afdc0ac6e00888a14604fda41f64cc7abf3cc2bfe3308dda72d65cd02ed38552

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/04/2026, 08:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Size 4.7MB
Sample260416-kjprfaev81
SHA256 afdc0ac6e00888a14604fda41f64cc7abf3cc2bfe3308dda72d65cd02ed38552
MD5 5c3c4fdebca0cf34d1265775a76b4c80
SHA1 46bdbcbac08d1987f68f988f0c3f658e2c8af7bf
SHA512 7bda6be0a7cdbc4942f1efa0bef27bfb6fad3100d142dd40d444a3f7b45a0286959a1adbd21ef64e69e88cb9f9ff160da12040f2b30b06a8a7065f4f543afd9b
SSDEEP 49152:k2AhLGp4btjMK3XAL8Njmbb/qedc+KokvY0n/sHQ4VD//IOSArTpYDOJj40NsHyi:GgpH3/qed+UsiC9EfJ4k
TLSH
T16B367C03F2E941D8F0AAE2789B765732EE72BC568B3065DF025036151E76EE05B3C762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
5668	alg.exe
2604	DiagnosticsHub.StandardCollector.Service.exe
5500	fxssvc.exe
1948	elevation_service.exe
1768	elevation_service.exe
684	maintenanceservice.exe
4200	msdtc.exe
3472	OSE.EXE
3416	PerceptionSimulationService.exe
5344	perfhost.exe
1252	locator.exe
3308	SensorDataService.exe
4892	snmptrap.exe
5340	spectrum.exe
2148	ssh-agent.exe
3064	TieringEngineService.exe
4572	AgentService.exe
4424	vds.exe
6100	vssvc.exe
2948	wbengine.exe
5560	WmiApSrv.exe
5108	SearchIndexer.exe
5704	chrmstp.exe
1456	chrmstp.exe
5424	chrmstp.exe
5884	chrmstp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\259aaf38b9e5d6ca.bin	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5312	chrome.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005243b16b7ccddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000038bf526a7ccddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000041ee836b7ccddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134208023131635524"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c283576a7ccddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000b144d6b7ccddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000874a1d6b7ccddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
1424	chrome.exe
1424	chrome.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
1424	chrome.exe
1424	chrome.exe
3112	chrome.exe
3112	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4820	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	2592	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeAuditPrivilege	5500	fxssvc.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeRestorePrivilege	3064	TieringEngineService.exe
Token: SeManageVolumePrivilege	3064	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4572	AgentService.exe
Token: SeBackupPrivilege	6100	vssvc.exe
Token: SeRestorePrivilege	6100	vssvc.exe
Token: SeAuditPrivilege	6100	vssvc.exe
Token: SeBackupPrivilege	2948	wbengine.exe
Token: SeRestorePrivilege	2948	wbengine.exe
Token: SeSecurityPrivilege	2948	wbengine.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: 33	5108	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5108	SearchIndexer.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
5424	chrmstp.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 2592	4820	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe	85
PID 4820 wrote to memory of 1424	4820	2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe	87
PID 1424 wrote to memory of 4612	1424	chrome.exe	88
PID 1424 wrote to memory of 5428	1424	chrome.exe	101
PID 1424 wrote to memory of 5312	1424	chrome.exe	102
PID 1424 wrote to memory of 5428	1424	chrome.exe	101
PID 1424 wrote to memory of 5068	1424	chrome.exe	104
PID 1424 wrote to memory of 5068	1424	chrome.exe	104
PID 1424 wrote to memory of 1408	1424	chrome.exe	105
PID 1424 wrote to memory of 3536	1424	chrome.exe	106
PID 1424 wrote to memory of 1408	1424	chrome.exe	105
PID 1424 wrote to memory of 3536	1424	chrome.exe	106
PID 1424 wrote to memory of 5624	1424	chrome.exe	107
PID 1424 wrote to memory of 5624	1424	chrome.exe	107
PID 1424 wrote to memory of 5780	1424	chrome.exe	110
PID 1424 wrote to memory of 5780	1424	chrome.exe	110
PID 5108 wrote to memory of 4980	5108	SearchIndexer.exe	122
PID 1424 wrote to memory of 3372	1424	chrome.exe	140
PID 5108 wrote to memory of 4092	5108	SearchIndexer.exe	124
PID 1424 wrote to memory of 5704	1424	chrome.exe	126
PID 5704 wrote to memory of 1456	5704	chrmstp.exe	127
PID 5704 wrote to memory of 5424	5704	chrmstp.exe	128
PID 5424 wrote to memory of 5884	5424	chrmstp.exe	129
PID 1424 wrote to memory of 4152	1424	chrome.exe	146
PID 1424 wrote to memory of 5744	1424	chrome.exe	147
PID 1424 wrote to memory of 5936	1424	chrome.exe	148
PID 1424 wrote to memory of 3112	1424	chrome.exe	151

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Users\Admin\AppData\Local\Temp\2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
  C:\Users\Admin\AppData\Local\Temp\2026-04-16_5c3c4fdebca0cf34d1265775a76b4c80_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=128.0.6613.114 --initial-client-data=0x2c0,0x2c4,0x2c8,0x294,0x2cc,0x1403946b8,0x1403946c4,0x1403946d0
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ff80bfac728,0x7ff80bfac734,0x7ff80bfac740
    3⤵
    PID:4612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,6061862147002659928,10222609920242726975,262144 --field-trial-handle=1964,i,12993891987112170936,2021842988481474009,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1960 /prefetch:2
    3⤵
    PID:5428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1600,i,4327914839749532372,5800041122304386780,524288 --field-trial-handle=1964,i,12993891987112170936,2021842988481474009,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2156 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,6374814851374957952,1284072952316095515,524288 --field-trial-handle=1964,i,12993891987112170936,2021842988481474009,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2516 /prefetch:8
    3⤵
    PID:5068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,11772837835537777719,1338701376532251739,2097152 --field-trial-handle=1964,i,12993891987112170936,2021842988481474009,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:1408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,13230337086489768824,16659642069342253369,2097152 --field-trial-handle=1964,i,12993891987112170936,2021842988481474009,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:3536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4380,i,2814091151353376006,15098158241176733167,2097152 --field-trial-handle=1964,i,12993891987112170936,2021842988481474009,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4388 /prefetch:2
    3⤵
    PID:5624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4676,i,12383414339545151572,7724930534255918930,2097152 --field-trial-handle=1964,i,12993891987112170936,2021842988481474009,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4708 /prefetch:1
    3⤵
    PID:5780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,9610355021240317227,7087369792793046266,524288 --field-trial-handle=1964,i,12993891987112170936,2021842988481474009,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5472 /prefetch:8
    3⤵
    PID:3372
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5704
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x250,0x2d4,0x248,0x2a0,0x2a4,0x1405755a0,0x1405755ac,0x1405755b8
      4⤵
      Executes dropped EXE
      PID:1456
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5424
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x29c,0x2c8,0x2cc,0x298,0x2d0,0x1405755a0,0x1405755ac,0x1405755b8
        5⤵
        Executes dropped EXE
        
