Analysis
- max time kernel
150s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240704-en - resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system - submitted
05/07/2024, 01:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
06e492a0edf22bf06928a08ae85b0ea8.exe
Resource
win7-20240419-en
windows7-x64
0 signatures
150 seconds
General
- Target 06e492a0edf22bf06928a08ae85b0ea8.exe
- Size 5.5MB
- Sample240705-bc434sycjk
- SHA256 b5e29982e1a78d87a0a28d4818550dd65d41d5bf40cd4ab446e23a380d7bcbb1
- MD5 06e492a0edf22bf06928a08ae85b0ea8
- SHA1 ffecd8c679362b67d5bed67a8be94596d8f0725b
- SHA512 59d126bc71b76e91956aa033b8113d29648e908bd8ff7e561aa295df64c637fc18c2fa6172c486b09c5064a31ace98ce121cf1867f41562f1b3ebb167eaf9458
- SSDEEP 49152:DEFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1bn9tJEUxDG0BYYrLA50IHLGfL:fAI5pAdV9n9tbnR1VgBVmzCCMlwLv
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 2072 alg.exe 4672 DiagnosticsHub.StandardCollector.Service.exe 2980 fxssvc.exe 2548 elevation_service.exe 1584 elevation_service.exe 4384 maintenanceservice.exe 880 msdtc.exe 1508 OSE.EXE 416 PerceptionSimulationService.exe 3136 perfhost.exe 4484 locator.exe 2244 SensorDataService.exe 3348 snmptrap.exe 4128 spectrum.exe 3160 ssh-agent.exe 2136 TieringEngineService.exe 4528 AgentService.exe 5100 vds.exe 716 vssvc.exe 3588 wbengine.exe 5176 WmiApSrv.exe 5284 SearchIndexer.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\system32\spectrum.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Windows\system32\wbengine.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Windows\System32\snmptrap.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Windows\system32\AgentService.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Windows\System32\vds.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Windows\System32\alg.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Windows\system32\AppVClient.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Windows\System32\SensorDataService.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Windows\system32\msiexec.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Windows\system32\locator.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\ab0e7b1289a4da0b.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\msdtc.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Windows\system32\vssvc.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101453\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101453\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 06e492a0edf22bf06928a08ae85b0ea8.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 06e492a0edf22bf06928a08ae85b0ea8.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000251ba2ee76ceda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000781c15f376ceda01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af4c08f476ceda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003672f7ee76ceda01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da4684f476ceda01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c26a89f276ceda01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000769304f376ceda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a3f089f376ceda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000252c85f376ceda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a9714df476ceda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ chrmstp.exe - Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 2528 chrome.exe 2528 chrome.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 4092 06e492a0edf22bf06928a08ae85b0ea8.exe 1432 chrome.exe 1432 chrome.exe 4672 DiagnosticsHub.StandardCollector.Service.exe 4672 DiagnosticsHub.StandardCollector.Service.exe 4672 DiagnosticsHub.StandardCollector.Service.exe 4672 DiagnosticsHub.StandardCollector.Service.exe 4672 DiagnosticsHub.StandardCollector.Service.exe 4672 DiagnosticsHub.StandardCollector.Service.exe 4672 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4180 06e492a0edf22bf06928a08ae85b0ea8.exe Token: SeAuditPrivilege 2980 fxssvc.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeRestorePrivilege 2136 TieringEngineService.exe Token: SeManageVolumePrivilege 2136 TieringEngineService.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeAssignPrimaryTokenPrivilege 4528 AgentService.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeBackupPrivilege 716 vssvc.exe Token: SeRestorePrivilege 716 vssvc.exe Token: SeAuditPrivilege 716 vssvc.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeBackupPrivilege 3588 wbengine.exe Token: SeRestorePrivilege 3588 wbengine.exe Token: SeSecurityPrivilege 3588 wbengine.