02c2402458ece78f0e40d19b961fe68eaf895fe371cca5b05bbcb63b741e30d7

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/05/2026, 02:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Size 4.7MB
Sample260517-ck49hsft4q
SHA256 02c2402458ece78f0e40d19b961fe68eaf895fe371cca5b05bbcb63b741e30d7
MD5 85dcd30259ac0981857086eb5e78266a
SHA1 f741f73af2dd029b11ba5d6a002362febebb7423
SHA512 40361384a7f06770acc2c37a63dd72c38f82a2e330e4c0a8646368d199efb9a977e70e0c7de2fb717b476217093c74e7360d73b985ad54f9c66f58e26f55f208
SSDEEP 49152:f2AhLGp4btjMK3XAL8Njmbb/qedc+KokvY0n/sHQ4VD//IOSArTpYDOJj40NsHy9:xgpH3/qed+UsiC9vYPKES
TLSH
T1C6367C03F2E941D8F0AEE2789B765732EE72BC568B3065DF025036151E76EE05B38762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 25 IoCs

pid	Process
4544	alg.exe
2388	DiagnosticsHub.StandardCollector.Service.exe
1404	fxssvc.exe
1968	elevation_service.exe
4052	maintenanceservice.exe
4384	msdtc.exe
4668	OSE.EXE
4800	PerceptionSimulationService.exe
1836	perfhost.exe
2500	locator.exe
4280	SensorDataService.exe
1344	snmptrap.exe
3676	spectrum.exe
900	ssh-agent.exe
5064	TieringEngineService.exe
1924	AgentService.exe
1624	vds.exe
4616	vssvc.exe
1684	wbengine.exe
2796	WmiApSrv.exe
1712	SearchIndexer.exe
5380	chrmstp.exe
5424	chrmstp.exe
5512	chrmstp.exe
5580	chrmstp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fbbc741979c0b0e8.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86734\javaw.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1580	chrome.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000053cfacf553e8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec8093f453e8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cb6838f553e8dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000413bfdf553e8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d57d7f553e8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000254458f553e8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3712	chrome.exe
3712	chrome.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
4820	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
3712	chrome.exe
3712	chrome.exe
2388	DiagnosticsHub.StandardCollector.Service.exe
2388	DiagnosticsHub.StandardCollector.Service.exe
2388	DiagnosticsHub.StandardCollector.Service.exe
2388	DiagnosticsHub.StandardCollector.Service.exe
2388	DiagnosticsHub.StandardCollector.Service.exe
2388	DiagnosticsHub.StandardCollector.Service.exe
2388	DiagnosticsHub.StandardCollector.Service.exe
5008	chrome.exe
5008	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3360	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeAuditPrivilege	1404	fxssvc.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeRestorePrivilege	5064	TieringEngineService.exe
Token: SeManageVolumePrivilege	5064	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1924	AgentService.exe
Token: SeBackupPrivilege	4616	vssvc.exe
Token: SeRestorePrivilege	4616	vssvc.exe
Token: SeAuditPrivilege	4616	vssvc.exe
Token: SeBackupPrivilege	1684	wbengine.exe
Token: SeRestorePrivilege	1684	wbengine.exe
Token: SeSecurityPrivilege	1684	wbengine.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: 33	1712	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
5512	chrmstp.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 4820	3360	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe	85
PID 3360 wrote to memory of 3712	3360	2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe	86
PID 3712 wrote to memory of 5016	3712	chrome.exe	87
PID 3712 wrote to memory of 4356	3712	chrome.exe	90
PID 3712 wrote to memory of 4356	3712	chrome.exe	90
PID 3712 wrote to memory of 1580	3712	chrome.exe	91
PID 3712 wrote to memory of 3804	3712	chrome.exe	93
PID 3712 wrote to memory of 3804	3712	chrome.exe	93
PID 3712 wrote to memory of 3752	3712	chrome.exe	95
PID 3712 wrote to memory of 3752	3712	chrome.exe	95
PID 3712 wrote to memory of 4300	3712	chrome.exe	97
PID 3712 wrote to memory of 4300	3712	chrome.exe	97
PID 3712 wrote to memory of 1364	3712	chrome.exe	99
PID 3712 wrote to memory of 1364	3712	chrome.exe	99
PID 3712 wrote to memory of 1684	3712	chrome.exe	118
PID 3712 wrote to memory of 1684	3712	chrome.exe	118
PID 3712 wrote to memory of 5884	3712	chrome.exe	123
PID 1712 wrote to memory of 5352	1712	SearchIndexer.exe	125
PID 3712 wrote to memory of 5380	3712	chrome.exe	126
PID 5380 wrote to memory of 5424	5380	chrmstp.exe	127
PID 5380 wrote to memory of 5512	5380	chrmstp.exe	128
PID 5512 wrote to memory of 5580	5512	chrmstp.exe	129
PID 1712 wrote to memory of 5688	1712	SearchIndexer.exe	130
PID 3712 wrote to memory of 5920	3712	chrome.exe	133
PID 3712 wrote to memory of 5920	3712	chrome.exe	133
PID 3712 wrote to memory of 6096	3712	chrome.exe	134
PID 3712 wrote to memory of 6096	3712	chrome.exe	134
PID 3712 wrote to memory of 5732	3712	chrome.exe	135
PID 3712 wrote to memory of 5732	3712	chrome.exe	135
PID 3712 wrote to memory of 5772	3712	chrome.exe	136
PID 3712 wrote to memory of 5772	3712	chrome.exe	136
PID 3712 wrote to memory of 5916	3712	chrome.exe	145
PID 3712 wrote to memory of 1960	3712	chrome.exe	146
PID 3712 wrote to memory of 5508	3712	chrome.exe	147
PID 3712 wrote to memory of 5008	3712	chrome.exe	150