        PID:5884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4360,i,11838141368585538142,10339152926164674248,524288 --field-trial-handle=1964,i,12993891987112170936,2021842988481474009,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5964 /prefetch:8
    3⤵
    PID:4152
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,13324258109281673091,9268198698644712017,524288 --field-trial-handle=1964,i,12993891987112170936,2021842988481474009,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5988 /prefetch:8
    3⤵
    PID:5744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5972,i,7334209089285443014,1069229125909222469,524288 --field-trial-handle=1964,i,12993891987112170936,2021842988481474009,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6012 /prefetch:8
    3⤵
    PID:5936
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5432,i,6690902211641798874,5525901667296686506,262144 --field-trial-handle=1964,i,12993891987112170936,2021842988481474009,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6112 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3112

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5668

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1384

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5500

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1768

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:684

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4200

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3472

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3416

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5344

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1252

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3308

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4892

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5340

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2836

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3064

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4572

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4424

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6100

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2948

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5560

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4980
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:3372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7c1e6929007a449674ca626b1198820164c57f0f135e30568692d555f17aa096
MD5 93f056b82b3ab3ea81fb344846637434
SHA1 3ff82242289365580c22168095756219e0e0080e
SHA512 140232cccf19da6901d0d362caaded7bb9ca3245c15d644bd7cbbcbbac5251aced4b19c9f7b679c99caa5575e063b790a843dad9a6e559d67419646355c1f3ca
SSDEEP 49152:Xb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnofJ4klKXnR:F3q6HjB7fJ4k
TLSH
T1C8D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 31f7e7abf9b2548b98a964dad11d19b95a368ffc51b0966ff7d0753cf0db4bf7
MD5 24914fbed6c6606d9fe1aee7ebb47c65
SHA1 732c5b55d1282f0ca4c73870d1b5905798cf5ea4
SHA512 960e9c98e0a12992c1adf97a4535d8c847efa50edcc74ce5e6f2287ec0c769e220dfbdbcb40f8115178481c178007190acfab30e1c46c9f8301a6eaabd9ec56d
SSDEEP 12288:c1XLsswWkxy2lRq2czA3fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sx:qXYfDtczA3fJ4yL/tNCJPXUQrPy
TLSH
T18805F12973E008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 47d622571578e271ea4dd2fcd34328ae6b5a8703d1e13538c3d10b090d65c788
MD5 8a1a58beb168861f0f6eefdc7612c164
SHA1 5881da709c1973bec39bc1b0e8ffbb25d97ed5dd
SHA512 bf40bcac31b281db3d69c25d4f0be2dd07e22b57554d978adc7c6a71be39e55fccbd7d07e2b6e8d0410d6778a84ea9a0567d11d9e38b9d1a4d8c62a9e73a2519
SSDEEP 24576:g0Le5ji0hmxirMQfJ4yL/tNCJPXUQrPo:gPji0AcRfJ4klKXnA
TLSH
T19235AE66F5748335D073C0B9C5D2A68AEA71308617308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8c77cfaa7a885ec251c15ae9b4ce3c3751de1612ff75ccc24802b257eacf8316
MD5 512ae938f7dc9a455eeda8b6b7631e7a
SHA1 ff40221a142d2f952c603ed353282ea8d79dddbb
SHA512 a1575c7ac7798026eeb8c0f25d0a619b7a0e7c78c6623b7d0c30343457357866f641e41279aa1c309f2fd40c1e314c0c9afe30da060d95ff1898af412fa829a0
SSDEEP 24576:ra7/ezSC6vUyD/aqgrvWE6q8wyuOfJ4yL/tNCJPXUQrPH:G/ezSC6vUzPvxHjy9fJ4klKXn/
TLSH
T1E1756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 979e2dc60d05b3f8e75e008b31782f00f10544e15a24d1d11c64363b68373059
MD5 92962ec7af8eeafb2734011df8fbbb0a
SHA1 b2a00218081093bd7ca93188aca6c3ee6e6a9a3c
SHA512 ecdee12985cb1736697d947c642e39b83a74ba2f896607b7c74f0db01260874a3e6ea02f677d2d9b833766712722e1cc4a1183fa2d953d60193b11da424ccfdd
SSDEEP 24576:rVbqPb88hv/l+6LfJ4yL/tNCJPXUQrPE:rVO88hXl+8fJ4klKXns
TLSH
T153559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 e423bd708ff7da5dd798e5eb1a480a131f76e9827d72f2336390510f216a3f8e
MD5 ec1475074b377ad2b1113d42b5442230
SHA1 58f18d2e4bdbd9e5ecdf548a726583659c707917
SHA512 a3774670481b23b57cbf73b1ede033f9d33a0017565eda135a7c92933e2e866f259add1da181d458ae9df90e5ec707f739e08e18b530facf691c3680980e09be
SSDEEP 12288:rRUfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SE:rRUfJ4yL/tNCJPXUQrPL
TLSH
T1D1C423E751849486DF6687F82A8CF001C304BEC5162FA2F6DE82B8857FFC91A559C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 74dd2e29326288f2233d07238597473d2045833aa93e9b3902ec9f636981e407
MD5 fc867b774be01c76e77314e453b4e17f
SHA1 a29f1b14a09909e40ea648c7c97b5e02401c1fc5
