7ef395d2d730535fa8623b5410bd3e59f4d80c183d24a498e935c39341d0e2ec

Analysis

max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 10:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
Size 9.5MB
Sample260415-mwdwtaez2x
SHA256 7ef395d2d730535fa8623b5410bd3e59f4d80c183d24a498e935c39341d0e2ec
MD5 571d3aabd4c1533077309243e34cc115
SHA1 02a2d10c6809975ee49dfd292216c25a459e4b40
SHA512 e9b78a32064a6a93bdab6b7b9421eabdb76e0b74d972e6e7e8fb95045f6af368ff34da5b01afa3e765faf983cf4d3cfda09cd35a1672f448e500594feca9bb0f
SSDEEP 49152:L/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+lpSt3I:YWQtZ/K0tGOFWVRuLftCTVdUy
TLSH
T1D9A66C07F2A84198E05AE179CF3597229B237C5A87F1A1DF216036D42F76AD07B3C762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 3 IoCs

resource	yara_rule
behavioral2/memory/5020-0-0x0000000180000000-0x00000001800DD000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/files/0x001d00000002b1b8-10.dat	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/files/0x001700000002b39b-81.dat	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2668	powershell.exe
2764	powershell.exe
2484	powershell.exe
4896	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
1464	Symbiote.exe
2636	Symbiote.exe
4656	Symbiote.exe
1452	Symbiote.exe
240	elevation_service.exe

Loads dropped DLL 2 IoCs

pid	Process
5020	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
1640	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	Explorer.EXE

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\iexplore.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX3096.tmp	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\WeatherStub.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\dotnet\RCX2342.tmp	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\PeopleApp.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX349A.tmp	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\RCX3330.tmp	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX241F.tmp	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX2A3B.tmp	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\RCX3105.tmp	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX3586.tmp	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\RCX31C3.tmp	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\SnippingTool\SnippingTool.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX38D5.tmp	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX30B6.tmp	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCX3174.tmp	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\Todo.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\PilotshubApp.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCX34CA.tmp	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX2391.tmp	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5056	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207237344286728"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5020	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
5020	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
1464	Symbiote.exe
1464	Symbiote.exe
2764	powershell.exe
2764	powershell.exe
2636	Symbiote.exe
2636	Symbiote.exe
3132	Explorer.EXE
3132	Explorer.EXE
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2484	powershell.exe
2484	powershell.exe
4656	Symbiote.exe
4656	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
4896	powershell.exe
2668	powershell.exe
4896	powershell.exe
2668	powershell.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe
2636	Symbiote.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3132	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1464	Symbiote.exe
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeDebugPrivilege	2484	powershell.exe
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeDebugPrivilege	4656	Symbiote.exe
Token: SeDebugPrivilege	4896	powershell.exe
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3908	chrome.exe
Token: SeCreatePagefilePrivilege	3908	chrome.exe
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3908	chrome.exe
Token: SeCreatePagefilePrivilege	3908	chrome.exe
Token: SeShutdownPrivilege	3908	chrome.exe
Token: SeCreatePagefilePrivilege	3908	chrome.exe
Token: SeShutdownPrivilege	3908	chrome.exe
Token: SeCreatePagefilePrivilege	3908	chrome.exe
Token: SeShutdownPrivilege	3908	chrome.exe
Token: SeCreatePagefilePrivilege	3908	chrome.exe
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3908	chrome.exe
Token: SeCreatePagefilePrivilege	3908	chrome.exe
Token: SeShutdownPrivilege	3908	chrome.exe
Token: SeCreatePagefilePrivilege	3908	chrome.exe
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3908	chrome.exe
Token: SeCreatePagefilePrivilege	3908	chrome.exe
Token: SeShutdownPrivilege	3908	chrome.exe
Token: SeCreatePagefilePrivilege	3908	chrome.exe
Token: SeShutdownPrivilege	3908	chrome.exe
Token: SeCreatePagefilePrivilege	3908	chrome.exe
Token: SeShutdownPrivilege	3908	chrome.exe
Token: SeCreatePagefilePrivilege	3908	chrome.exe
Token: SeShutdownPrivilege	3908	chrome.exe
Token: SeCreatePagefilePrivilege	3908	chrome.exe
Token: SeShutdownPrivilege	3908	chrome.exe
Token: SeCreatePagefilePrivilege	3908	chrome.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe
3132	Explorer.EXE
2108	chrmstp.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3132	Explorer.EXE