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Users\Admin\AppData\Local\Temp\2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
  C:\Users\Admin\AppData\Local\Temp\2026-05-17_85dcd30259ac0981857086eb5e78266a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=128.0.6613.114 --initial-client-data=0x294,0x298,0x2ec,0x2e8,0x2f0,0x1403946b8,0x1403946c4,0x1403946d0
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8bd88c728,0x7ff8bd88c734,0x7ff8bd88c740
    3⤵
    PID:5016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,17374502652383921874,697957683772001328,262144 --field-trial-handle=2008,i,17412945214924846073,5602940200944313359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2004 /prefetch:2
    3⤵
    PID:4356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1580,i,17517582747809114027,1652665613291857669,524288 --field-trial-handle=2008,i,17412945214924846073,5602940200944313359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2268 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,863466548066993761,5985084716538624663,524288 --field-trial-handle=2008,i,17412945214924846073,5602940200944313359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2564 /prefetch:8
    3⤵
    PID:3804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,16758153425990486836,4987174360500521825,2097152 --field-trial-handle=2008,i,17412945214924846073,5602940200944313359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
    3⤵
    PID:3752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3340,i,8958578565970095274,9164912828275052992,2097152 --field-trial-handle=2008,i,17412945214924846073,5602940200944313359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3348 /prefetch:1
    3⤵
    PID:4300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4512,i,2430423973601449225,17044236097391032966,2097152 --field-trial-handle=2008,i,17412945214924846073,5602940200944313359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4516 /prefetch:1
    3⤵
    PID:1364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4676,i,18123064244391126964,12879452729962889208,524288 --field-trial-handle=2008,i,17412945214924846073,5602940200944313359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4640 /prefetch:8
    3⤵
    PID:1684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5036,i,8494227517844382101,1324810301577047124,524288 --field-trial-handle=2008,i,17412945214924846073,5602940200944313359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5572 /prefetch:8
    3⤵
    PID:5884
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:5380
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d0,0x1405755a0,0x1405755ac,0x1405755b8
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:5424
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5512
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d0,0x1405755a0,0x1405755ac,0x1405755b8
        5⤵
        Executes dropped EXE
        