SHA512 d6edd681813b37f7e8de95f502cfdcbb2f1967d4b42b50a9033ecc9a1fe590013b3f96b9983f6b6cd2f31917fe676f0b7ae08486fb1f5e86792cd3be7cc8a298
SSDEEP 12288:/eBNUbTVO86UzfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7St:/JIUzfJ4yL/tNCJPXUQrPW
TLSH
T19B05C07BAE28FCD2C67A8DB85B90C200D77278704B22A3CBD165C20EDE275E51D79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 06084ecf843ab67a9444a2d6965113d9ee1a859ca290a3ad1e0b90749c0afd0a
MD5 c694d7aeafa6c4bbea2e10af391a5a56
SHA1 ce955fb211fdbd6785ec40dfd02d28be1cd95109
SHA512 794a337ae1a20960062d38248c04f711809cc93cdae2093ad1f24c7a57626d9c41e44b8dbea0aa86af9beca7b9f83657279f5c7ed1e5d4b30d541e713b6f5325
SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THI:8QvGAdlCEL8c/yRNw5CefJ4k
TLSH
T1C2266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 89300d5b041feac903d09410b508c606d257264ebff97b9a4a6008c2efb9bf11
MD5 d57e2eaca8b8b6ed5abc008a7a435850
SHA1 634b25751abffc4ef35fcd3870981167b600f375
SHA512 8cced70e085bb6bad7cedd42ba82fe4a2320a775639b614665a568c4cc4e9f91a34f57b85dfd184765400ffd13a64f6dc49c3430b231d2cbec0185af21a2d35d
SSDEEP 12288:rAwSfxL/2Dc34DLLmt0LDQewsAjhfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yWs:UdewsAjhfJ4yL/tNCJPXUQrPK
TLSH
T16F15E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7c4c695cb506885a87e6f66e01653a55109f23288f1f1d0dd34e2ef5fc4c0f54
MD5 b5ef353845fed2caa8cf775dfe4cb044
SHA1 ca7c4d9325e6e999d3dd98087f4413cf4ccd7658
SHA512 e1cb971cc0fd24a92146923cc5b7d48c1ef12cd70e5aad4615876e5801457a1e3a25ffc41141fa5e81f0f4019ba5e7f8049a879ceb4d7426a241b0c4d6a0574e
SSDEEP 196608:aUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHZfJ4:aUEtQevvqc2W1cpV2EI32Z
TLSH
T1C6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 bfaafdd2c91febff60b1ca6ffc8597a24140934d21a67a0054491be8d360f5ac
MD5 162a8152657d57c09e2cf9eeb75b2b93
SHA1 a1f2d873f0894912cad6da9fa248d92eecb8cc51
SHA512 1611c946138384b183d50a69b80c9dd423e6fb0e98a41cbe32e88c1e4b86675c5dc2bd44d30a8e6844fa53f09ea8a084157da97cf16198265c8e74f4718b957f
SSDEEP 49152:QCbRquA/m2yL5zifFiV+XenmE3/zBfJ4klKXnP:5oqHVjnmKfJ4k
TLSH
T1B0D58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1812f0ae3f7bfbdd33e886bbd14d430b6d3b41f251803462f664ae4b20ecd823
MD5 bb2e4e1588fe868df4b5aaa103f1710a
SHA1 f222154b3c7e1b081c6ba935cb0dc1db4596555a
SHA512 7f2577bb92d7c41863ac1e6035854ec000c718f71437de7a05450dabf36fbeb144e26b383b38117b284d7f6f6242d9691d6c9ce8ca7f77cf1246b1e8170f6693
SSDEEP 24576:kAhGLJIFoiwtA5l7S53qfJ4yL/tNCJPXUQrPz:kAMyFoiq5afJ4klKXnL
TLSH
T19D359D81E7F955D4F5B3AAB899B69170EA76BCAA5E31C20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 8e75e41cacef86b18b62291349c55669d67970c32cf919e9545601b92731f922
MD5 60269b0561ec3b619bbe5de7fa5a7e23
SHA1 bc20ccc11f935c0de82d2608f42837bab6b4600b
SHA512 ab63e2ecf5fdab7d7570095165e739754bee3e86265013b309771b9e2705048f0188a2815aa00b2cfe524ba510b59732d856e444b367b519032c5ecf1f47e7ff
SSDEEP 12288:omw5HEjsChNVBFgl0WDm+CufJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTK:FwuoOWdfJ4yL/tNCJPXUQrPm
TLSH
T11005F14A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 17643df7b6e9972fe177c81b0f7cfb0d9c056802d79a7b4d8e7943b3bc354a60
MD5 f9a0dc28bf46b13ff9871edc5b741886
SHA1 8719abe424fcecbf10651ed8f9d7890a76165d69
SHA512 62ec0cc211d03a253a1abe32c80ad1fad5a9d41a33d2195a901abacf3394a4be58f985840519907c5ddcc7488e96f92e8a3a41814ed5091a7bde78d1ed06b6b1
SSDEEP 12288:MBZ1IyxfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S5:aZu4fJ4yL/tNCJPXUQrPW
TLSH
T101E4129B32D460F9DAA782BC8AD4D101D3317C92233A53CF5A5195963FBBAC61D3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 399a99fe14caea485ebe5e46b0b0c247e4577cdd59658a180244dc56589422ce
MD5 bea26b4084d7025d9e0cf466778914d7
SHA1 e8022aa0b789ecf929ee53d67a04d66653b0f501
SHA512 229d3cdfe1dbd15b346460df8c4c7b354cef223f7c44ef43c1984d3635b15f29b6066268bfd0d4bf513f27ccb75384f00be97aeb49fa57020d7c3c3114586a20
MD5 SHA1 SHA512

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 cd02e0c13ac5d34825b73d8fcdb68e263e4c54d79a9e2c21ddc68be6a678aa29
MD5 3a2d1827432fdcf211954c70b1f1f9b6
SHA1 6615d2e41a29af3d8b5e94359acc522368a8bac6
SHA512 4e9e8f48fb414f4c2cce017c9e54cff477fb2ef646e4565c1718e958ad294d618f1a9740ee2e4da4d90879c1e710506d1353eaa407c05c691f85423aecc39077
SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uw:2QRQyi36YOcPQLvw2gAf+PN3ffJ4k
TLSH
T13B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3a92ee410f5c2941281ae3589a9dd41c64b62a625ba3eda4d3f2f9280fa07f24
MD5 7526b3605ee59bd08216f465a5768456
SHA1 24f40303a3cb463e4f7b2803e7e1dde5a67a8d5e
SHA512 7928eb2e6d87f19e40d97cad051cfc0f74b72e09f283c46d870187dfc193bd98a593efe563a9ac71b50f137d31faf35301c8baaca0199bec1151790285bf24e1
SSDEEP 49152:uB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glnfJ4klKXnS:8u6JmVxd2dnfJ4k
TLSH
T184D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5424_13420802311639293.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5424_13420802311639293.pma
Size 696B
SHA256 da9a8ae0c04da6ceae900796a026f4777895bf149eed2c495fbdae098362f596
MD5 3f5af086a83b749aa34a3aac1b986a0a
SHA1 0e67e17122beec914722d98cef0e669541560ff3
SHA512 0a12749b3971d0023cc1dd4f87113c94cc2c961ef824009c89a32ba24fe51de83357bb0757af7612ffb3a638302f5a298a2fc823dec8d117cf27255d2996191b
TLSH
T153010E49A3144F77CC828D3584FE27412BB0FA501B821BBF7B10724F2E021C9AED9168
MD5 SHA1 SHA512 TLSH