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 1464	5020	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe	80
PID 1464 wrote to memory of 2764	1464	Symbiote.exe	81
PID 2636 wrote to memory of 2484	2636	Symbiote.exe	85
PID 2636 wrote to memory of 3132	2636	Symbiote.exe	53
PID 2636 wrote to memory of 3132	2636	Symbiote.exe	53
PID 2636 wrote to memory of 3132	2636	Symbiote.exe	53
PID 2636 wrote to memory of 3132	2636	Symbiote.exe	53
PID 2636 wrote to memory of 3132	2636	Symbiote.exe	53
PID 2636 wrote to memory of 3132	2636	Symbiote.exe	53
PID 2636 wrote to memory of 3132	2636	Symbiote.exe	53
PID 2636 wrote to memory of 3132	2636	Symbiote.exe	53
PID 2636 wrote to memory of 3132	2636	Symbiote.exe	53
PID 2636 wrote to memory of 3132	2636	Symbiote.exe	53
PID 3132 wrote to memory of 1188	3132	Explorer.EXE
PID 4656 wrote to memory of 4896	4656	Symbiote.exe	89
PID 2636 wrote to memory of 1188	2636	Symbiote.exe
PID 2636 wrote to memory of 1188	2636	Symbiote.exe
PID 2636 wrote to memory of 1188	2636	Symbiote.exe
PID 2636 wrote to memory of 1188	2636	Symbiote.exe
PID 2636 wrote to memory of 1188	2636	Symbiote.exe
PID 2636 wrote to memory of 1188	2636	Symbiote.exe
PID 2636 wrote to memory of 1188	2636	Symbiote.exe
PID 2636 wrote to memory of 1188	2636	Symbiote.exe
PID 1452 wrote to memory of 2668	1452	Symbiote.exe	92
PID 2636 wrote to memory of 1188	2636	Symbiote.exe
PID 2636 wrote to memory of 1188	2636	Symbiote.exe
PID 5020 wrote to memory of 1640	5020	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe	94
PID 5020 wrote to memory of 3908	5020	2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe	95
PID 3908 wrote to memory of 4584	3908	chrome.exe	96
PID 3908 wrote to memory of 4300	3908	chrome.exe	100
PID 3908 wrote to memory of 5056	3908	chrome.exe	101
PID 3908 wrote to memory of 4300	3908	chrome.exe	100
PID 3908 wrote to memory of 3768	3908	chrome.exe	104
PID 3908 wrote to memory of 3768	3908	chrome.exe	104
PID 3908 wrote to memory of 1052	3908	chrome.exe	103
PID 3908 wrote to memory of 1052	3908	chrome.exe	103
PID 3908 wrote to memory of 4244	3908	chrome.exe	105
PID 3908 wrote to memory of 4244	3908	chrome.exe	105
PID 3908 wrote to memory of 2484	3908	chrome.exe	106
PID 3908 wrote to memory of 2484	3908	chrome.exe	106
PID 3908 wrote to memory of 3296	3908	chrome.exe	108
PID 3908 wrote to memory of 3296	3908	chrome.exe	108
PID 3908 wrote to memory of 3344	3908	chrome.exe	112
PID 3908 wrote to memory of 8	3908	chrome.exe	113
PID 8 wrote to memory of 4176	8	chrmstp.exe	115
PID 8 wrote to memory of 2108	8	chrmstp.exe	116
PID 2108 wrote to memory of 4496	2108	chrmstp.exe	117
PID 3908 wrote to memory of 3860	3908	chrome.exe	118
PID 3908 wrote to memory of 5004	3908	chrome.exe	119
PID 3908 wrote to memory of 4600	3908	chrome.exe	120
PID 3908 wrote to memory of 3864	3908	chrome.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Users\Admin\AppData\Local\Temp\2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Users\Admin\Videos\Symbiote.exe
    C:\Users\Admin\Videos\Symbiote.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1464
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -c Add-MpPreference -ExclusionProcess "C:\Users\Admin\Videos\Symbiote.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2764
  - - C:\Users\Admin\Videos\Symbiote.exe
      "C:\Users\Admin\Videos\Symbiote.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2636
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -c Add-MpPreference -ExclusionProcess "C:\Users\Admin\Videos\Symbiote.exe"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2484
- - C:\Users\Admin\AppData\Local\Temp\2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe
    C:\Users\Admin\AppData\Local\Temp\2026-04-15_571d3aabd4c1533077309243e34cc115_cobalt-strike_hijackloader_icedid_njrat_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=0.0.0.0-devel --initial-client-data=0x38c,0x390,0x394,0x368,0x398,0x1403bb618,0x1403bb628,0x1403bb638
    3⤵
    - Loads dropped DLL
    - Drops file in Program Files directory
    PID:1640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3908
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3b22c728,0x7fff3b22c734,0x7fff3b22c740
      4⤵
      PID:4584
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,11969531643366961028,12645664498743203351,262144 --field-trial-handle=1988,i,18373744255652204740,16326335049884317902,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1944 /prefetch:2
      4⤵
      PID:4300
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2136,i,13785320772815160082,17713670738855872208,524288 --field-trial-handle=1988,i,18373744255652204740,16326335049884317902,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2132 /prefetch:11
      4⤵
      System Time Discovery
      PID:5056
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2260,i,5730918913545953793,3367014557364875099,524288 --field-trial-handle=1988,i,18373744255652204740,16326335049884317902,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2784 /prefetch:13
      4⤵
      PID:1052
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3104,i,9402519663841287674,15461763419857177685,2097152 --field-trial-handle=1988,i,18373744255652204740,16326335049884317902,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3120 /prefetch:1
      4⤵
      PID:3768
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3128,i,14456762559723270888,15091533118116642546,2097152 --field-trial-handle=1988,i,18373744255652204740,16326335049884317902,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3148 /prefetch:1
      4⤵
      PID:4244
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4204,i,13555923451563430389,12647727036110563610,2097152 --field-trial-handle=1988,i,18373744255652204740,16326335049884317902,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4220 /prefetch:9
      4⤵
      PID:2484
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4628,i,4513422999097766485,5101755714449555646,2097152 --field-trial-handle=1988,i,18373744255652204740,16326335049884317902,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4404 /prefetch:1
      4⤵
      PID:3296
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,3908224076249110430,6132857731690468500,524288 --field-trial-handle=1988,i,18373744255652204740,16326335049884317902,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5436 /prefetch:14
      4⤵
      PID:3344
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:8
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7dd6555a0,0x7ff7dd6555ac,0x7ff7dd6555b8
        5⤵
        Drops file in Windows directory
        
