c1036cd51d6fa03070f4586f
- MD5 e0cbc241ebcea1ae244908f559b1a161
- SHA1 f22775f44a59a2b815dd7e4467255d71b057f7dc
- SHA512 cecc0556f4aff83d36fb53d15bb492c110b29883871f90ca736b113b25e1859a3986ad271268e1fb9944e0916dd64d1a03d00d71265660491ee9590a4c76d1a7
- SSDEEP 12288:ZyoKo2HRple9p2eSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:ZyocxAp2et/HU9zPjeidP1Yi/dGyA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 a5dc92a9388ab2bc9720bbb395ff410e33b4d2edffb2f9c64f568cf437b297fa
- MD5 88c90ec4c4846584874c6ec0bb3129eb
- SHA1 04fdd04b0f3e5ad3df3dbd6b380075ca8b8da862
- SHA512 2a50e9795a1f0b31441c7935a97a1bf20e04ec4e20dcd1f82792e70d0b07150e23ade6f0a5e7f40b77c85b03ed9699ec30fdfd9ffcc2eaad6562facba48f3ba1
- SSDEEP 49152:gWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKrUpLei7dGy:S0zuNI/Utq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\Crashpad\settings.dat
- Size 40B
- SHA256 5928caa89b1d2b710b06e2032deeeb129c5844abc95bb506a96a2181663fdb20
- MD5 63c24fafa38c1b0109d7b33c1be0d22e
- SHA1 9b3ae6d17378fa094069f9aef62df034089e3083
- SHA512 1387ef7a3e1e729ec2d22463f44463c5645c772a8336127bbbc7532923abb04b62bbfadf10c12c2f6b50d1ffb567ae4059efe192f3fc0ffdd90ff0cafaacb6b0
- MD5 SHA1 SHA512
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 0f4eb5b40ac839e97cb490924cad8680f379f9b9f38e2a7b6bf1af11858aeabd
- MD5 65be141e18c2c10226475cad0adfbcca
- SHA1 6d5444779347fa8aeb7c842bb4f063e3d7fe7d11
- SHA512 5edb385d645eaa4f69adc8f0f78d818935bfc8acd4bfd1aea4e3012ea1518f1ea716bac2c5d00ca4b7f5883d4c657b2dc380c19472bd34958a103042754c611d
- SSDEEP 24576:b1QT7EcpfxR+N5AWAz3ooiYtjMqbdet/HU9zPjeidP1Yi/dGyA:mTDxR+N5YzTfjMNUpLei7dGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system32\SgrmBroker.exe
- Size 877KB
- SHA256 91d0a2b3170ba70c2a9e0a6b79ca2b78171ccea45faef745abc58088f9c5358c
- MD5 ca49af33903750b50dea59b8d3fcf88e
- SHA1 b0167da2054b3ac0707e7c314e0448fb81524c8c
- SHA512 5e7c4aa4d98eb65d768807582e785084bfbb7938f1a078f02303ee40b88c782a105fd94a5a1634c5c4af3c60cdb234434e331fb3ec34da7a200ab4b3ca9a8da0
- SSDEEP 24576:DTMdOz0FFS+imSLZet/HU9zPjeidP1Yi/dGyA:h0K+imSL0UpLei7dGy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system32\msiexec.exe
- Size 635KB
- SHA256 18e2baa31df4682705829eabf716e1ee581988adf5ee1459d8a6a60fb4d36fd3
- MD5 2c5cc7e8f7e43bf6cd7e8b6cddd6b554
- SHA1 a1dbce550ad93b1a6162f50949d48788e697308e
- SHA512 43f79d600c89d5a83fcdf92e3c5e29683fc7a41017d33e73bbba066cc5df849b9dc8e7256d446283725cd956abe490f6cd90748abbb482e2f045631ba6d01c63
- SSDEEP 12288:7474eSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:O4et/HU9zPjeidP1Yi/dGyA
- MD5 SHA1 SHA512 SSDEEP