Submit Download

5704_13420802311801819.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5704_13420802311801819.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 1557d3173dce737d69723dc8e421b20cf3c5376c677e9540eb469ab20904b422
MD5 98e526900724c28546c154729cadb431
SHA1 e76fdb64759d4bc0f560f18277f27d60df43debc
SHA512 7f40f0622d8007b4c31b0b4764dfda9eba21c9b98d25fa02132d51f5bfe48003e9a6bb215f289854a560e5874d8600bb6c08b9ccd52e66065a968d82783006d6
SSDEEP 24576:PcP4mcvIjkGOxhKP2l71SNKbrh/8KBAfJ4yL/tNCJPXUQrPE:EP4m4IpOO67N8KefJ4klKXnM
TLSH
T1C665AE2DA7DC0096D0BB917886658A49FAB1742A2F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 7KB
SHA256 5516e7f85231b6f087b9f609007a113bb8400cb3560f8d1cf68e5dd3d096e390
MD5 b0f930a11f6073d07ae8323bbf0cbb58
SHA1 791317d6b460272863688cdba4f8e3cfeba07f90
SHA512 c664f850a0fa1cc74db42fcc3d19f4bdb2282d61298fa4983c28e756f3a4c9c73585267bd41e12856cd563c05547da7e7bb8b8bbe31019b815e048bcd3db5689
SSDEEP 96:Q5aKe0LOzlkoN5hK3yK37zsVz8bckehK2RK24GUOE2sj8:frfz9JC0zrnCosj8
TLSH
T1AAF190D69E024C6F3B82DB6B336326546D57640BC7F895B237FB5107B4CAA64001F2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 9KB
SHA256 643c62bd1d512a099d4a52514380807df2c25b693a24c6f6c0726dedf6ae50b3
MD5 38217a4e7b4f1cb65c961e0d1fb2de42
SHA1 d55857858c34d56ce2b8e445d0bb0810f52220b3
SHA512 d078ebd0942acfd872a18c66db34c755170f8eca5ffa4d9a538c323d20048d62a45c9810cf4b83814c498171ecd06fbab57ffa87a10a767b55efe15b80f31657
SSDEEP 96:Q5aKe0LOzlkoN5hK3yK37zsVz8bckehK2RK24GUOE2sjg10lNhK3sK3lR0:frfz9JC0zrnCosjLjYS
TLSH
T1B212AED59F024CAF3B82DB2B335326616D57640BC7E855B237FF5106B4CAA68001F6B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 232e203e466db43a7421a3ef94a06ec687029d0a0c24c82e718de22511a118b7
MD5 a75d4cf544cc27995b4f3eb7571c94a0
SHA1 e39860afa38fc626350e955d8183e60454944651
SHA512 4abc378891054cf365a9a5df0b08135667598d1cf7979757ffb32256671626fe63913a545a4887a54424344d1cdb5f1a1ff6909ed580eeececc2a5eb6a583e2a
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6a97c54c7dfb8121533a3b5ff17c6c17d411596007d438d38c35eabaeb90eab2
MD5 ab09c494adabc23b8252bf6319ba240f
SHA1 28b5a61aa027500952e0976197acc681d00752c8
SHA512 cfb17aa2580ca0a61f3166c4129878a54cd88eb6dc0902bd0456260db96ae76fcd85273ec8daf4b7d33ae59106137f189e0b414fa548c1e2c1006e91220b58f4
TLSH
T10EE02BABC952EC2708FD176860544705EF2017173B51550B7B3C860D8FF163B458286C
MD5 SHA1 SHA512 TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 86866fc86c587fdabc6c6bc494bde084aafce1653b5a2d0ae3f6e9c167d0064f
MD5 3e0be23c11bb83d5a7b2dc36408bdf5a
SHA1 8a6f12b94cdce86ce3f58c81e632d49dccac78fc
SHA512 73651f24c5079a8a4e446571b310efb48d800d959b12de52d96f6df33c30de7e6576a5fa82f9d5721c2c70b14eefa561b070b430a73016671bde047d1ac45fce
TLSH
T198519DF793E4896D851192F49A10AE1FDE7D0A24532C7C62C9D8AF0B53F2872E21135E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 d1e804886b3056414c55f489c5c6dc41e7035dcbaa5409885af248e4b8696adc
MD5 41ebc17d2d8de49acd0d0f969581598c
SHA1 f0e68135c2f6921973a048ebbe759e5125de5513
SHA512 a66ff475595fe459776068d0f2cfb4930405abbed235e2d250e48b36b22c3bdeba6d118e8c1223d70d5c965b071f8fbef77b93b1fcbb0477eba370a296a4344a
SSDEEP 192:NR6TY7rwEkv7m1i9PRp2fXsb+WNnS42jqK2yYgbiyIsnAUgtaJ:NR6T+AlXAXwZ2jR2y88
TLSH
T11E32C72EE918A53B9CDBD22AFA727763DBF1102135942E84D6FC962C24D79CC2217437
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 86fd5d33893cff8b4a4e1d363d304e1babdf59211c3558621321ca40a9e1d0e1
MD5 a8ca979b7d85d655bb6c1ea1a7c38fd8
SHA1 79be0ac8f36cf63cfccc4a6e5f8c2b7bc92bc3a5
SHA512 69cac8d11e1134aef64c45673b6f581990a915d62f957346ec703f0a48a96e513823298f20386e53fc59e317dc3c3f5a0a6a9b75e8bc1b6900fd4dad1ba86a94
SSDEEP 192:NR6TY7rwEkv7m1iXPRpgfXsb+WNnS42bK2yYgBiyIsnAUgraJ:NR6T+A/XGXwZ2e2y2e
TLSH
T15D42E72EE914693B9CDBD22AF9727763DBF1102135942E84D6FC9A2C24E79CC2217437
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe586721.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe586721.TMP
Size 3KB