        PID:4176
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2108
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff7dd6555a0,0x7ff7dd6555ac,0x7ff7dd6555b8
        6⤵
        Drops file in Windows directory
        
        PID:4496
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5984,i,8501479275625065768,6307619386877166837,524288 --field-trial-handle=1988,i,18373744255652204740,16326335049884317902,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5976 /prefetch:14
      4⤵
      PID:3860
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,8962565322756529666,11780263221343704305,524288 --field-trial-handle=1988,i,18373744255652204740,16326335049884317902,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5932 /prefetch:14
      4⤵
      PID:5004
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,15863060474831271968,13845532107087723660,524288 --field-trial-handle=1988,i,18373744255652204740,16326335049884317902,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5888 /prefetch:14
      4⤵
      PID:4600
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5588,i,10826718945094144075,16055966793366879659,262144 --field-trial-handle=1988,i,18373744255652204740,16326335049884317902,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4244 /prefetch:10
      4⤵
      PID:3864

C:\Users\Admin\Videos\Symbiote.exe
C:\Users\Admin\Videos\Symbiote.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c Add-MpPreference -ExclusionProcess "C:\Users\Admin\Videos\Symbiote.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4896
- C:\Users\Admin\Videos\Symbiote.exe
  "C:\Users\Admin\Videos\Symbiote.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c Add-MpPreference -ExclusionProcess "C:\Users\Admin\Videos\Symbiote.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2668

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 5.4MB
SHA256 9fc497073c9243f38771a562fdf8c442ec22178a0ca3f0165082e5cdb856dd83
MD5 41eebf4c8faaa69213e1943848821f1e
SHA1 1a46112e0f16b232d123d470d799f71da8788d9c
SHA512 1271868f3eb6255f7b30a218c0baaf8d04817f84ab3ad6b824e513cf8839cb00f476650b9daf246b797458d5387b95b69c76eea7777546511af9d331e1df0a31
SSDEEP 49152:ZB+taZ3usBWOBr4tEGW0bqx0z+n217aau1glTkx7SVfl:Pu6Jm0xd2dTkxaf
TLSH
T1D9469E03F5D901D4E06DD47E530A9522BA79BD5A0B34B2DF9B90B2072BBBEE45738720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2108_13420723734819660.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\2108_13420723734819660.pma
Size 696B
SHA256 838b08e2dc2d6939136cb4cb2a7a19ce9acee46e3e4774407338a6b26f432f5f
MD5 cd5b87490960d17ff18056ecfe0edc8c
SHA1 c02d5a1e9bb0cde5779457dcd38f6185dc352790
SHA512 c6e6af4b13923b70df154907d218f0b83a1070e2dbffa637ab789fac99d9843e1168618afb05fe46145dfe2d3822af569985966729c28700997d6bbb6fcbf2da
TLSH
T1B501C946A3144F77CC868D3584BE27512BB0FA502B821BBF7B10724F3E021C89E99168
MD5 SHA1 SHA512 TLSH