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: 33 5284 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 5284 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5284 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5284 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5284 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5284 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5284 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5284 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5284 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5284 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5284 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5284 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5284 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5284 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5284 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5284 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5284 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5284 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5284 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5284 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5284 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5284 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5284 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5284 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5284 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5284 SearchIndexer.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe Token: SeCreatePagefilePrivilege 2528 chrome.exe Token: SeShutdownPrivilege 2528 chrome.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2528 chrome.exe 2528 chrome.exe 2528 chrome.exe 5292 chrmstp.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4180 wrote to memory of 4092 4180 06e492a0edf22bf06928a08ae85b0ea8.exe 82 PID 4180 wrote to memory of 4092 4180 06e492a0edf22bf06928a08ae85b0ea8.exe 82 PID 4180 wrote to memory of 2528 4180 06e492a0edf22bf06928a08ae85b0ea8.exe 83 PID 4180 wrote to memory of 2528 4180 06e492a0edf22bf06928a08ae85b0ea8.exe 83 PID 2528 wrote to memory of 3652 2528 chrome.exe 84 PID 2528 wrote to memory of 3652 2528 chrome.exe 84 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 1960 2528 chrome.exe 98 PID 2528 wrote to memory of 4440 2528 chrome.exe 99 PID 2528 wrote to memory of 4440 2528 chrome.exe 99 PID 2528 wrote to memory of 4644 2528 chrome.exe 100 PID 2528 wrote to memory of 4644 2528 chrome.exe 100 PID 2528 wrote to memory of 4644 2528 chrome.exe 100 PID 2528 wrote to memory of 4644 2528 chrome.exe 100 PID 2528 wrote to memory of 4644 2528 chrome.exe 100 PID 2528 wrote to memory of 4644 2528 chrome.exe 100 PID 2528 wrote to memory of 4644 2528 chrome.exe 100 PID 2528 wrote to memory of 4644 2528 chrome.exe 100 PID 2528 wrote to memory of 4644 2528 chrome.exe 100 PID 2528 wrote to memory of 4644 2528 chrome.exe 100 PID 2528 wrote to memory of 4644 2528 chrome.exe 100 PID 2528 wrote to memory of 4644 2528 chrome.exe 100 PID 2528 wrote to memory of 4644 2528 chrome.exe 100 PID 2528 wrote to memory of 4644 2528 chrome.exe 100 PID 2528 wrote to memory of 4644 2528 chrome.exe 100 PID 2528 wrote to memory of 4644 2528 chrome.exe 100 PID 2528 wrote to memory of 4644 2528 chrome.exe 100 PID 2528 wrote to memory of 4644 2528 chrome.exe 100 PID 2528 wrote to memory of 4644 2528 chrome.exe 100 PID 2528 wrote to memory of 4644 2528 chrome.exe 100 PID 2528 wrote to memory of 4644 2528 chrome.exe 100 PID 2528 wrote to memory of 4644 2528 chrome.exe 100 PID 2528 wrote to memory of 4644 2528 chrome.exe 100 PID 2528 wrote to memory of 4644 2528 chrome.exe 100 PID 2528 wrote to memory of 4644 2528 chrome.exe 100 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\06e492a0edf22bf06928a08ae85b0ea8.exe"C:\Users\Admin\AppData\Local\Temp\06e492a0edf22bf06928a08ae85b0ea8.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\06e492a0edf22bf06928a08ae85b0ea8.exeC:\Users\Admin\AppData\Local\Temp\06e492a0edf22bf06928a08ae85b0ea8.