SHA256 2dcf441eae56d9fb2add77111d1da53e04a2fdd30cfd71ce23a8b7675b14188f
MD5 80c108046198713cb3016a8a18e836de
SHA1 b612d9f9ebaa6630e928f0ec54e589fc3d3c8b3f
SHA512 759b331b7ba06331b0ac133f07b6abca2f3040774b162f27f78eb09900dbdd772447a09e0f3d19f02826d7fa57b890ad2c5193714b3ccd706b7a031fa381b01d
TLSH
T1196171ADD0E50CB70DF37B76A43A0782FA55827B10400C263E3F818C4FB66279185F5A
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 56a1e8c00cba78461b814b7af7b99a3de58a4329a7a44475b23e4150677716ca
MD5 6932e737f9fb5bb798f741f34796b7e1
SHA1 58bd5e6597f4a5801de9e176eca39fb244cddab8
SHA512 6e0d027f757f85c0e73419b5d0cc63c8778e317595fc91efbb163ddebee9c4ad7ab8467ebddc43b66b02293c61347fd81b0b3e241e6794b5bc99b05d775c9885
SSDEEP 384:y4jGR7KxkXqKf/pUZNCgVLH2Hfgslyi7pLuLcifIpXODGJ+ErU3DcHG8akl78fPY:yMGR7KxkXqKf/pUZNCgVLH2Hfgswi7pz
TLSH
T1FC720AA76C4C997B0F94CACCC8177F4FADB5015B65E9886493FB582603D8BCB11091EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 528968707071ccc6d6729865e4717d3fce196c92c6dce7db26bc6928cb4087b2
MD5 47bf63e23c5cebd480ea709ad70ea0a5
SHA1 500380b258a1cdce420acf697b08e78c3da19538
SHA512 ebd03b6c0e73857f2f57ebe9551d9fc900bfd7511826e373be764fa4206202ac6ac02a28e2fc4e3610c7d12cecc69826a96e90f1e38170e12d2d52efaebf2ec7
TLSH
T1A8B0122080019501C0A303B026920CC831A49F24C709130193F079B5DC2B5A14215260
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58af46.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58af46.TMP
Size 96B
SHA256 d30fb54ddbe5684a7758ee9c4b6d5ae8c8074efdf50127cc2ce47011fe616556
MD5 3d7cc16d1f6f5462e56cc342bede91c5
SHA1 67cb10884f322c1101e7c737e8207112c208a3a8
SHA512 714a981eb7e44cc6acaa1817a027026f993549f6f9fc6f5dac8ab38bec4305cf9d5eb489c66a0c361129e44becfdb2cddb846693db8a330bc74e4b1a5e705b9f
TLSH
T114B0223CC003E232C80303F02880A0C830F0CF22C2030202A2E00E23CC203300020030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 6c28db81b4102689058881b67687341ec1503dd880310cc9dab748026c1709c6
MD5 f2cd23473eb8a7b8b9dc1a1ee9d87454
SHA1 83fb693129a0eb05ddf379f931dbc9da547905ae
SHA512 9c3f07a3eb534d1cee0cd9a1695e7dc67ee630aa1269a0924bf549536baab88057bb6438f4797efda60247d5951b634d7cf7c5f6049657e875c899bad6febafd
SSDEEP 6144:0GmDPKv8yZ7XpYOiL40rOk0HOGm/SFyEEH:0ZOrYOiL40rOjuGdF2H
TLSH
T1511412F6DA15095785FD2BD0B98EB20E8CB2634B71ADB94C311C26CD27C92464BB3E71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 c3b170a54c3fdda6c4c543a3e4af236a644259ffa7394a06fbf403d91519c7ec
MD5 f19deeb6353ff7f4bf8de7eda2d29a01
SHA1 06a22e81cd8949f3392f63ba53a2cbd865f66a77
SHA512 435ebca610200854cbae38ace93e79c3e793d13bcc503167edceb85e4af945ebc4c86057fc14c4ace0a8c33d8608bc2b7233b2c0bc7e6a8ca47827040310fddf
SSDEEP 1536:0cCXcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Yj:0b3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1119302BA9E2646E7957E468176AE780CCE23130D709FA9CC319C639D21D41C92B72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 7db269a90111fdd2c564b4abcf6bcf9e7b7cf82b6121eb00e070d22e70d4a720
MD5 81ba005b8799f16ed3a20a40782f5496
SHA1 d3a6bb79b01d45a07ad7d7f5198e65ca40334968
SHA512 f1c908752b750ab444c86b6c966e133ec32491944cb82cfe3ec2307d527581c7350e1544c971a0a0c2eeded4b8ea5a5aa839986803791369cb6e0d12e6a65407
SSDEEP 6144:09DPKv8yZ7XpYOiL40rOk0HOGm/SFyEEH:09OrYOiL40rOjuGdF2H
TLSH
T1621412E6DB15495795BD67D0B9CEB20E8CA2134A30AEB94C321C17DE27D428717B3E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf541fbd-79b2-4056-a73d-6a59efca191f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\cf541fbd-79b2-4056-a73d-6a59efca191f.tmp
Size 193KB
SHA256 4fd5b3392be610a95d4e608e83a48d5a5dfb70de4ed44465d51812c754c87876
MD5 2fccee2ba2527a52943797a50d43372c
SHA1 974ea4eb87eaf1a5f86e01479f48b8d24e1d2e08
SHA512 d5e5c0b876734d54ff48c518349c406e1d2a6fa9abe61131fad06a543b8c6cbfa69ff178eb9d9db84c392248daa717b83b99656f586c6cdba5b52ac38bf6ef10
SSDEEP 6144:0CDPKv8yZ7XpYOiL40rOk0HOGm/SFyEEH:0COrYOiL40rOjuGdF2H
TLSH
T1801412E6DB15495795BD27D0B9CEB20E8CA2134A30AEB94C325C16DE27D428717B3E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