Submit Download

8_13420723734855582.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\8_13420723734855582.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 974KB
SHA256 8f5127e34c0bd7eb015c5c6f75c37b27ceab2701b3d769a4f81c54715fa2c235
MD5 cfec599361e8119c2843f470eb4dae7e
SHA1 e56bb078459c0ba2a92c9e95eb929fc48b7444c3
SHA512 bee51b71f249d00bf748a89fe809dc69813c840a38f29cc0204e5c2466720a739f231a95396fae9dd60068aa72f6f2239a2edf7e2a718aeff2c14dc5d8409afa
SSDEEP 24576:MmveXK9x7MSFuX4y7HUftNtcSZlk5UYVF:VkK9x40uX4y7HmtXcSYd
TLSH
T1EB256B720138F808EB5CF032295C7F4EED1469AABDC2567E5426A25443FE3431FEA95B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 974KB
SHA256 f18e9ff8e511cdd14cf67aaa4912881f538367c68df99ea715b1888c0a206232
MD5 3a04cb29058fdedff7fd590db2be3cb7
SHA1 651fbd452206ac46e301246dde7c29ecb29cfb1a
SHA512 192377b1aa012ccb12ccb16cc480f2141372031aed0f50fdfc6c46ab8405cb43168edf833b70e059a9473622bca0527bed5d88a77a9725e9d39302179292eac7
SSDEEP 24576:CyvhgGQWyDUGVewSL0nDdvPW+buzdC+n:zv/QP8+Dd1CzdC+
TLSH
T1A8254B7E4DBE9718DD63C9F885948D9C476861F2A11B3238239872E40DC13772FAE972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 974KB
SHA256 86c2725cedc977588d6e57ee9ec533efdff231130aa008f0785c79558bf84000
MD5 de781f2eee72a45174ae149df027b971
SHA1 f282ab746d4d074d5b51b9f8adca3cce058434f7
SHA512 f97744962b55f021f02ec5521437f1aeae5ddc4865db9388903d4f19dfc9152741e19dc5aa2b39b757e7d6476db90604c0300b5fa65211e0365253a607bb0dfb
SSDEEP 12288:OKcEbfHPzAgQF/UTdyfCt1nE/X149h8/OB8fXza208P:OcQFLzC2OB0nF
TLSH
T117255CEED9BE42BCF1F69479D9BCE6B423D4B46A0363B2394054508DB3D841F22F1A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 974KB
SHA256 062471e9dd8c5860c28f096a6c875a0f54d8c67342f699e3c22ee22fb3578034
MD5 7271eae54d7c38cef6a87e633aa0227b
SHA1 49b76b390ab5028371fa4f4afde3d86e29da4882
SHA512 5b7ca7baf87c9c36aea3b6d1517a16b126e5456c6276e21f3663df810d2f7d0594c64913c0a35637301a8045a6c97aa84fa3115a962c923c1ba765c0bfe67111
SSDEEP 24576:as2w97jA1mTkdLQpPPbDoZYi7AVm7aFIP2AVm7bHpijY1KoWt+Pp19YicWmiKYi1:z7jA1mTkdLQpPPbDoZYi7AVm7aFIP2AM
TLSH
T12D258DA9BFDEF850D9B107B54C0C45F4AF5783D93B783AF55B27C017829098E69AE082
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
Size 974KB
SHA256 31d6bdd3eb469e298cf3875b1e67441e460b9d33eeb39d2911c2a269f99b6a37
MD5 a47f198aefa242094bf49bfc8a083f82
SHA1 57acff2eb8f145351514e31386c9985f6aefdf18
SHA512 a8e35765aeb8957699ee54d0fa0d45d4da7d3c97c2b2e34ffae1fc9948ac543755aabca24917c9f4992579bc9bc914082a0002f6feeca88e1c4272817641ea87
SSDEEP 12288:a7pkaiuan3Ih/in3IhuVhqhRZD0WBPpazWJP1zuRYRi9xdvC0hAGKAP:a7s24WBPp31zzFm
TLSH
T1DB254AF83BF8AFB3C70395729BBDAE21016724B3E7C490663826270505C659BB5A7335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jre-1.8\bin\pack200.exe
Size 974KB
SHA256 8bcb569920ba9b57dc1bf379ce2a2448a21279f4935db609983c7310983cdf05
MD5 33b8456e20659cb542449c3b9c5421ba
SHA1 40d56c6c6649370da5def9dcd0c55b493fd33873
SHA512 a3f71cf15012449c6ea87e4f3f0dd0c30ee5011dba3ba2b20863c444ae42406c3f7f5245e0070684548305a7bac3e950b401b330f84dafedf38719103fb55333
SSDEEP 24576:h5qFh3PdcLggNOXBhtAOHQaQ4IeVf4cRIrFx:PqDpOaQ4Isf4cRIrF
TLSH
T17D257DDF4075CA39EED11FBEE0A9933688A8C19F7556E2434AD8E4917FC95163280C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSPPREARM.EXE

Path C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE
Size 1.4MB
SHA256 ad71f0bf3e6d5996606d5fd2c8db4867920d440d91c6fa9682027d20eb46fdd7
MD5 4d3a955ec313851fa1cc4e5d83ead3e8
SHA1 8c68be01666b724529218ce89e3986b15d4c1a91
SHA512 f8b6570bd90783afe9338f7e16f3fd7a861898fefcd4d8284eea03be58e438c1bd15a63f5ee8e312c96e1ff4315f677b0aee31ef847381cd00de71842a6d5967
SSDEEP 24576:pu2w2JUqOAw79anQBXDSvGRcDC7cEaWQXOLU9TJOLU9n4PIwTMI7W9E9eZd1ioMc:pO6OAMm9es/WSD
TLSH
T1FE657D2E0E2D80E5DB0EB6FC0C838195D975F94A6B4192CBE1B5F27C3A2B5635CF0961
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSOXMLED.EXE

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE
Size 1.5MB
SHA256 a8096ef45bf1be38ce26ded01ef872e912663bb247e7c0b0025cc4bc169b8eed
MD5 c2c82c831e2b48895142460c02ffc404
SHA1 6bda74f98607e5b1daf71f1e269275f77b27d970
SHA512 ce9c1a915d2ff767cacb62c5c2d11ba1ddac7d4d19627f0e29ad341286e8e662809f0e1a11a0061ff7438b88e70c82a56bd9fab129bc400dfb866ac76a064e7d
SSDEEP 12288:JCrJolMmCeGxigNKMhODQzvxMi2lsMUgAzAzCD1Pe:JWolMAGxiUKoODQzvxMiEsMUgAUzm1G
TLSH
T1AE7529A269C928B8D560053D06BCEA6CAE702E0DD0134FB374913ECDFBD159D9FA6274
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugin-container.exe