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x2f8,0x140462458,0x140462468,0x1404624782⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f1eeab58,0x7ff9f1eeab68,0x7ff9f1eeab783⤵PID:3652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 --field-trial-handle=1916,i,8786887825679684614,280504335819529751,131072 /prefetch:23⤵PID:1960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1916,i,8786887825679684614,280504335819529751,131072 /prefetch:83⤵PID:4440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2216 --field-trial-handle=1916,i,8786887825679684614,280504335819529751,131072 /prefetch:83⤵PID:4644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3020 --field-trial-handle=1916,i,8786887825679684614,280504335819529751,131072 /prefetch:13⤵PID:2848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3144 --field-trial-handle=1916,i,8786887825679684614,280504335819529751,131072 /prefetch:13⤵PID:4584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3576 --field-trial-handle=1916,i,8786887825679684614,280504335819529751,131072 /prefetch:13⤵PID:4408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3972 --field-trial-handle=1916,i,8786887825679684614,280504335819529751,131072 /prefetch:83⤵PID:1324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4712 --field-trial-handle=1916,i,8786887825679684614,280504335819529751,131072 /prefetch:83⤵PID:1100
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings3⤵PID:1396
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff63f01ae48,0x7ff63f01ae58,0x7ff63f01ae684⤵PID:5168
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=04⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:5292 -
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff63f01ae48,0x7ff63f01ae58,0x7ff63f01ae685⤵PID:5352
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3972 --field-trial-handle=1916,i,8786887825679684614,280504335819529751,131072 /prefetch:83⤵PID:5684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4148 --field-trial-handle=1916,i,8786887825679684614,280504335819529751,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1432
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:2072
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4672
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1880
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2980
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2548
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1584
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4384
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:880
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1508
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:416
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:3136
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:4484
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2244
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3348
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4128
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3160
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:4216
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2136
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4528
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:5100
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:716
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3588
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:5176
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5284 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:6012
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:6052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
- Size 2.1MB
- SHA256 cc611e549f0a2c6207ea2debc046b9204435869f6ff04ea0ef34dc27369f4731
- MD5 873258bafe961ab01291d441b90ef395
- SHA1 18ac4906b2b11b683d17e32f2613946350de9d23
- SHA512 4ede9fe29de3cfa046afdde9631fb24fd96962b2196c5e509a5d37a82f22a411bedd1131ca1a63b16674bc0a3bca37645a5a4a7e93116fa9074622a605bcc706
- SSDEEP 49152:8uYk3H5koUzfTqkkYLO/W2buywzMbOX+T7z51CCAcKV/NmLvTd:87fTqi90bJCCMlwLv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 797KB
- SHA256 6099338a6dd3cddaada71b43df72453f56aa2b44190cb1d98984721ec10f3f8a
- MD5 28b146cd1a478a14e87b620658ab996e
- SHA1 d6ebd62674c609100d92f2b0e89f6ac29b6d44a0
- SHA512 09e3976585b7272db1fdb6fdaa4b3be2433b2da3d25ab8417b36109f9ecbd687f5bf3cdb461adc10d61c5024bf7a22cd6680270257795218823a540e62f7b59a
- SSDEEP 24576:BiPnBsuEowH/BYcCAwQEKesf/NmLeiTd:+SufCCAcKV/NmLvTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 d98346d1c17d7517a1a3216b95d62fedc037b1d2ef260e33de265269b78e1bb0
- MD5 900d246c36d0534e7da1e27dbb02aeb3
- SHA1 122816af6b14b59e3cbb433ae9cc7264b2e39124
- SHA512 1acf418756abff89a3c4c56d14d4a2f1ce1973a5571422c6781df8394c475a923159339a1c1adc551534b825ad53d9fa5b70e7b1a72abc0effeaedb56178997a
- SSDEEP 24576:6+gkEHfh4Co0wH/BYcCAwQEKesf/NmLeiTd:fgkE/SmCCAcKV/NmLvTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 96d83c34dc326cca9fa449234b6c210d11ff57a2611b4a5d5a07969d9b264770
- MD5 b4b4510499ad49ec728b30bada0fd0aa
- SHA1 05b2f49fbe68457c0a7d5fa6614130937bdb7b14
- SHA512 7194cf78dab9fa072eb42cb25c78b469fdc67fe93c03e138a7b188eccfc17e8e6027a60873c7cee259a9015d0553fdbcaf59ade9d2cb3207bcb4b9b97d8303dd