        PID:5580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,3553595565675617908,2395275579490508211,524288 --field-trial-handle=2008,i,17412945214924846073,5602940200944313359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5508 /prefetch:8
    3⤵
    PID:5920
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5252,i,9127492854691757176,6310985983897643328,524288 --field-trial-handle=2008,i,17412945214924846073,5602940200944313359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5772 /prefetch:8
    3⤵
    PID:6096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5856,i,6718269322304365214,4914294885124604059,524288 --field-trial-handle=2008,i,17412945214924846073,5602940200944313359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5880 /prefetch:8
    3⤵
    PID:5732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6048,i,4380026054617002958,4503058710570207032,2097152 --field-trial-handle=2008,i,17412945214924846073,5602940200944313359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6060 /prefetch:2
    3⤵
    PID:5772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6032,i,8974235144697491381,5255777848799256385,524288 --field-trial-handle=2008,i,17412945214924846073,5602940200944313359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5956 /prefetch:8
    3⤵
    PID:5916
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5996,i,3784575801968824638,16849259664134200374,524288 --field-trial-handle=2008,i,17412945214924846073,5602940200944313359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6004 /prefetch:8
    3⤵
    PID:1960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,13157179272838369025,17799424714123253654,524288 --field-trial-handle=2008,i,17412945214924846073,5602940200944313359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5916 /prefetch:8
    3⤵
    PID:5508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5880,i,7334532124958722734,8762147007923158538,262144 --field-trial-handle=2008,i,17412945214924846073,5602940200944313359,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5916 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5008