Path C:\Program Files\Mozilla Firefox\plugin-container.exe
Size 1.2MB
SHA256 3102ef360dcfca77b28fa96088948febf31c48092f4d4138a197e5c0bd70b260
MD5 eb5ff4fd3857a29a30ab2632fff77f08
SHA1 7ae60e188716472f03bef2f2f9996bf70f67532c
SHA512 5fdef4fde029f9e8004dd7284e50bc2e14e2e29a64df536eecf934c4f7459adae1e696e002528af4f51dfe884ff2530125c782af11cec4be26c1dbd031a69720
SSDEEP 24576:F6IaFK6uzRnq767iq707Xq7HRQq7cA/1jGqXWJ7S0Rw0e5SK3pg++S:F6IQK6uzRnq767iq707Xq7HRQq7B1jGE
TLSH
T105458D33853EA67CC1E21876C759AFE4B21426E1D2D340DF643A9791AB530C1EE7827B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 308dc6ef39f832081ba9086da11d99c047d34d971c206771c36925dd27fa06cb
MD5 f7aa1e9bd59c99c5ecdfdf29a902249c
SHA1 682e4dc0c37bfa75616ad3586a176b798a23da76
SHA512 e39ed17ea30ae28c0cada3f1742c73fecdb15d6813c625fb54e8877bf8fd57637608cb62dbd5b2abc321de38eafa81b72a03995e83005bccc2f6ab070f5354b3
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6eb66b38e4499e30e413196c2512dd3b49f108a243939c0cfa5ea6dca622cfdf
MD5 cb2834f27bbee85777314ceaa7dea1b4
SHA1 f0fe04139b32ed0a5c97298ae5b9045bec3a9c86
SHA512 473c18327c03c9ea184c72775bf4e0ef6d65d3fcffd005afc5bcedff337380de268f3a2f9c7dea17d4684daa68a501a0359f08383d93e8b6471fa511ab24bb2e
TLSH
T139E02BAACC21DC2B18FD0B1960508782EB10135B6741854F3B3C820D8FF027741D581C
MD5 SHA1 SHA512 TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 51776719485ff8d96403ce3e8320c9cf733614fbe29e2a7ea15730b3edd4c2fe
MD5 ab985c9433f87bde44114bbe85fa7e1f
SHA1 8d1223c372476eccf0b40b6dac03b7926115d867
SHA512 aef47c7ca6de0bdd3d3140f3ca83dad02b595950fe30ec5b16ac72334bb2279a0ced4bdecdaab012ef77c6fed948991513a999424b22c15530e0a15e17a0028f
TLSH
T14551ABF393E4897DD51152E4AA25AE2FCE790A24131C7C62C9D8AE0B57F2872D20038F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1428b7759914e1c0d099f986374211d4bae009499ec2356a45a46b4f51086474
MD5 97c203b87a82f493722a155415e84664
SHA1 da5577a6d136856f1238f80b45c13c1548bcc5f6
SHA512 71bae49116ecae7aaaab9045cb9ce24878de7ab37a55886e19fe6085cd3ed1b11b0d3ce5c196220d40c9df9b2fd7ba3c757e02ca7fd4f2bce493edb6092023ce
SSDEEP 192:bRK0IYrs980k2hGiv71/GPRpT5Xsb+WNnCEp2V2WRb2wVq+kwiiyIsnAUgraJ:bRzIM8WnuZQXlXws282wVq+7e
TLSH
T17442C66EED14757B5CDBD22AFDA17B53D7F5102221911D84EAFC8A2C18EB6CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 f1c902fe1afae9ee601c2b7c6de5a3715334151521e3f96072bad1d50466aa9b
MD5 acec50f1cf19f44140492d1d85bb5a3c
SHA1 b09f6556aa4d17cc3a35054a30dea89e78523388
SHA512 0734c37c5ce201d48aa65ea4848bad88e0981ea2753d063e3126db5244478f995ddcc612f15f6f6b37200e7614b80b9cb3ef9291b1025971d3a8ecc0235eac1a
SSDEEP 192:bRK0IYrs980k2hGiv71/9PRp25Xsb+WNnCEp2V2Web2wVq+kwOiyIsnAUgtaJ:bRzIM8WnuZNXqXws2n2wVq+38
TLSH
T12A32C56EED18B57B5CDBD22AFDA17753DBF5102221911D84EAFC892C18DB6CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe586201.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe586201.TMP
Size 3KB
SHA256 197683a0d9df3c2636eb036dc45272b38ad651e2be56f454d72998310418fd74
MD5 8539b16fd7439377ed8bfbd5d6da1a98
SHA1 9e054cd4e165249ecdac78c67e9b1d0d7f7016fe
SHA512 7e227df9d435e62932b3f049aba7e6520ee3983e0b5c9df0d02aec99513c20a51c8ddbfd45970beb09979606085b9d5737fd70e3fae361abfbdd38821bfc4d60
TLSH
T1EC612169C4B44CB34DB2B7A5B92E4781FBA4473F118018057A7D8ACE0FB39275581F6E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 2c3c79bcfcfdecf9c0f4c3813fa89dbdd9e096f30167b84395792c7c49270842
MD5 b2ab6d65a134acb43bd099b17fe67824
SHA1 a70714b594b7f44f0d6220c7ace6464334727c3b
SHA512 20f56cbd4cf999daa760301442d715fdbb4f9ea11a22adba9a3fb9ed05180f8aaef738a611b19ce125bf6a578061c4d768f0231b42a5550c6fff5ef5025e1fca
TLSH
T147B01260C4429502C01702F82182148871189F30CB05230253E069B29C2A6904118161
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588fe7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588fe7.TMP
Size 96B
SHA256 194e132f974e92644d22866c444518df8fc7357734a26cf093ef0e1b30c85315
MD5 88cf8bf85614422756166d2cc9750e20
SHA1 aed539c26c68e31147f521316780e3b1a664cdb8
SHA512 aa6d15bff5543c6a51979203d766021c8a0ab57de45e8cdf9f508265c872559e707531cc0a64e4b8dfb208111d3d0a366e89a19c7dafe6b463bdfac98481e399
TLSH
T14FB02200C002A223C08203F03CE0C8CC3820CF23C303028282F00A22CC2822028228A0
MD5 SHA1 SHA512 TLSH