- SSDEEP 24576:ABpDRmi78gkPXlyo0GtjrRwH/BYcCAwQEKesf/NmLeiTd:ENRmi78gkPX4o0GtjVCCAcKV/NmLvTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 ad75c02afe5907691022b5424a719ff7a0697cddbde013eed76ccb1c731c06ac
- MD5 012150bb793e10b18c592795754e8b24
- SHA1 684bfb57aabc19805510a627eb196546d24a6cfb
- SHA512 3d7a8e892d69f1755bab2a3a98d1dc74202998778350ce75cf50a877f6fe19f58170559b0f625403d0e83e0a63905f200e29fd2c47245d610c4c2031cbe82bd1
- SSDEEP 24576:XLOS2oTPIXV0wH/BYcCAwQEKesf/NmLeiTd:B/TtCCAcKV/NmLvTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 f4a0a6cf62f3c9c0d85be5dabae14a37547af8442b06301224ac5fc2e54aa670
- MD5 8a317b37adedd61ec96e89b5da2cc32f
- SHA1 66d7dbbaea7483b02e31a2600a629916dae5b357
- SHA512 5e1dde3d9e0320f555426bc06986ada65840c98cf98da1df0191d7a423c58b16ddc552eefae5a4add443778ef92a516d8db22e0278afeb4883dc9192ac939eb3
- SSDEEP 12288:9tsU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:9tGwH/BYcCAwQEKesf/NmLeiTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 287164c37376cccebe8d76d9d01147f5b27d8109df26aeeb0b2aab295d9d8b2b
- MD5 eb6aeb5954b2d375d651f6ce8dde433b
- SHA1 fbc94362d89fe529b5051356fe77fe2c97670eec
- SHA512 ab4583a0d7ed93088ebff2eb378328f982152f1fdfc0e2e3606679414ad54eb1615bdc5c201d162c4eed3ea2f7c038308fa6439e5760691e7dbec0b8fa754cd2
- SSDEEP 12288:7eBNUbTVO86UZU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:7JIUTwH/BYcCAwQEKesf/NmLeiTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 000389501eb1d2c9b421038c578000ef3d9b8a9fbec79c789a65294b7ff3ce6f
- MD5 28369567082388a5d03c5252ef7cad0b
- SHA1 00f0fe29991b70fb413cbc7403c4a1f2c7754a86
- SHA512 14fd89d748be72c36d89c73525feb2892d925560aade191e428d0c2ca48f19457ca8a8be42b9c8432c0ee8a80e54f10b957d5c7da74ea6a2843a740587e25096
- SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THx:GQvGAdlCEL8c/DRNw5CgCCMlwLv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 01ae4cb7c9b487d5c129e43706d20ad21094f16b4892e7f40243e6d4a6d1f1e8
- MD5 9d8e269ee4d314f18c3da87ddd17da3a
- SHA1 7b38724407e7961f924be73d3c28ba307f85600c
- SHA512 859ef554dad3c4f4c5078acd423dfee7ca31e598237ea323e528013346809aeb7fedbc11d275f18ebb6b8c2c05789e537a9796f10b15ef52d272c9a318ec290d
- SSDEEP 12288:6AwSfxL/2Dc3RDLLmt0LDQewsAjvU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kR:P0ewsAjJwH/BYcCAwQEKesf/NmLeiTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 186684ebeb708ea93bdac49b0d716842896410b328810038fe37bc20e7b9fc19
- MD5 e792ef3dcea7245a4b342c0c1d74005a
- SHA1 b896079984a9a63164ad0260146357c2bfe1f975
- SHA512 029fa177c9d6964ea2d2c20177fe1228ecf3c39eb631bfd20ac58008bd83564b3fdf83b25e938470ee692f0c84a4b4c507ff65e8b7091e18b7b3b2766a58f264
- SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHh6:BUEtQevvqc2W1cpV2tI32h
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 6376aa31340fea94af675278e4b2306bded2058b1548dabe9ee6fccd01f69028
- MD5 0dd7612189b487aeb896b83f3a141af7
- SHA1 f38272c661c96d4a812257bfac8b44431ae8c5e3
- SHA512 f12be08bf0be39d5d933d554614fe62522f33484b03214bc817b2fd86477b23f743cea8660597f4fb7fb25ec41d87201ec6a41054c10466ed645bff4f3c22140
- SSDEEP 49152:gCbRquA/m2yL5zQfFiV+XenmE3/zpCCAcKV/NmLvTd:poqtVjnmkCCMlwLv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 822972d797ad67555b3940d51ed3fc476aab2173fdeba2f80d204bb2c4e428d1
- MD5 cebe0f173376e92750aa84ea11bc356b
- SHA1 07116b5a2ed03809564038b0e4c77dccf0b87573
- SHA512 955cff014575bae72e50387f474f95daf9f8c429c434c0adb177764756a755d187c0d4ad6cf78aff79b99918ba8be34da3605f58f8cb89f7ae3fc42ed4336602
- SSDEEP 24576:DAhGL3IFoiwtA5l7S53EwH/BYcCAwQEKesf/NmLeiTd:DAMUFoiq5UCCAcKV/NmLvTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 adb5d3fe5316ab9f352636f45ac7143337f8d46576971807b7e5c5ddbac7612f
- MD5 de680d4dee98caccccab46448bb82c7a
- SHA1 52a299d221c42b8e99e76106727594adf7742490
- SHA512 fbc291775e17904fbcaf7101d908975158e967c07647eeb27641b2e711528e38dc2b0fe0a9e0fc8c1718158ca8a6c41a9589cf2f5644dc4c2bc5c0722c35bc96
- SSDEEP 12288:Dmw5HEjsChNVBFgl0WDm+CuU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6e2:Cwu4OWtwH/BYcCAwQEKesf/NmLeiTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 c383e1a8a4a121bda3237687ae407c37a30ddad7916dececadb0f6a7c53f17fa
- MD5 e0914d360444851ea1133ad248ce3c97
- SHA1 c91e1fe21bbe296ce8004c2ae5d5b232ca1ae24e
- SHA512 16f03921b5c0c8d59b470bf601fc9792b8df83e9f2d6af0cf8ba2c9d0cc3948d1005abd09b2a4586aecb9b64fc89000cfe1d68b36f0197ce7ef4b6c7b3139db6
- SSDEEP 12288:veZ1IyfU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:2ZuywH/BYcCAwQEKesf/NmLeiTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
- Size 5.4MB
- SHA256 a2853c2a4d1c802d0c20b12309871ab78cc9341249f075c114bf8ced4f5f2a73
- MD5 73ce7dd00cfd98085a529bf24ef2f796
- SHA1 c21ccebbb150b5084714ec00ec976c28c93ad04e