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4544

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2388

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2592

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1324

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1404

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1968

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4052

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4384

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4668

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4800

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1836

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2500

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4280

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1344

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3676

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:900

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4580

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1924

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1624

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4616

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1684

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2796

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5352
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ef0823ce95465016985853f051a0e3d0c25f814246a48812c83e10643c7b99f1
MD5 9e1ab9654db310558bc31959642bea66
SHA1 349e93ecc2a23ac9c6e3e286b231c14d3956ec1e
SHA512 c97fcc24f8dd3b43a7e97d3c77916c98ee56c73950c93fd11a53ed7f0eb9891ce6035aa90174d1bfccf711dfbbc14a2f98e91955bed2a57fad2db7c7314b2b1d
SSDEEP 49152:jb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnhYPKEnSG:B3q6HjB8YPKES
TLSH
T1FED59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 ec667c21a6c91fe59e7d70e4d78f639a9442795824fa6a299936e959488e2127
MD5 7d88d348abfb641ee9681522e5e30947
SHA1 9d9b37774ebc2f12957b37e3706781d09cb57bd7
SHA512 44f7c5e38b84f16b43aa697a9d24915bb3c8611ea830fb21eb1b84c12e0762a30cee96e7b0ae547021f03c3412e4366a9bd44a9c4b1ec923f53f8926cfa5863d
SSDEEP 12288:Y1XLsswWkxy2lRq2czA345Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRky:eXYfDtczAIYz7KEMdX6keYnAcerr
TLSH
T14085012867E508F5EC67823DCDA28501EA33788507A4E7DB03E899661F373D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 509698bfe90f7c1ab47471a87a5a0a8759518d610a637dece540bfc0b421f3f5
MD5 433f00b58e706ee08d61208019fbccd1
SHA1 4bc9b9d64e5a38ddae0c1b50ed3dd8f4de044c36
SHA512 78c2057a1639f6e266a2be28365e8147382bb14b9ee2fd92ee6f1f349050e4d5afb70dc691bf1fca85aa0613391020e473371e7c34f9b03862569d2fa004cb4a
SSDEEP 24576:U0Le5ji0hmx3rM5Yz7KEMdX6keYnAcert:UPji0AZGYPKEnSG
TLSH
T15AA59E15F6748771D073C0B9C5D2A68AE97230861B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 23d423e0664cc8f43e8bd327b2d5a1465ebeef7fb538d5cf16b48dd918105f42
MD5 b0f382c760fa4af68a95ea667480c25d
SHA1 404bbdbeb88ca62c3f8f276be99b81fb24e17364
SHA512 ce95c0cd4010c8f92573a71c817da17d448af943781a4511018211cf5e52c795f3a2f92cafe264f9b5d1b9dc4c54ea6060a7da9b399c164f792b3368a40df1d3
SSDEEP 24576:ra7/ezSC6vUyD/aqgrvWE6q8wyuTYz7KEMdX6keYnAcer9:G/ezSC6vUzPvxHjyyYPKEnSG
TLSH
T105756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b4b4d763bf110386a46cc3f48673e4bd675ac58e67003d4896bfcc1d943fd6f4
MD5 0998e10ffab5ee9a007034d81a1e47bb
SHA1 cc879f40e7274618ae7179af6867c753bd18e59c
SHA512 c20d778f9217d680fde059d926059818d91a2aac0d63932af3e4b6d818830d3ef9cd864e33688ecb13df8bb3a500fecf6abb54f67af0a5be9822b911d89fdc5b
SSDEEP 24576:1VbqPb88hv/l+6MYz7KEMdX6keYnAcerj:1VO88hXl+1YPKEnSG
TLSH
T1A1559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 cf6ea7f8b7df3996b5d8a394f798855c7f55f2c80745e1cbab7ee0da93db0ec6
MD5 b41f64105708b8723676b03d45069d3e
SHA1 5a72410a2d476ee41ca5664b57c8b26e35d703bd
SHA512 9eab16d5ddd161307c655bb8004a6faa074e40b0d6de7fef8337b9482278ac738e99029dcfe9dfc8376672cb962d300694a1dd61a0ccdf321ef48e3009f55dc8
SSDEEP 12288:8XO45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRky:8XdYz7KEMdX6keYnAcerf
TLSH
T14D6523048B1A89C2F85F067BFFF5895085375DC62E8C97A1C94CFA4293BE622C50675F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 c739c3d375dec0af4b02cb70c485c683cde0930d7a12b96445c409ca07d0b6d2
MD5 7919bc80cfe1d9f8bee8f785613a17f8
SHA1 fdf1a6b36dfb9e01f19e74e1601567138a633f37
SHA512 9af4e8184cde8c6609de9277ee39013037d41f4989527db9278818d7a91175604d4ef152c4cb680eea24f6cd9ad471c80dda825ba578c2a8f44d1a574422114c
SSDEEP 12288:TeBNUbTVO86Ub45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk4:TJIUEYz7KEMdX6keYnAcer9
TLSH
T17285CF3BEE28FCD2C27A8DB96B918600D77278704B51A3CBD164C20EDE275E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 dd6f8be6b1d9c791d489fb707022c3e5dd211d58736d59b4bbd588edba9876bb
MD5 d0e09efdd2d4bbd86df21be973da8a89
SHA1 585c12421780f45050825cd68af7a02ff9e7d6c1
SHA512 31ad6f6c198fe99fff4a788e7952d037582637aea0551bf072968c710474dd675be843d4e5be2c594eb517637370ef698ba2c5c5e56e00b5fca3244a375c1dd1
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THn:VQvGAdlCEL8c/yRNw5CjYPKES
TLSH
T167267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 09a1c39283c0169b8bfadc3a0609da6e07cf53ddd608ce901cadd71141263bb7
MD5 41134cbcaa95f4cb308ed30b06e39fb3
SHA1 deb88de146feacc1555ecc3f97cd528f4c4bf89d
SHA512 f7efffaf45acf42a16b7f853910a386dce96c840a5a06dc178aa81f4e8d5f3def01ccda629411dc5f9a1c7f4749ae3a8bf82ec2131f02fc3faf4b0eab494faa2
SSDEEP 12288:EAwSfxL/2Dc3BDLLmt0LDQewsAjJ45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkU:ZkewsAjWYz7KEMdX6keYnAcer1
TLSH
T1FC95E031FE75E432C67F0DB62B36C716543D79600B511AC3E3A89E8E5A742D22336A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1e7770e0219b28acd25428c4880948ee4ea567cb877b9328bd963d2f07755316
MD5 7d072675a928b4cf1d6695ab9d754d0d
SHA1 08cecf0245a83a11273b68075db2f270950ad674
SHA512 8edf1ff979b67140f348370a44f1cbbf5ae2a436b370d7345c7748eda9a8f75a1ef9e3b724177d8cf9e5322fedfd665abdafa2cc70ccd264e77e77f49487b685
SSDEEP 49152:gCbRquA/m2yL5zQfFiV+XenmE3/z2YPKEnSG:poqtVjnmPYPKES
TLSH
T1B4D58D0976B8C2E4D1F6C77896A2C647F37178154B34A7EF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 ad59b9986dfe46c93f9a24120db198716bd38adae3327b4d0a750497f476854d
MD5 700106783a34498d23f37190e8e72cfa
SHA1 cf98e95c98dcf12a3e2aa717256137a0b8e92a65
SHA512 c01632d860ef6a0908c95de2f02916ed36511a692536a41b4c897e97d1351b4f91ffd694cc66cd27c6f13f2f5b7cfe9b9a63c22933743b5dd1d62966c54b72cc
SSDEEP 12288:Jmw5HEjsChNzBFgl0WDm+CY45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkp:EwuSOWSYz7KEMdX6keYnAcerw
TLSH
T11385F14977A90CF5E8A78239C697C132E7B2BC422A25D71F4760C6575F37321AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 3b5660f34fee84ce4fee262a918123398751b3f147c921ef78f05e47ca7a0410
MD5 4b8eb31b46f86811c01f222c0735480e
SHA1 e4bc6cf2c31136496cd5beb659cf69ab10d23ab4
SHA512 edf391e86cc2c2bd000ca29d7bd0409246123295badfd7e3b77c436f6f91b00ad6f5bb3c0892f77ed8486082695691296ea3c8221d485d672ef4672ee6cb193a
MD5 SHA1 SHA512