259aaf38b9e5d6ca.bin

Path C:\Users\Admin\AppData\Roaming\259aaf38b9e5d6ca.bin
Size 12KB
SHA256 b67f141688554374468e88c2d24aaceb6ceefe174ee230b29ad0f007a88b4b04
MD5 440a1e95f385a436c918d035343d1410
SHA1 d6e9384cb6770d10edf6dcc41a82628533b07db0
SHA512 e8150de521f204ed00667e0b956ecd513635da836dc4204e95407937dd668a1fc7ade996a42fa9e7e642e7460087a6f573cc43adb30648f56537332678f77754
SSDEEP 384:Jdol/858diD9hqZcz2Df4qPw7N/EnJC8P+3xad:ol/8adifZz2Df5PwJ/wJC2o0
TLSH
T17E42AFEF111DE8C4074D9AFD492ACDB2010D6776012569FBB7ED001E0A59E3FEB82B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 54970dc6f67ae262145e709149416b7ac15ee772b5454d9240592a787118012f
MD5 7389fe31633eb4c1356ef8b015650d69
SHA1 7510953126fa5e42c13319c70211df04a92fb7f1
SHA512 3157ad2f26a29ed6fac09428fe4d404da07100d4f695b48f8d6f5b2a521b9f554ee23ff7d98e29f597921dad9a793e538cc70ebb6099d1a3bab194602535b759
SSDEEP 12288:4YfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SX:4YfJ4yL/tNCJPXUQrP8
TLSH
T1D3D423A761D8D44AEE7687F81648E00093097FD56B2B92E7EE42B4853FFC9161DAC313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 808961b629a6a493bcfb41b53ed23c2243d736c3f6f4b07da095eea7ab74fe25
MD5 b615f9341784e2f68040bdb1e3127f58
SHA1 3ae8d619fec1dbb3dc620284c0c3e630b4569f24
SHA512 2368f9c318ac30e666edd4748837f7c8e09d55421c698aebc262006c50f5e3b873f6ebef282fc5b3e3423e527dcfac6cb60eff813b1decccd7ac2f977b24ece1
SSDEEP 49152:Ra0h2GEkuAe73q3pp46zwwQCfJ4klKXnQ:Ra0hNYG4JwZfJ4k
TLSH
T181859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 839430186c6d17d2f8dc7d0a52c6ffb3ec5283a9e35cf17ca97c07f3ab667eac
MD5 7a06bcbc4a4fe9c88f48347a02547d1b
SHA1 132218c56b685acca1092dad2853f8362db21c75
SHA512 0862939ecd7d99497ef47a9ad5c0cbe1ac858bf67875510deaf3c48f676f9db7d4bdb0fb7130aa1e37f2df385b2ac86fb427fd6804eb0e78b7e4ec837aed045b
SSDEEP 12288:lhbHjfXlfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Su:lhbHjPlfJ4yL/tNCJPXUQrP5
TLSH
T140E402BE22AC20D9E571D2BC4684D106C331BC951726A3EF57C2917A2F7BEE51C38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 0ee59bee8760b067ef695ad62c14e3b4967a21a2fdb37e97851dcbe9692f049f
MD5 4d28bf19a59d752e33d19caefef83218
SHA1 2d4176f9614d9b437554c21375317ece9f296c81
SHA512 dbf2ea4d177466ffba2479ed99676e7f63f209df4e07c997fa41fe025a5f16859cb7a13f129f79bcad738bb6515ac4d93fe85c4db301186bb4684eeab5b15162
SSDEEP 24576:S3YgnJcRTk4yti+R5dpR/dfJ4yL/tNCJPXUQrPd:SIgnaTk46ppR/dfJ4klKXnV
TLSH
T1A345B02EF2B910B9D8A6D236450143B5FB71782D1F2196CB0170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 90b3ec1116b17fe7eebd7999e9cf5266ad07b90c001e69d574c366bc7fc409b8
MD5 353e836729ef7699c4ce7e0fe4f09a27
SHA1 24f66c8742b0350a83bac8eecc90644fde7c5b78
SHA512 6ded81a852765f43b0f5273ef126546bd439cb0e6778045522fb5fb70c25af7f710b46870734b925bba4168fb5a9eb3e3706bd7ab4ef0055e125fdd135ce1ef5
SSDEEP 12288:V0fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S3g:V0fJ4yL/tNCJPXUQrPz
TLSH
T12CC423AB6085948ACE6587F81648E001D3047FC5272F62F7ED82B8857FFD99B15BC392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 48da71334c849fa64fbae175b426ba72ff6941e33c5c8ffe6b8d1d4f1a48cbd6
MD5 ca0ae875e814dad9043b5d4a9cec95a9
SHA1 4604f4a4d45c5c79a2e7cbaa93261115676f1915
SHA512 0abbba9bec18c122a7b293295256c48cbb36d193fdd035dc3134413ebb5d6f484f69782bc903cef1370c15bb1138bfa35314b002364193d9a0ffb9d9ccfea409
SSDEEP 12288:7Ob9A4LWOsvAYFT3fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:EpL3UT3fJ4yL/tNCJPXUQrPV
TLSH
T11025F155F29400F9ED6BC27C89A6D512D372B89D0324E3EF07A88A552F637E24E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 99d86805417e4b7a0f5a3aae0f2c86af0491e349ac8a3d6de98082b80ae772c8
MD5 993532e78967bd164a89f84deedc0fa7
SHA1 5988fbefeb0e92c5c0d9f3bab21d0467363bf7c5
SHA512 2dda178833f123252c961125494dfc210e445cec0e539a6c2f81539a46e09e782209c9c34a032bafb7d514fa010948614e8878ef1425230cccde8d7fa80c450b
SSDEEP 12288:kpFtpOTfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SV:OOTfJ4yL/tNCJPXUQrPu
TLSH
T1B7E4026A32EC10E5D576927C4A85D209D331BCA6172753EF46D080AE2FF7EE82C39761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4969dbdabbfd34a85b45d7f71b4db7b894f17ac48bce763653b466b5514caf94
MD5 f7b23b4cc68fa288174454970cd85a29
SHA1 333ed0f9c230e64cda839e5aabea0a62f705efa0
SHA512 f56fd42241b9eaced691c4f17f52b82c4b5df91ffe628cbc46192fe6dc32477d171a6e7a4e4620010eee76db55df9604b0741ee3ba76d1505660006b466b14de
SSDEEP 24576:I7NM9YmZqmWMUkPjZM48Mv6bEhsIfJ4yL/tNCJPXUQrPi:I7cBWMpPjN8DbEhFfJ4klKXnK
TLSH
T1E765AE2E6BEC81E5D477D13DC9A28205F2B2B4611B318ACB5152833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 cd238dfaaab2621c6caaa1aea38c612682f9777e732658e50d210ec2b1ecae8b
MD5 d43f12bf2585281d4e4a3c801c766d40
SHA1 d65c6db08a741335a2a85819d8065ed846c9f5f9
SHA512 73947c856e8c33202923d06fc9a15ebf10d171c8fa73ef2baa0061e7bf99ac7adf0c42196858f7db162b2e1e8e7c185030281648ec01623d567c19bc28e88963
SSDEEP 24576:cW6BApg2YuyuNDYTabvcRvNYf8km1mfJ4yL/tNCJPXUQrPh:cF2YuHNETovcvNYf8kmofJ4klKXnZ
TLSH
T1F1858E6A27ED80A4E0BBD2BD45B6D146FAB2B8511B3056CF0255862E1F33AF44D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 7de04d3e71f4b9d71fb26c935f8d94f99af1ce497ea7709a4650c051f7fb419e
MD5 b94a76107f72f7792b65dbe1261063bd
SHA1 fb779d63ba828f190ee6beff62df938e4193658b
SHA512 94bcc166a6106f10718933106ffe4cbf88cb73aca0bf2fda11d0c42075406bce19df9ed2f0e48abc0bcee920397702d568d4d90bd295995a47c06e8a48b1cce7
SSDEEP 24576:JAFs06+Omlf3NXEbTo/fJ4yL/tNCJPXUQrPD:OFs060lVXuifJ4klKXn7
TLSH
T1E865AF2F62EC00D5D07ED17D8A96C91AF7B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 31c341bfd2a61174abba95414eacff0e49a4f07ec8772dde3b28b41d241af2a0