- SHA512 7427b86f8f093812f936c78d25136716eb2b57a74bc5a48636f220f2c5bf6aae15dc8e8852a688a95e65440002c45d434dd71b44d51b002337e226fbb48bead6
- SSDEEP 49152:t0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjy7yY7BHi3u7L/gBUUWLh:VwfhY7g/rLO7yYA3awr341gMCCMlwLv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
- Size 2.0MB
- SHA256 eaf6096399ab0cdef3159acbfc10bf2d13a9611a263b2fc0072867459dddb334
- MD5 fbb7dc4f72084edc29b365ddf5976dc7
- SHA1 d3fc6c3abcabea774e9b341f4e939ce89d5cb0f8
- SHA512 a086e2c2c46e6dfc63dab873392ac489868136c7dcda226522d3a29f38bee258a4484ece7af086c3c5a8299304bb2b376ac2a24f78766be101a8140d411866ca
- SSDEEP 24576:PcTyYv0FteQUd5I2kjgD6iQacAtwH/BYcCAwQEKesf/NmLeiTd:PuXv0FtpU5606zOtCCAcKV/NmLvTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
- Size 2.2MB
- SHA256 84c2fce74d0a47d1c18bdd177fc5ef88abfaec3b4317099a1008dd9d2238d7b5
- MD5 6d7081d9b2240a2f6a69beef64a4aba3
- SHA1 a16cd74326945909f17e40924d629d4352f1861d
- SHA512 48341f684d97737fa5f03f78f9d15651c0c0fb6da0af73a8f1a97c051a54e29e29e5a4798bfe5a5dff6201cf98e7b19599d7dc2a680d17e224e02aa6bcb08a8f
- SSDEEP 49152:by7mTd0GxN8jyyncHjXKUyn4GVcbDSKrNTxJCCAcKV/NmLvTd:GmYeycHjWjMTJCCMlwLv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
- Size 1.8MB
- SHA256 85d015b0a7344824567ff1f21a3d739df555cc2028737659f55857c6d74efecd
- MD5 c111cdd69c0761e399301fef5735b34b
- SHA1 9173ed40c5f64c673e97ff0c1b1bec2d224d3007
- SHA512 50de9366be4ca69d0f085df5179d3c0977249fa9250fc964aa91e94fe5d48e1af7de892345091c64366bf86384ecbb578a0fd9c939196912d7cccdeb543a4336
- SSDEEP 24576:E6drZn1WEci182IEUZNbJeRgUebgW816qwH/BYcCAwQEKesf/NmLeiTd:EWnDci18NNNUgbY1CCAcKV/NmLvTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 1.7MB
- SHA256 10092942f6219701c2e300075726aad6bae91d0dedc932a590bf15884724a65a
- MD5 672cbbe6a06de3eea7ba943eb97a9a7a
- SHA1 3d821cafdeb8fda5f0d7ae7b6dc4f6cf619ea4ca
- SHA512 6f0f83679b08440d8b9f6b58a1f84ad579a2d842f76215cf539a365d3e23591aa84fa3393dafd33acbdf7c2ebbf9d22f05d865bbdc676368f447f289ef123bea
- SSDEEP 24576:Qk5lHW5EzMZupOG0G2reD+melRgTTv/1nyfwH/BYcCAwQEKesf/NmLeiTd:mizMZw0GhamSoyCCAcKV/NmLvTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 9b3d0638437ac02592a402aca6684adf293812b86d15df5f5889a76ed6b59ff4
- MD5 d6103bb718b5a5c46fa9726bf2ea89b2
- SHA1 a9f085e11ea11c60b7c17527408de64c80ebb4fa
- SHA512 d9a25157835146abddf025cf5619a0a01b4790cd7394c5c26651726110a4ae6460d12a1f633c44df875b6d675e0f1286de6c52640baccc54c2e31849f25a3abf
- SSDEEP 12288:FUU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:FOwH/BYcCAwQEKesf/NmLeiTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 1b51755f175d1dfefd886692c8287a360d0c7ed15c11e259e17dbf5c0c23e664
- MD5 a2bbbf870426be80097a580f9bc85a52
- SHA1 8680d3ca4e8fc76a5295f63a7087202d0d3d8b3b
- SHA512 21197f651a7541f47c1a966387b05ec909acf4f33889b95f4edef9b2b37beb76f01f8690cc85e8607707569c278c125b72af371bf045bd0422ab0699ed7b51ed
- SSDEEP 12288:wjU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:wlwH/BYcCAwQEKesf/NmLeiTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 6b60870399931e93164552b60d2153ef4a032d9b7ca627f48914bcd943a3c849
- MD5 94b54acf7ec5a4a255df00da1fc10631
- SHA1 8f598e4e3f0297059f8c8c12cc9f735ed2d46236
- SHA512 a3a633ba07e3c16a21ca55d4b5d3433eef35eba354991bc876f6677406770e6e1c8c5ca5f5f957823f9ffbe459e767a9e4afa51373839cd2e6798fe6b8e5e837
- SSDEEP 12288:OhU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:ObwH/BYcCAwQEKesf/NmLeiTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 7e8d4980c86726df3f7a96a4ccf6d2e2db5e7c833f398fcfbcbcf8ac2ff15280
- MD5 b3029f88aa6eb6a3f2e10f5c586e2587
- SHA1 13fedf3c17cb2b565bd8375aab246c0e5f9513f5
- SHA512 93ee465f5d0b6508325e50ad4af92e4b0d0315faea4a7f77130a6be3fb681c6510057e4c32ce12e36f6f654a5a344881c0b61c714c8925da49f51fa47bd651b4
- SSDEEP 24576:PcP4mcvIjkGOxhKP2l71nNKbrh/8KB6wH/BYcCAwQEKesf/NmLeiTd:EP4m4IpOO67W8KgCCAcKV/NmLvTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\dotnet\dotnet.exe
- Size 701KB
- SHA256 5f0290cfc71ab4666ba15c780629bbe48a83a27687d39616940f52dce4beb58c
- MD5 ab580713196573981175caba54e920ea
- SHA1 9523c5e102ecc78af8b22192d7ed3f96450acaa9
- SHA512 958cdf5f1531da407b44003aefb9119b54f58cd7541e496b4acfaf69cc3c5fa1990c6d002ef4d203cfdecaaaf09f1dfa4c3c1873e554aee6ab385f3705e00505
- SSDEEP 12288:rUFmDDLVU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:jHwH/BYcCAwQEKesf/NmLeiTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
- Size 40B
- SHA256 57ab71614cbe849ba6df25332a0e85262fcf40a6b075c5e7d256bae2d4639070
- MD5 7c99581d8acee1d88a8dd2e91b1a5b7c
- SHA1 8bb37684452d34a43f19ede921853ac97bc0a08e
- SHA512 b49bed2f793292c297d5bb93bda612101350ee23747562be29e4084a76d4432fc5ce65a921d934e86b33ae956e0b99395eeb31163bf510ebedab3e2768e99590