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c69a204dcc2236716ee10712f280fa5cc93af01370dea21c36a5481133a89863
MD5 04f1825a89b5a173b2851beda9c4b7b2
SHA1 9a9fdfe608071cfc985cf037b620c69b298e0e81
SHA512 773193fcb24588131435f119aab3daf4a83d3281c7f156969d704931822d6b49cd3496c668633548a21bd06ef18fa422c5805504f5f4b6f002b546954f3c74b2
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UL:5QRQyi36YOcPQLvw2gAf+PN3gYPKES
TLSH
T191667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 68a19149ffba38a4c46cd6272b26e7dc0d825e00ca5a6ead4d669acccff8374e
MD5 f3485fb86902adb3836da2135afb6317
SHA1 dfdb9a8b8b40079b064d54f8683fc1b1bac2b30c
SHA512 c406f6d6b002c03ea5fc22fd0f7e01a034cf10962dc79c160b39ebdd7a5f8cf792d322cd474b59d066e6e2eb8aa83f6776b771525e20af2c7837eafca22444ae
SSDEEP 49152:PB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl4YPKEnSG:xu6JmVxd2d4YPKES
TLSH
T1E7D59D13F1DA01E8D05ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5380_13423753592884288.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5380_13423753592884288.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

5512_13423753592691454.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5512_13423753592691454.pma
Size 696B
SHA256 da9a8ae0c04da6ceae900796a026f4777895bf149eed2c495fbdae098362f596
MD5 3f5af086a83b749aa34a3aac1b986a0a
SHA1 0e67e17122beec914722d98cef0e669541560ff3
SHA512 0a12749b3971d0023cc1dd4f87113c94cc2c961ef824009c89a32ba24fe51de83357bb0757af7612ffb3a638302f5a298a2fc823dec8d117cf27255d2996191b
TLSH
T153010E49A3144F77CC828D3584FE27412BB0FA501B821BBF7B10724F2E021C9AED9168
MD5 SHA1 SHA512 TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 1308a1d5b151dca28f47943e02b735cb090d0592e9fbffb9892eb9b04c3cd46c
MD5 b17003d4a248b3133fdfaac6c8fc053c
SHA1 7bc898ebcf1e91b68ea12c7faf9b32d6b2ee8c2c
SHA512 ad155638ca52c628dd92edc1e9e71fe5ae676ebd22eace4d48aea9260d017a44cc82d945d2ad1f2e09d6e98aeeed44acaef83a59f2650636a230540b842cb3f8
SSDEEP 24576:icP4mcvIjkGOxhKP2l71nNKbrh/8KBpYz7KEMdX6keYnAcerm:NP4m4IpOO67W8KjYPKEnSG
TLSH
T16C65BE2DABDC0096D0BB917885658A49FAB1742A2F3286CB1160933D3F77EE14F35F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 7KB
SHA256 41414301174bf179bb03bd7e0d731439b6c476707376d8575af6efe01cef7344
MD5 7416219e4e6838e6d401a16e94b8b840
SHA1 403c14fb3abf2ead1c20eaca721c9eab5ac40c33
SHA512 93d3aed569110b21dd45a0f55531699971faae6feac82b1636885c06c0ec9e200d7506e73f66ec7387706f8c95622f0b2d4a0ba9fb461d928e647f7ea97263c8
SSDEEP 96:yFaZ8WMrBsZ8gihK3BK302t3z0v0gihK2QK2tVkS4OJS8AQHCL0:5KzBtuFczfi73JS8AQHN
TLSH
T130F1BFAA8E42846F3B81DF2B336331A55D576009C7E864723FEBD505F0CAA65011FAA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 9KB
SHA256 30c481d72b11cc4697234ac00bfa653c5f5c92d80787586c47c872b71816dc27
MD5 76b510942c9edba0d598c5550b8cb13b
SHA1 6286036e53ace7c87c55fed6fcff1db7abf650fa
SHA512 2175839c8c9df501cf557019732c31ceb569fe82155b21c63f3aa65b28058708489c281794d44331f3f68ff65806ddd5d3b87cd76887a57013bee18437bca414
SSDEEP 96:yFaZ8WMrBsZ8gihK3BK302t3z0v0gihK2QK2tVkS4OJS8AQHCLkQ95hK3BK3Eymx:5KzBtuFczfi73JS8AQHqiJXx
TLSH
T16712CFAA4F42886F3B819F2F336321955D576009C7E865723FEFD601F0CAA65001F9A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 ecd252b3f1c5f339086245da7090a285db79f6bdbaf05efc407e533763b1cd9d