Submit Download

ef7a9e49-308a-4592-836c-0d4ed357f20d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ef7a9e49-308a-4592-836c-0d4ed357f20d.tmp
Size 17KB
SHA256 815f7cf2441d8bbd1e771118781b4364aae22d7489793b4db97b9f0119d089e3
MD5 6c2a084e9725415d6e6f241570b51988
SHA1 f7e51421dd3914c45e248d5cfdbcc1ccdd7b1907
SHA512 0f2edbb6a76239ee35ba77bd8dd350b86c055aaafae69ff2d50a4140d561c818f0c11904a51a61bac41705a0c50d69925327d1db674cd222f87fa3c49aced588
SSDEEP 384:ZXjVs7KxkXqKf/pUZNCgVLH2Hfgslps7pLuLcifzOXODV0+ErU3O2HG4YpPlG/:ZzVs7KxkXqKf/pUZNCgVLH2HfgsPs7p4
TLSH
T1D772F9676C4C9A770F94CACCD81A7B4FADB5024B65D9886483FA9C2A03D5ECF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 654b59fab66ccd34e8686d9c22119a2aa0547769791f18156c3f72c546bf4930
MD5 b620651fca93498509d3dc69684f1466
SHA1 a7d5e215510e6d71dbc3fd7cac058c4bdee94784
SHA512 77bd69f7943026e05b0bf46c66923dde35aaed1575f835b95ecd61952dfe3830a36baf2751392c1583f514ae36a03b90a198b7843aa8b6ee388edf9d4ba83188
SSDEEP 3072:1L+sXGOM/o+BuP1gRL/9m/C47U59JZ1U7++J3qUQm08KMWF0bFTcVHr6zI:1LNX4/tBuNsYUfJnU7++JjcMW2VcVLn
TLSH
T1CF14222DAD19ACF46663DEA4A10B0C574DE3C8EEEB44B13C31C66F4A365C3B1651B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 d70f3ae25aa0d616ddb5a755754158e038c053122ea1a7796083ee268bc7fc01
MD5 e641931d13b491092d753d6e4a681c82
SHA1 1ab17fa62dab58e58770f452ee427abfe72bb7b8
SHA512 b35b2310d7f43026e36b361651f325c8116180a5aad1f987dddbf632059ae87978af10cd6a44d19eeb2936111f4bf2711ac041531abfcee28dda670fc671f0b9
SSDEEP 3072:RK+sXGOM/o+BuP1gRL/9m/C47U59JZ1U7++J3qUQm08KMWF0bFTcVHr6zI:RKNX4/tBuNsYUfJnU7++JjcMW2VcVLn
TLSH
T15014123EAD1A6CF45AB38E58610B1C560CF3CAEBDB45A42C31C93F49365D371A91B426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 ecd7445c4d05ee54961478a3ab0dde42e754dfed88edbd9b3e94f989365a54a2
MD5 f2195f174d58f373cec723c01e1004ef
SHA1 c408bd5391b23ea1a7f636ddddf19e9ff8eb02c5
SHA512 3d522b7acd2b807421e6f944b51e35535e0734f818749985afbafdbed3a9d24f2fcde312215524fb7bd1fca6daf3ad887d250dac8f3841aeeda72d4a4f7c4f3a
SSDEEP 3072:CL+sXGOM/o+BuP1gRL/9m/C47U59JZ1U7++J3qUQm08KMWF0bFTcVHr6zI:CLNX4/tBuNsYUfJnU7++JjcMW2VcVLn
TLSH
T11A14222DAD19ACF46663DEA4A10B0C574DE3C8EEEB44B13C31C66F4A365C3B1651B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 1478d1b24627121ac73589f00b2cbf5ef23665f5dd0326a9565f9f5f6ea15157
MD5 0a080b227f9395a46443b304811af625
SHA1 69db7b4b204b8028517e742311a4a4bbb3144296
SHA512 a082fa9a856e71896bbe2f27d5794d4e78e37c47c831d4d1150a06191e1d2b80a1334eecd539c603f36e2c5db9b77f59c50e226811a25fa7bbb09193284c1b69
SSDEEP 1536:XpP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:h++J3qUQm08KMWF0bFTcVHr6zb
TLSH
T1279302B9991E7C79536BD696A0079DAC8CD3DCCE111451BC30C76F0E14BA3A3A31B8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 28KB
SHA256 0c00f2be17392a9dfdeb8ad532913083233e91c6dffd535d147992a4188a225b
MD5 2a2891817fb545e038f855158dc85587
SHA1 40f82eeb6ba712443b6952a61dd225e678ce5224
SHA512 ee49d1e5564039a95b54fdd9eed1e4fc5cf45415f342766fd3fc0b70c9095b3ecdba68baea3463ecb6bb40cc604dc7b34fd91f912bbc7302f2832a76ccb05e46
SSDEEP 192:HqF7ILgOk0K5neCXq81ptNOTzI/UvqTdpH:HPMOWneCFv8zI/FZ
TLSH
T160D2DA62F884D622DC092C72AFEBE5DC26317E25CD5E031339C5B73F99BB5C18928948
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c82f2726f8ce51fc0d84eb392397b748700470a79032acae4a60c63d1067edcb
MD5 782e4d43fee2487ad2471a9e11efb280
SHA1 17dc94ce4aa72d53aff8024409de3033cfa358f5
SHA512 d16f50a54a1a7c3c1babdc7b90e1b203cf74a18a8f922dcd12d337b31a8ec54a769f7749841116d43dab39bf93cf14acdc5da4a27a0e6127b803bf95f1712541
TLSH
T12421AB33B79CC135C8D9117A108CAD01B1B5C3C7449ECECB7B84C518A57F999DB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_fm2cdoad.0ob.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fm2cdoad.0ob.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Google Chrome (2).lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome (2).lnk
Size 2KB
SHA256 bcc4cea0329b8bb422a1afa78597118371a045743f49b70f8ec0a3b56cabfaa5
MD5 57be77817ed2680a8b0ccc24210a1e56
SHA1 02a4214159c25b3bf892918c991df29ff0953012
SHA512 0055b88f592f0ab4b5afeefdb6359c0cd7adab240185ba36b94e4bb10e7dbdc5b8b83927e5b4a0c0068ea2fb705cfe50bf1b197150aa35eadd6d2ceabdf6fc56
TLSH
T1A4418B0A7BFA175EF3E386326E733B710FBBF81792A45B1D5190428808A1914489CF77
MD5 SHA1 SHA512 TLSH