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
- Size 193KB
- SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
- MD5 ef36a84ad2bc23f79d171c604b56de29
- SHA1 38d6569cd30d096140e752db5d98d53cf304a8fc
- SHA512 dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be
- SSDEEP 3072:HXm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4g2rJBXCy9enoN:HXUMCm4U6q62MEBi99g6JVCvoZhhl+No
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 7a9b543c1ed1a0f339efb296344d3eb4a59b9955ccb5926cdb21fc281322726d
- MD5 b1f3e13a4793225227233c87172a91d8
- SHA1 2982fbc2cc805c61e247897506dad287fd4e9e9c
- SHA512 40a7d151e6e35ba174a7b936b0536794fc502e47d4102e258e833c8cc8827c79a16f966712dc23cbf42d25b47024a009ad86c1edd100ce1eb363534f78ad2c3c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 356B
- SHA256 9ae15892d28dbe4c4191b42b8335593ab97700cbb0e2589ac2f9cc116b47697b
- MD5 c3eaa27b7ad3d99b7b95ef46ba9b0c75
- SHA1 1d527a9b1ec2c427383fc5eecd71b5266fb9579a
- SHA512 6cfe269e4ca005943dbf5ec9efc6555d709398569ae58c2bb30bfb9d32226cdbbd239a56a74c1f227f189a4efe7b34c214f7cc7d8b58dee96abd6551f0549013
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 5KB
- SHA256 baf336ea13e42dadd165c8466563b04855626d4810cdf6c58e1d5e5139bc69b9
- MD5 196182a40b76b0ed32f180cac7a473a8
- SHA1 42f668e83e2fa4a126b4c95a9901e2063df83a48
- SHA512 f1abea9e839a2609d513f4c5b48d6cb847c4d687b6bd6654ff7535805ca105c4a2679c0614dcc8f3757ac67b51af66293fe3d4246994980c2e97a1ae89e5a07d
- SSDEEP 96:Nvgz+7X5rTwEkJj/W8iZRy7Dx+6MSmueGOZ2MEVMup:N4C7hTwJTW8syh+FpPU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 4KB
- SHA256 cdcc8a1d2576c50e0fb786a9033de09d7cd6091dd17d299936134ee318d3385c
- MD5 0bd9806236b3dcd11f93656b7c1c5151
- SHA1 d7d0e086efbc7be3d26569428d239eee126e9e6a
- SHA512 f45ce6d608fc0471fe941c4ef6e7c3e01a1226a6d50449adb743c1721a8b59b895bba3c335b97569091c95d91da9333799105eb824f3a28826634847ac4896b9
- SSDEEP 96:Nvgz+7X5rTwEkJj/Id8iZRy7Dx+6MSmuedBOZ2MEVMup:N4C7hTwJTe8syh+FtmPU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe582045.TMP
- Size 2KB
- SHA256 1a630e764f94a9d7033bdfe8f38f324d66da0a6cd14a8d5e3d55a91db3ecec79
- MD5 be8e90f3f58f7f5e27e15ce5102c3d30
- SHA1 24cc69bf8ccfc7f7e3e2cbc0f1d4a292568f801b
- SHA512 5f978117cd483e6596cf9019aade224ca11c0e19ace7071320729ade555a87dd0114e5fccc08eb6c174c52b979b93bfaacd703160ec566cba55cbeea79e6a678
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 144KB
- SHA256 9c3c7d86c621d48a74194a21ab4a2655c7a4e174c85740415c3d3002de8550e7
- MD5 d795c4b95f1fad790ad507381f392755
- SHA1 f2ee4d503990d66186d2fab323e501f8ef62ee26
- SHA512 0c235af5d6e1f25e65afb6c11dce4f2349a2935b536b331cc6e895a2daf987b16fbeb575f09480c16fbc7dac354af64337f8f2750a042570ce997e7d0bc6de3f
- SSDEEP 3072:TvgMGZw018MGaJu8ZsV25nNCH6Oo7YetXMGAzR:TvgMTjAuH05nN4T4tcGAzR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
- Size 7KB
- SHA256 918fa16fc551215ebd627f174d8c5b5823d2ac618e0151846da15af554cd4c68
- MD5 758a660605734775db1d1b3a610ab718
- SHA1 3dec59b529842f672677e3d48dc880dc64efface
- SHA512 b6cad061751625e7b3c79d70dce1cffffd1d6b336ef4d48e5457df9d49980bc81ee83b0fa6a56cde0153f0391963c3f1d419117ac5f22ce480e6ded02ed611ae
- SSDEEP 96:I6v6en6JuxnifUtwK39K37qCOPXniZEwK24K2JF8yeWbam+3vg:Bi9dfXQeyiTCKq1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
- Size 9KB
- SHA256 8b6b85868097b3b1c0f7a0bd06cc7a9463623ecd9ccd853c1c286e7572bb3a7e
- MD5 df453900e887a95be282eefa96206bac
- SHA1 449fa3bfd38f72df0dd7dc64d84d71d2dab57be4
- SHA512 0c5fe62aecb540856b5a845cc3cd5a82c5781f985b0c621a3346f30889fe6247e7e3d9769b71671f1cfc04a5d2aa7f0731912c7decb1dc156f2994759d928635
- SSDEEP 96:I6v6en6JuxnifUtwK39K37qCOPXniZEwK24K2JF8yeWbam+3v37O1wwK3tK3rnw:Bi9dfXQeyiTCKqMO749
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\ab0e7b1289a4da0b.bin
- Size 12KB
- SHA256 c2d5230034dfcf6588b735c41110576ba4667d2e8d04897f01ff7f1eefad8cd9
- MD5 44eaf497c23f8e5f185129aef9784405
- SHA1 817215c22487fdba3db9ed69549fd2fa58255e7c
- SHA512 cca795800a24e9d2e9465978abda8d5095b1cd9779badc7d6fa711e8945bd63064d4775c1b5987b4d171c36e1547c5b1f51cfc4cb64e351c8d02b8f67560789b
- SSDEEP 384:klqo0r0fVZhM92jt/Cw8mp2jopoHzkZ+xj1T:20wdZq92ATmojnHzkex
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 e95d44193255d515681dbd9ac7d00884d64d3cb802f56d99fbd181aa0bc4d881
- MD5 bafd73028ca890bbf55fe9285f8b918c
- SHA1 db009bfcce16a3ca620bde0791dd53b559c3e808
- SHA512 be365b8e6a7a16324d5bfa616cfeae711d5feb2f2d8fbb0e156aa8769c0f4e85522e9540a2c68132cd874747bed72d2ee6cb295c7e812660a480ae378fe68078
- SSDEEP 12288:lQU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:lSwH/BYcCAwQEKesf/NmLeiTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 9bf4c3c93b7d008c6a45f7c5a58a7f6ffc34d9feb86d0166354ff1c61b5a6edb