MD5 9e8a968ddefd4d013e51d21d82cf1104
SHA1 2fbcd2f941dcb366be77993bac70c4e59d25de29
SHA512 5c8f8e39a186c5f1aa266b589b30bd1126d6f7e74860b3db3e5e427f28c5b8e9beec691dfaed35f96d0998833be844518bee7e0a64b8ccb4dde37e161d1c26c8
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f0fd478ce0fe8337d27ff920c9d23d60ee5c44faafdba1506b170e163474a159
MD5 8dadf5f83b134977bb32134979292f72
SHA1 c41cae94a9c70d1c7811e3aefcfdc11927b20506
SHA512 c712699d7d98c68184b6b5c6b64e769ac0c35e94a0ab8ece49e2299719be95fa2b2592b2db8ddfcfec2a79216fe06b8ffa5170ca1756b3f002b05add94a7ed8c
TLSH
T119E02BAAE9399C3B2CF9572C60540B86D74013573B50A98F363C810ACFB5B370546C1C
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.106.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.106.1_0\service_worker_bin_prod.js
Size 121KB
SHA256 dfd0ec0bc928d34168470caa909b172ce231abeec84c1c1a9f4fb56c5fc24bb6
MD5 c13e4b9d5de348199a68a781d9917134
SHA1 e099a794691befb662079203b41db4cd524d19bb
SHA512 5595a5cc09ce1faca8e808e4ae135bae2cc69b94cf7b52df736dd89ba9175734403f9394ffd8030e9bb4313130fccd41c1fe25c4ba1947e4f36fd586a21599fb
SSDEEP 3072:V8yXpHnHBP5oKvTNcpa/4Ybza33t8ZA7a:V7Z3vTDbza33t8qa
TLSH
T1BCC3E9CDB7A574624363A4B6002F000FB23AB8AAE44C85A8F189D9E97D7446D4377F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 81d45def0e14bc73be331b81d01aca4e7685378b297ac5e0d4272602e7d0a92b
MD5 7b6f510e4ec23fe9d1c94fac79e52443
SHA1 5bf3f955c3cf9af4a807bccdbc065870e89fdabb
SHA512 41a5ac839166cf91dff8b14b30ca6827491ffb0af10a19cd20538e1953e89631fdd2938f64b3d34f84a63ec891fc51f00ed2a94dd7b41277fe18fde6e941261a
TLSH
T1FD517DF7C7D88A6D855162F4A625AE2FCD2D0A14532C3C56C8D8AF4B53E68B2D21078E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 8cad084c57d203ff9903ad52ea88310a18775b2b1463d26cbb943405b4638c06
MD5 55165c11129bdc8c744a9213932e88c8
SHA1 e52fa4fb4c0842222df93e0aa0772db41d267854
SHA512 d911b586e11c252a58e21ff128f4fd9f36d505043e77307f402c52dcccd8b86d7895be7f908bc7f84ac29cbba49e498d4960e6576cb5100927b08d3410d10098
SSDEEP 192:QRNIZN+v7P9PRp26Xsb+WNnL32ZwefYiyIsnAUgtaJ:QRNIZN65XxXwb2zp8
TLSH
T15322B52EAE14653F6CCFC62AFA25765BD3F5102271952E84D6FC8A3C24DB6CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 ddc7b3fc439a5b5555eff948bdcb39486d9056323cfa71794cce43d3ece5d2c2
MD5 46107d32314934302ffd6cac6d297ca6
SHA1 dd5dcf9a5663df958532cb91734e678cf5a057f3
SHA512 38e3d56880a5acb87cee520b39a594143065804e125bede39149a8529c510338614574927ecbd0dda2b413d61e2649c9952e11d644d33f290f57a974e7c149f4
SSDEEP 192:QRNIP+2MN+v7J9PRp26Xsb+WNnL32ZwefYiyIsnAUgtaJ:QRNIG7N67XxXwb2zp8
TLSH
T1AE32B72EAE14653B6CCBC62AFE26765BD3F5102171952E84DAFC8A3C20DB6CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 bc7474da13603e284f11c7907193b521f95fc0b1733556f7f16adf3a6f1e087b
MD5 b4c6415c7fd559ccd1d6ea3db6c962ab
SHA1 ff629efd3d4325a9a2193e4993564c72b7849bb5
SHA512 614ca2e0611dd84110d19873976637f5ef4577884459877b59951068fe344746801194634580f42119e4ca62fcd6ac7a5ab1292a7b79fddb75ce47b6e4696fe7
SSDEEP 192:QRNIP+2MN+v7JpPRp+6Xsb+WNnL32kwefTiyIsnAUgraJ:QRNIG7N6nXpXwb2O+e
TLSH