MD5 8ff2d5ad7851b7b4dc5142096a112f88
SHA1 bde6606d097e2d53350d4ffc1e95e175badd5ce9
SHA512 96c29968c8b52b245e731cb4032a71090576494c78bd49df755ba516e2fb50d4f3ea0a0861eb762725f90ea0997dc85afbb7fdef802c9c57f20992dd802d1736
SSDEEP 12288:iCJnJ5D3VkrlzxofJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S5:jJnJ5D3WtifJ4yL/tNCJPXUQrPy
TLSH
T1E515D02DD2A810E8D4B7C3B482596746FF72386D2F226AC768B4D4353F12EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 05d2cb27b7b868c80bc33b712e4d2847196675470d032faddb8f8ce548a6b212
MD5 7616c9a83c47eac64a7204a35c5837a5
SHA1 671dd391dd874c33adec21f6c134b75d1b8c7e34
SHA512 3711d2ffcb7a008637016e8c66677d1af85b2b3414cc1e708bafa6a9afac17d77df955c66bd2b2a92f98b6e06151b10d5125c31eb1da4f8971c86242206d2284
SSDEEP 24576:YEPohm6/7IIXdwcXrif7qQncjlP65i3VudfJ4yL/tNCJPXUQrPo:Xo06DIKdwc+eQnSt65aV8fJ4klKXng
TLSH
T106955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 628765efa472fa7a40d912085eff5cd3545aed8321f564cbd912ac8e63e351da
MD5 cb17776d3461638af82126672f84d787
SHA1 77269d36393b50c281c30c87d93e210a621bcf17
SHA512 4634b3a1a641198e0bb353395146d2bd4853730ba52bcee5f45f3a4a61c7059c918972cfbee7e6710296a94a2a57ef0973b57eed11a86505b606f027bf9d64ab
SSDEEP 12288:NEP3RrnfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SS:urnfJ4yL/tNCJPXUQrPd
TLSH
T105E412AE229CA0D9D526927C4680C101D331F4A12B2723FF5AD1D17E5FBBAEA1D3CB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 3131f8290fd8d1f8b43ad7eb1db62f9aa8dad508a8e835cbac62d76f43383f10
MD5 8487c6b459393b185a0837a5b0f7133d
SHA1 55a85f8920029931f6b1d437911d1aa5c2f0eca7
SHA512 4d5a5fa1a22a10861f76c2c14bb47b145101c76dd4d5cef9171ccea8da4e78600f75048bcdeec0c1987afb850c29a0422e85c2e797410679d913898fd3e6dbe3
SSDEEP 12288:ujky1fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SD:uIy1fJ4yL/tNCJPXUQrPA
TLSH
T115F4224A23D4A085DAB6477C4A95D140CB34BCA02F2693EF9580F53E7FBABD56C38712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 c5faa77d4c291da613fea0036ef353cfb5e3210f9049a53577a3726ed9e3f565
MD5 171fca8631d4cc1e8a9383bb5b99fce8
SHA1 757c9ef056502cb95bfa1554915c89cb4886b345
SHA512 2208e20132c12bdc2fee61d8685cb2bc3cc4e8dd69961125c60d1b4a4ea4ac432ee1954295e17e76f43a01b7c7d0e5ed74456bd73054f15fba1d44f018337a70
SSDEEP 12288:FFjfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sy:7jfJ4yL/tNCJPXUQrPV
TLSH
T1FCD423AF2095A48ADE2687FC0648E000C3147ED5272B62FB9DC2F4A17FFD99615BC791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 8d682a0b8885d35881315c5cda29e7e4bae4ce68859522ac0cb7a2f721c05b61
MD5 b6cb0face73b05efdb057eaa9fc4f18a
SHA1 c39455440c10814ed52f42c8b304cedc2a46c4ef
SHA512 94d08f4a8a7ffcde1cab7091f1156d72f817454b363d2aa6e0871eb94c864206969d66c79442ac148807b1c95e17a67ae7a90f2fe38d50619f2e090e0d763a8a
SSDEEP 24576:NQ9MxZKdcz97w3wfJ4yL/tNCJPXUQrPe:NVKXwfJ4klKXn2
TLSH
T1C3558D2DABE9058AE177C27595A250C3A633B4311B35D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 2cfdf53666b067ed7823e6a3c5bbb3354daf69c211a4a2fce8580b545ffe9378
MD5 a617ed51557afb0359169636aee4e2d6
SHA1 91e0949c69b4173d248fd3631c97bd17ef3d1698
SHA512 82b122afe071ac1db1f068c816821ffcb01a67d1257caba9caf20e627e8cb4f16a482079ab12827b7bbb17d69bf41ad99e5e1a120d05ef4ed97e3860829706c6
SSDEEP 12288:pyoKo2HRple9phfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Se:pyocxAphfJ4yL/tNCJPXUQrPB
TLSH
T173F4E05FB7A940A2E176823C8984C205E773B4701B2263DB6681C33D5F77AE97D38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 7640bec0d757b8e7baeda5f63998655d5be14b192b8da7f78b3149d5f924effb
MD5 13016ebf1021c7d139c8b361ba4679b8
SHA1 5d4ffd222f93cf0ec37b375cfa38cd347be6f078
SHA512 722cdf7b2b1c4442bacd8a3dfb8fd951a3bcb5f53be7a52bcf150e1f27cc7a693b5f048f13b695d6bb3c0b686b9aec01e5d9e3cbbab7fe1229f5290f0071806e
SSDEEP 49152:AWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKhfJ4klKXnE:y0zuNItfJ4k
TLSH
T1AFA57B3DA2F800A8D9AAC375C5451366EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 93e7d3dc589dfe97179bb54da475f01be2d5f8710d04173a666c87f092aff6c5
MD5 b51a65cb70d9b716dfec48e9e0a5337b
SHA1 34ca7c1173dff9e8b18d2e2e1d3cb7cfb501415c
SHA512 504ba9d36f2ea26c8caa9e5ec281ba2372731dea9b0db97b57c99165f96d67dfcd1f731f3610e370c489eda0b59bd7330e51b780e7ad1f8db600e547c546e8bf
SSDEEP 24576:W1QT7EcpfxR+N5AWAz3ooiYtjMqbufJ4yL/tNCJPXUQrPz:7TDxR+N5YzTfjMzfJ4klKXn7
TLSH
T1F255B02EA7F855E9D17E86789A23C502FB727851033193CB42A0C17E1F6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 b34283c688dfb0bfcf0b1d11a0558112669e15bafb45ab3d4b40bfe478c3ef5c
MD5 407a9f97eb7c5fb2cfaed0589ce53cf8
SHA1 03d2d3e55c7d9eaaffabb77c92252df043b6c5d1
SHA512 67c7615c82da9a3c637d8f30e3ef1ac9c27cc71e4c239b2597730626638e6b5b7801a01471c65fd10ae57cb9b0feb4472965238fab88a7955fab0025bb96a21c
SSDEEP 24576:GTMdOz0FFS+imSLKfJ4yL/tNCJPXUQrP4:C0K+imSLKfJ4klKXng
TLSH
T1B615E17E63AD14E5E57BC27C9642D906E67238A6032266DB06D0C0793F9BFE4393DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 956d87783a40640ff25cd35d4105133c87d59f9590a08d5ee07f091224bd3ee8
MD5 0808c2f81573080474d73292c199b6be
SHA1 99c7d385a73b747039ca1bec900bdf1472bfdc32
SHA512 fe9b3c9f5068e56ba3e4a6114c9e67c931f2f3733ae6008a6c68194a71db4e2470d97878366d3f5bf5c17ff8760c3af2f285302c57a36ccbe56fc7041422e14f
SSDEEP 12288:K473fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sz:53fJ4yL/tNCJPXUQrPA
TLSH
T1D9D4125E23D870D5E87293B84B54D101C330BCA6232A62FF39C1D87A6FBAAD5597C712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/684-106-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/684-101-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/684-104-0x0000000001840000-0x00000000018A0000-memory.dmp