- MD5 e5ba11018c89d41bc6c4db6ee464c54a
- SHA1 3b06907d299c845a60375a819dd3833cc62d7c6b
- SHA512 494e1ca185de4318c56a0c0792e3f66dbb2615860337fe10acacb3c936af066fa71d5a0d408d62b1af59ba0ea9007315cd58f714833e361afb19a5f510f34d6e
- SSDEEP 49152:ma0h2GEkuAe73q3pp46zwwQcCCAcKV/NmLvTd:ma0hNYG4JwhCCMlwLv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 659KB
- SHA256 51e6ef68e68aba92918eb41b936773122fbdbc4eade56187af3904a3d67354f7
- MD5 782b7626d5ae7797044644640c336e42
- SHA1 322f2775702ec43f59a8e44e2106016edd295bda
- SHA512 a477ca2e8f5e556b7bf6b0443c191a09dbb7a79b209bf1cf9085da7ae345fcbb1c816773ff9561083efc66e2299705eed9ce6850d75e57b7e297376c07324c4c
- SSDEEP 12288:GhbHjfXzU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:GhbHjP1wH/BYcCAwQEKesf/NmLeiTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 93aaa48c66fe1abb1cf1a6f6400ade83cba3101b8209ab3911246f37e97ea514
- MD5 741709ac2f205ce3f4e853c576dc8bbb
- SHA1 dfd4aab6e49dd6f6603ddca6bc49dcdf3435e915
- SHA512 2e3d549fd34e10091f9b5217dddd635a984554fba33a15ffc9a70238cdb1adc83247bef6cf1d66a7eec16ddc449bf57b84cd5d2eb737838b2e298c55d77cb019
- SSDEEP 24576:d3YgnJcRTk4yti+R5dBR/twH/BYcCAwQEKesf/NmLeiTd:dIgnaTk46pBR/tCCAcKV/NmLvTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Locator.exe
- Size 578KB
- SHA256 02f83f22b38f7c20ab6a1bcd70c441f78a9c36bc98203d0b36d401849555879a
- MD5 f6079b74ed5e6a2382cd85748c988b3e
- SHA1 5bd7d3a41951db2c255605710810922c8f5481e3
- SHA512 31580948e91d83aa071dc1a4a0a4350087c78450e27d915e6cb8be91a610d3abbcdf73f1753e9b4052a7163249ee9c290379808833695cc8df6d672ccb7bafc8
- SSDEEP 12288:qMU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:qmwH/BYcCAwQEKesf/NmLeiTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 940KB
- SHA256 81cdd8decf46320c74536faf932d62c85278726a58c354758cb6f33d0ac29fcd
- MD5 a6fb8ab3adabd6910d4a61165f1faa17
- SHA1 9d84bf795572aa22719275f8441c7c9e139027f9
- SHA512 9bb57f00c0a8592dc0b1fb350186d79308ad3f4a4dedc78e887db1463fb3573643715590e012365ac361a0905ae16f521ced2d582a573098de9e549ac3367ec2
- SSDEEP 12288:OObfA4LWOsvAYFTdU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:3bL3UTPwH/BYcCAwQEKesf/NmLeiTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 671KB
- SHA256 357860aac434c47b83c5e0b873c20c85032cae201bdb6ebb3af8d05dca5838f4
- MD5 c76f6bf3fe50cce98c4875cd21a0df26
- SHA1 0a6c830bcee4f2e1932b7b85a48ec3e9dbe24df1
- SHA512 6734108e284190216836f82cca2508cadb336707e8cb63941bee98e5032246025b9445e8dc414984f45f3b258e9b42fcb5aa74e8619d80ec563bd844659ebaf1
- SSDEEP 12288:hpFtIO5U5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:gOzwH/BYcCAwQEKesf/NmLeiTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 0dd8610f6e5a297ca141f4c9342d96ba325062b03a4475959d275a7f84a37a0c
- MD5 16578b0cb4c26e30ed0eae824576a681
- SHA1 b5c87b2076887b24d6a070e29e86d44504235412
- SHA512 f9ebe964257f766c574f21c4998160712896517fa8e58f61355ec40159a636b0f1e275f17d4f5dff7b9431229d51ad4def297ca0fd885ef0c396cfa43d9903df
- SSDEEP 24576:A7NM9YqZqmWMUkPjZM48Mv6bEhsiwH/BYcCAwQEKesf/NmLeiTd:A7cBWMpPjN8DbEhVCCAcKV/NmLvTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 50fc1d6f6cbb63f60b27dd2bf55da51488ed0f15bcf93903224a600cd7ca55b5
- MD5 af2bdd9ea82185e0042c5d03ec763fa5
- SHA1 5f0d0c64b0d56304a30d06c81b622190df325196
- SHA512 d2f7d405a50d806b673718dc79e9914e324ead441795d52a979e4a5fefa276ee4a3a4e2b35361965c0049b497d77f51d9b283bebfcf7fa3389f34fd00fff555d
- SSDEEP 49152:nF2YuHNETovAvNYf8kmCCCAcKV/NmLvTd:+6BCf8kzCCMlwLv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 fc7450b8a38f7cdbd6fb90a8e6982420af755366ad67b2e4d5d05d6dfb11051a
- MD5 d3ac246ff70a05d1cb6d2e965d5a939d
- SHA1 5920d771bb6428973ea49f306c2e19131e1480e8
- SHA512 85f28e86309940d27fb8131e44ee1650724a78f16379ebc52223c0ce276bae822ca1d736381be43ad7a15ff2fc44238aa1ae18c6a15fb55fb79179acdc46bfb9
- SSDEEP 24576:pAFs06+OmlfkNXEbTo3wH/BYcCAwQEKesf/NmLeiTd:uFs060lwXu8CCAcKV/NmLvTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\TieringEngineService.exe
- Size 885KB
- SHA256 99dc9ebee3cae701033bf10cc9eabf4fa39f10bb5d727de9fe434fa96ed22ec8
- MD5 4d92abd50dcb933711916f8a9fbf76e2
- SHA1 f4cee3bc022d574983e284b2da98b2cad314d9c6
- SHA512 4d42811a4bc889d9d96bbcbac7bf8577320c8f4309c2579199bc257d3dbc871a6f5cfad180eefb25c86d9127894ef0d5c9e7b4d5281ef121f6c214445878ac67
- SSDEEP 24576:iJnJ5D3WX8wH/BYcCAwQEKesf/NmLeiTd:iJnJ5DGX8CCAcKV/NmLvTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 57f66d1cec9f1b89106c581204772189e1deb37571872e912c34e09e20e9409c
- MD5 333d750d56f428a98b0de9f503d8196e
- SHA1 7d1fdce4ed00247aa65c1aaa420bad50236b4dcb
- SHA512 ac50ec959f2fd843c77285fd6ebd719fcbe03ce92103f5a6931f8c15f1d31aedfd82ea9e074042b45cd52e4add38f6b2ff33b7a6684c3575a8df0e7ba8598289