T1F732B62EBE14653B6CCBD62AF9267B5BD3F5102271912E44DAFC8A3C24DB6CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe582bbe.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe582bbe.TMP
Size 3KB
SHA256 1416953291c598b10371bf2f93fc3c242176d92ac627352f6bd284a3ef7bf26c
MD5 020164be0c6a0963df6f9985a767a83f
SHA1 c6497b589c2a01000c78c89ec490484370aa9347
SHA512 cb8baf498ee8eb30a1bc8a259d477b4c8b86c39cf6f255f1d33fb95d0f285d88852d95f4819d2a4e966551fced8afc15b7163a45a6b97341ff3e00089cda84b8
TLSH
T18261346DD5A04CA31DF2A77AB83A5F82FE15467B0140285639FE298C0F729674182F6A
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 66ab49435c2a959e3364060ab4860e5ad2e523de760c85879dc0ff808d0c03b8
MD5 c64047622744e88c584cd0fedb4e264c
SHA1 8d5bb5b44a543b3d6aace26cf9861fba874db178
SHA512 e8b42a9d5468d80474ba2481982a2c8dbfc8eb0286bdc376e9275740ce8300af66271492912fafc5ff9fdb50024c6328443fa5162adf51c69f420fddcaed517c
TLSH
T1EBB012A0B0465510C84046F0220B504C32115EA1C100070393D0FDA98C571E05260248
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 227KB
SHA256 489485bb1609fe89e08cff7ba3346ff44544f3d3b34388baa6baaff454c612fb
MD5 24af82d3361d92ce373d464337d0f73e
SHA1 be224559c3cebc91f1beab2fee7c90f2ce155f4f
SHA512 6c5d53db0acb652001d66ca4c996a39add773dbe1269fa61a17bf35dd3d8c7acd1ad6821166c6abe46472043ed7e243245789d8bd5ed83ad34d4fd9bce919820
SSDEEP 6144:P9Mc2kMLz511jPl6m7Rkm1tYpBeh2BAo0:P9S9z511jlV9oBGcAo0
TLSH
T19E342237EC6AAC723914BA7F858D1EAD09F098A3C010DD27C8DD97087A557EE191ED34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 83730083e628a6038a542fe2f2fb4dc67e68480a931b1c0842fd89ed8c941670
MD5 a69697cdedec610885fb13782c3fc859
SHA1 e982f0f07ca329857eb0f11c7afdeaae9f02eaad
SHA512 67f2837a899ca13d1d2df0a2b631634eefb2a559ca320de89969b073199d2fed7de7508be69a2c9e33921f6ec56516f991dde0ecdd7491eb3bdb2cd85125fcf5
SSDEEP 3072:aGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:9m7Rkm1tYpBeh2BAoO
TLSH
T11BC3123B5D75E9375D79AB0EB48E0B1E1EF249A6C920DE42C8D86B0433FA7CC1904A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 bf25e7bd9e323d7ae24191e1c00956b078a4bed1ad155ac99253d6e488c6eee4
MD5 521cabe1b0467208219db263473b9188
SHA1 9a51e0628e1e33404152a1349bd87aa1e055e195
SHA512 c0355605113248ab73e4c9a16e1d172d15d3fcf9d41f82426c90cacba3376ed22db6b59bc0d24df19d27a52d9cf2dbb15b09ba0724a5b77d56e6c236d0fb39bc
SSDEEP 3072:VIGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMr:Vjm7Rkm1tYpBeh2BAor
TLSH
T1E2C3123B6D75A9776CB9BB1AB04E0B1F1EF14DA6C920DE52C8D85B0433E97CC1A48934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 228KB
SHA256 c0f87ad94ea679eb0d4a6d55d44a50a7260a98f8345c3d05b59a0bf1bb808973
MD5 2be4a5b05c5a6c4c667e3a1d8b8a496c
SHA1 239a69b8dbbfb33f2eb9b3eb71dad0dd9b211ce9
SHA512 4fc36cfca4252807ad53acfeadbe484b5316bdafd947d5e2e983558af1a41451fc8190f9077f8d3d9875f9573ca72e0e29a32a0a111faa4f16991e58b2997630
SSDEEP 6144:t1WMc2kMLz511jPl6m7Rkm1tYpBeh2BAo0:XWS9z511jlV9oBGcAo0
TLSH
T130342237AC565C722914BEAF858D1E6D0DF098A3C510ED2BC8D99B083E593AF191ED34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e068b54-9076-4caf-8504-9c8949877d45.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3712_2038100383\6e068b54-9076-4caf-8504-9c8949877d45.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fbbc741979c0b0e8.bin