Submit Download

PEStub.dll

Path C:\Users\Admin\Videos\PEStub.dll
Size 59KB
SHA256 5aab76737f2d9f6e6d4d225b12e1123918306d86f1ba5e0f629f97fd3f9710d1
MD5 f2ce20254995e4bf4d3cfabdbc83bac6
SHA1 f66dcc83217684ab697d7b4fb9e0e7efe9857ee0
SHA512 15248c1631347d9544c6a24c0352f97842f2f6003d99b7e81ba37bf1f295dc28d9ed3dd790eb76e91ef681b6b889248ca1a179bb6b21a8b4bc34a121e666df02
SSDEEP 1536:MgPxVyuElaILcRe/XLcRe/ifgla76mQ36OhxwHKoMxxHX97VAzSVORg5:MgPxVyuElaILcRe/XLcRe/ifgla76mQT
TLSH
T1094361B2675C8D60D42A50350D0ABE8CC798F94BB73973F3109AA61646B59C1FBFD1C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Phosphoric.dll

Path C:\Users\Admin\Videos\Phosphoric.dll
Size 868KB
SHA256 bbbf9287cbac6a35d66cd0ac5744298a62b1934cbc8cf2292e3f1efd43ab22fa
MD5 fd08d3089294cd4a2615c03ee25e9860
SHA1 8adf7c1d71483d8d168c66df2c60ff12e4324dc6
SHA512 733ef480584ef4bc9e2128a9a4e72e13faf361e758faa27f93a194c1bbd58b822db9432a3e52922120c1d7c3e49642eb7fbbfaf4f983b3305a097c78833f37f7
SSDEEP 12288:SPUT7wHIS08djtFeDqP53oDfGV8KxFQLbWCe5w9:SYwoS08dj2qP53oDeqnY
TLSH
T1DC15D737253C41D5E5B99439A91A3E50FEE0BCDA0336BBB790E444871F26B90A5FDB02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PsPInjector.dll

Path C:\Users\Admin\Videos\PsPInjector.dll
Size 21KB
SHA256 dd93e8ae016728ffcfd0dde17e67768357f909d9b09e73919838b394960f1a8f
MD5 55b589afd3f824702cd484e0b7521a00
SHA1 aeaae629061a552b38dcfb805e3967dc223beab7
SHA512 71c933a19bce1a875a88bdb14dd7c19850a6f7f105130b79b1c360f1f7b70053f63db815bc56c2af37311686be478fb677ff4521fc06aaa9a9c96f82c254cbc1
SSDEEP 384:aLkOXUH9XtYPAYYleHSRg2d+Q/WQGrEujk:787y2DQ/WQGr7
TLSH
T184A24B4763B501ECE1B6E53ED6574623E1B830455324AEEF6BA1C6AA1F329C0B03E715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Symbiote.exe