- SSDEEP 49152:Ug06DIKdwc+eQnSt65aVOCCAcKV/NmLvTd:FoCCMlwLv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\alg.exe
- Size 661KB
- SHA256 9b12b8ba8a3010e1e8d3e164201434c8390444c9d4baf9195dd147e3fc4ab3b1
- MD5 4b80bd83601d3afc8f9718ada0f63031
- SHA1 152e6c57539ea3aa819e5e995ac63d98088c8991
- SHA512 2d504381418b96cd3ef4c4e957fac7f101f870cb9819efcca424de1b98be57dd23a6709ad12e5b047cd5b9dee2daec27a32bcdb6c2b0087104588af8843a4b5a
- SSDEEP 12288:vEP3RnjU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:0nlwH/BYcCAwQEKesf/NmLeiTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\msdtc.exe
- Size 712KB
- SHA256 86a8aeda256e2ea48989405a225f98344a79aff7e67f5191ce139694eb651900
- MD5 d6395c9d81ec4752fa2d7adc4872ae54
- SHA1 2d4173cdad0ee0bf02877b2c90401159f70f6b8f
- SHA512 931ebe639bc387b0c7aed9dc20ce619929557a8632b1c78f3685458eefe3cab86747b17403c5cfeef67ac0cddc7db5e3ed28265cb0c780ac64882432a7d3e0b5
- SSDEEP 12288:GjkyjU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:GIylwH/BYcCAwQEKesf/NmLeiTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\snmptrap.exe
- Size 584KB
- SHA256 c45382bc93efb0c07ff17f3d26a66ad9801677d13b73209e252879aad322aa7c
- MD5 66a03cd5865edc37296f773650bd92b2
- SHA1 2c82a9452398a5d740f91180015d53b3a854788a
- SHA512 b6a5925023f9c517272bb6e9ad9e7445a152e1163bace2982aef4e9dc68d2293395438f2a08897b4a7c04dcb6bb479a62b667f706c58c32bc795e276f9badabf
- SSDEEP 12288:uypU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:XjwH/BYcCAwQEKesf/NmLeiTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 aff00d57d7d34030e4f5f8322ef48bd142bfbcbc14746853b5bf045c570040f1
- MD5 1092ff827d57c7b30a1a6804e60408d7
- SHA1 789ce78056bad528871967c153711768d6a6ab1d
- SHA512 0bb81f6b19f70a7b248ca88c3343f92c930e87fc33345b15840b55c48821b8f80a04319736196b77a58256f4426ae2857e453c51de2853fa6af68192aa842f2e
- SSDEEP 24576:nQ9MxZKdcz9dw3KwH/BYcCAwQEKesf/NmLeiTd:nVKZKCCAcKV/NmLvTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 772KB
- SHA256 ede222c0b326cc08d5b7eb5109179bacbce15831b1300abd67c78b12c5e125b8
- MD5 509d100f420f594670f643adc4eefc47
- SHA1 180933d654791397606c30d781809d9c0f4d9408
- SHA512 a2ccbed29c60fb49629224ced7587b760eb716b80901a07820de930390d02c1d1bc334f24de8e4ae8b9531eb369b1f7630773b9e7e693ff51d0c4a2fbeeb200b
- SSDEEP 12288:MyoKo2JRple9pvU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:MyocDApJwH/BYcCAwQEKesf/NmLeiTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 fd77dcf003a5fcddc3bda44fc2f499276c4cb89b588ba3a872ffbcf535269c51
- MD5 e220664c13d6653ef2376bb7aab95452
- SHA1 1a39882b0e21ec863bd8d37065851b0bf02189e9
- SHA512 392cc4cbac9e5fc9d70f9d97ea77522bbd1385546d6e8a80f1292cd6abf407cda8c31e320845bb483ea0443be185a6e84e3e6de9c3442340548c1772269185cc
- SSDEEP 49152:gWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKJCCAcKV/NmLvTd:S0zuNIPCCMlwLv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\Crashpad\settings.dat
- Size 40B
- SHA256 d1215b73e131337045c0d8290709999e43536fe53a0eb9555e06da69e5d1ab8e
- MD5 5b764fc9c98c52acb9b83a028d3f7794
- SHA1 5ded2b401475ac928be73effd8c4724cea52be93
- SHA512 638bd1819955eb2c2025a48a369e9022685810085acdf90d1011498e9302e67856ec5c7f49552edcf2268057d9e47e172e7cbaa23cbc704cd492a9dbc388fea1
- MD5 SHA1 SHA512
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 31d9c0396d4fa1b8f87dded989f3c068e40f9b5da916c6295603eb7600f38e81
- MD5 c5456d1f7095b89fb9d1d43d067063c6
- SHA1 190b847d907ffeaea8285a7905c8b090fc8eaaee
- SHA512 e332832e51f2b220bf0e633997ab9056a2915ae20371feab6d7941f77238f6e0511d94a7ba76223e0974e6154d90a8a1720247ff435173d613793fb2cf1b7f65
- SSDEEP 24576:E1QT7EcpfxR+N5AWAz3ooiYujMqbQwH/BYcCAwQEKesf/NmLeiTd:5TDxR+N5YzT4jMTCCAcKV/NmLvTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system32\SgrmBroker.exe
- Size 877KB
- SHA256 5b1c70ea74a907acc92a6c08d9e7bf806bb55ec4813e2c75e02fd2945eb2c83a
- MD5 3088403f77ef037fe59131cdd8b93a11
- SHA1 96849fc49dda8912201c9d982857c636def23533
- SHA512 165178612cd194efd9e2e87da2067ac950633197b1ad873ee3acdac3bb1cf7c888b2b3a4e47952e5c6a2670e5b33643b38126c0c0207a5fb3f3180bd326e5b44
- SSDEEP 24576:hTMdOz0FFS+bmSLkwH/BYcCAwQEKesf/NmLeiTd:L0K+bmSLkCCAcKV/NmLvTd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system32\msiexec.exe
- Size 635KB
- SHA256 183cd0043fac6ee51e8268c321c86d473a9928edbeb60d7d7fe37de3acfbbf20
- MD5 58cd0ccd7abe819ee09bfe9fad48f4c2
- SHA1 62702e7e58da41f7fc9e755e3fe76f3ce28b0811
- SHA512 22b526fb62865bbd0f652d2dd5e87195247d7b37de5cb6b8feda1946a34d3c0e0f45f9565ab62adf0c49a6708267c684ceeb977e87ab0a440f06df873c69c888
- SSDEEP 12288:H4KdU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:bPwH/BYcCAwQEKesf/NmLeiTd
- MD5 SHA1 SHA512 SSDEEP