Download

memory/684-87-0x0000000001840000-0x00000000018A0000-memory.dmp

Download

memory/684-93-0x0000000001840000-0x00000000018A0000-memory.dmp

Download

memory/1252-312-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1252-165-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1252-163-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1252-157-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1456-542-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/1456-789-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/1456-536-0x0000000002000000-0x0000000002060000-memory.dmp

Download

memory/1456-530-0x0000000002000000-0x0000000002060000-memory.dmp

Download

memory/1768-100-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1768-83-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1768-77-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1948-220-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1948-74-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1948-72-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1948-66-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1948-208-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2148-232-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2148-538-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2148-230-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2148-224-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2592-10-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/2592-19-0x0000000140000000-0x00000001404BF000-memory.dmp

Download

memory/2592-99-0x0000000140000000-0x00000001404BF000-memory.dmp

Download

memory/2592-16-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/2604-51-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2604-43-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2604-52-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2948-611-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2948-301-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2948-298-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3064-243-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3064-543-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3064-245-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3308-168-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3308-176-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3308-325-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3308-174-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3308-618-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3308-620-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3416-142-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3416-286-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3416-138-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/3416-132-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/3472-276-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3472-120-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3472-129-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3472-126-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4092-646-0x0000026017F00000-0x0000026017F10000-memory.dmp

Download

memory/4092-644-0x0000026017F00000-0x0000026017F10000-memory.dmp

Download

memory/4092-645-0x0000026017F00000-0x0000026017F10000-memory.dmp

Download

memory/4092-647-0x0000026017F00000-0x0000026017F10000-memory.dmp

Download

memory/4200-115-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4200-109-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4200-248-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4200-108-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4424-268-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/4424-274-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/4424-277-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4424-599-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4572-256-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/4572-255-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4572-259-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/4572-261-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4572-249-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/4820-6-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4820-8-0x0000000140000000-0x00000001404BF000-memory.dmp

Download

memory/4820-0-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4820-36-0x0000000140000000-0x00000001404BF000-memory.dmp

Download

memory/4892-197-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4892-195-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4892-436-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/5108-615-0x000000000CCB0000-0x000000000CCB8000-memory.dmp

Download

memory/5108-326-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5108-350-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/5108-334-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/5108-368-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/5108-327-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5108-662-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5108-319-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5108-613-0x000000000CCB0000-0x000000000CCB1000-memory.dmp

Download

memory/5108-612-0x000000000CCC0000-0x000000000CCC8000-memory.dmp

Download

memory/5340-211-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/5340-523-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5340-217-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/5340-219-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5344-153-0x0000000000740000-0x00000000007A7000-memory.dmp

Download

memory/5344-148-0x0000000000740000-0x00000000007A7000-memory.dmp

Download

memory/5344-300-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5344-147-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5424-587-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5424-544-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/5424-553-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5424-550-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/5500-63-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5500-96-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5500-55-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5500-98-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5500-61-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5560-617-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/5560-310-0x00000000005B0000-0x0000000000610000-memory.dmp

Download

memory/5560-313-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/5560-304-0x00000000005B0000-0x0000000000610000-memory.dmp

Download

memory/5668-22-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5668-31-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5668-30-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5668-141-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5704-528-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5704-524-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5704-517-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5704-596-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5884-562-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/5884-790-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5884-566-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/6100-287-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/6100-289-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/6100-600-0x0000000140000000-0x00000001401FC000-memory.dmp

Download