Path C:\Users\Admin\Videos\Symbiote.exe
Size 781KB
SHA256 dd822836313f979e21c86489d4b2a95a68c258baccb3abdce736d298a2c7ad14
MD5 1cf9e78bbf12f12a633e10b889aba3db
SHA1 a18ee2e1bfa93d28bb9da056aff424b8c0984c08
SHA512 2b2a8582ae67073f8604ca84248dcc4bb00f0e5b98a29003ba7e6bf8e74b9eef07a6c4607775bead2322c1269f07eacad64663d5055b044a6cccaac010a74546
SSDEEP 12288:dT7wHIS08djtFeDqP53oDfGV8KxFQLbWCe5w:BwoS08dj2qP53oDeqnY
TLSH
T14C05C727243841D5F5B99439A91A3E50FEE1BCD90336BBBB90E404875F26B90A5FDF02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 17d500511ea2d82cec7d93f6770589626462fddd761a88ddefeda973552ad7ed
MD5 f2f7fdc41991faffcb2b63eb548d436b
SHA1 6540c0e8774f7fa00f82597c837cf704860815a8
SHA512 c54c7be074de4010130504ee6322062e63c081fe06017198c3aa4853087e142b909745b80d946c3a1d411919836fba242cfae3b8265e62b0a78f38d749373782
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 8KB
SHA256 a8a7095f399e36dabc2f02433c6ac561ed9cc2bc8e6700e4376801d5fba53781
MD5 7dc74b70fbebe0eb32484f444ebdb74b
SHA1 9cc3c91bf027b2457fc2898f1d325d348f93669a
SHA512 dbeca65df9b23bb6f9be5896d034fee4df3c0f88a2a6458302959652de8b035649dd61788fdee0a3a38e16829662267332a0ffea8a32ca00a33220493a0e5dc7
SSDEEP 192:Pn7QAbPTq3JJeAJPOLOOpsbI//AA1QMZZ1fiA28bqffORETesAftzttVRb+TRC8:Pn7QAbPTq3JJeAJPOLOOpsbI//AA1QMg
TLSH
T1FA12CED68E02486F3B82DF6B335335519EAB640BC7E894B277DB5202B4CA965012F1B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fb485201330a5ca14dc2d7a80ecf88b5c9e53d59929f9234c3ccf7548e2fe73f
MD5 d457c1f4bc93b922760f898f5ee33a51
SHA1 73b3a14397cddbaf0f61cf73df084973e2d781f1
SHA512 84f2942c741f0034f4c83cc58350d8c63e150b1bf02c2c65e07ee2f259dd5679b2e318faec233d2be6e5d4ce67ce7b56725dd4ab4a3186aef34d62da35bcff17
TLSH
T12D218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C518A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/240-416-0x00007FF7E5DA0000-0x00007FF7E6313000-memory.dmp

Download

memory/240-430-0x000002B7F7A80000-0x000002B7F7B23000-memory.dmp

Download

memory/240-393-0x0000000140000000-0x000000014025B000-memory.dmp

Download

memory/1640-477-0x00007FF71CBD0000-0x00007FF71D55A000-memory.dmp

Download

memory/1640-478-0x000001D3E9370000-0x000001D3E9413000-memory.dmp

Download

memory/2484-163-0x000002E0A2330000-0x000002E0A2342000-memory.dmp

Download

memory/2484-160-0x000002E0A1B80000-0x000002E0A232E000-memory.dmp

Download

memory/2668-168-0x000001C778600000-0x000001C778612000-memory.dmp

Download

memory/2668-169-0x000001C7788F0000-0x000001C77909E000-memory.dmp

Download

memory/2764-134-0x000001F999320000-0x000001F999326000-memory.dmp

Download

memory/2764-41-0x000001F999250000-0x000001F999303000-memory.dmp

Download

memory/2764-16-0x000001F9987C0000-0x000001F9987D0000-memory.dmp

Download

memory/2764-17-0x000001F9987C0000-0x000001F9987D0000-memory.dmp

Download

memory/2764-25-0x000001F9FE5A0000-0x000001F9FE5C2000-memory.dmp

Download

memory/2764-162-0x000001F998630000-0x000001F998642000-memory.dmp

Download

memory/2764-40-0x000001F999230000-0x000001F99924C000-memory.dmp

Download

memory/2764-43-0x000001F9FE460000-0x000001F9FE46A000-memory.dmp

Download

memory/2764-141-0x000001F9FE580000-0x000001F9FE58A000-memory.dmp

Download

memory/2764-161-0x000001F9987D0000-0x000001F998F7E000-memory.dmp

Download

memory/2764-133-0x000001F999310000-0x000001F999318000-memory.dmp

Download

memory/2764-82-0x000001F9FE5F0000-0x000001F9FE60A000-memory.dmp

Download

memory/2764-67-0x000001F9FE570000-0x000001F9FE57A000-memory.dmp

Download

memory/2764-51-0x000001F9FE5D0000-0x000001F9FE5EC000-memory.dmp

Download

memory/3132-42-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/3132-26-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Download

memory/4896-159-0x0000020EFD9E0000-0x0000020EFE18E000-memory.dmp

Download

memory/4896-164-0x0000020EE5490000-0x0000020EE54A2000-memory.dmp

Download

memory/5020-424-0x00000224CC280000-0x00000224CC323000-memory.dmp

Download

memory/5020-423-0x00007FF71CBD0000-0x00007FF71D55A000-memory.dmp

Download

memory/5020-257-0x0000000140000000-0x0000000140464000-memory.dmp

Download

memory/5020-0-0x0000000180000000-0x00000001800DD000-memory.dmp

Download

memory/5020-15-0x00007FF71CBD0000-0x00007FF71D55A000-memory.dmp

Download