Path C:\Users\Admin\AppData\Roaming\fbbc741979c0b0e8.bin
Size 12KB
SHA256 f8df68671545e7e3fe41ffcd4b2359733e7259804c60d54678ddd1d7b6ff315d
MD5 fc14d4a5e7749b3d6b37829d1d2f7965
SHA1 abe62ce3666820bfbc9d33466e48991656032ab3
SHA512 666bfdbea2fd65669be5797000a7b888b75a8d5c5f3ff744ab88a0e3e71754e3e3dfc59153e14751b18acb80f20066f0871636ac603999a2c4ad35a6102ab75e
SSDEEP 384:QI5BF1aU2kX32adNE9Jfm+s+cMZTOFkDvv:l1/2s32a49JmBQf3
TLSH
T19F42B0BACFD736B625DF41868F20F7A2E47329A4F56911ACCB2D301F4659864E8444CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 93913839300a20b970aa99da9440a938b4ad4c735942aefac6cd7e603b00c6d2
MD5 5a8b969786e73a2aa552bc78bec4cc03
SHA1 968c45a3feafa882658bcf3d2317353ccecf01df
SHA512 5120c9f56bb4fdc4361e5ab3fdc67959ba4a97116ad08103245821896c2953a1ae03844ad2cfb6a41bbfc254bac43bb3cbf215c8f63886c524b8a312c2e9e178
SSDEEP 12288:bK45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkq:bRYz7KEMdX6keYnAcerv
TLSH
T1FD7523048B5E8DC3F46A4677BAB58510953F7EDA2F48C2D7E80CB24293BD6628C2571F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 b2bacd72412b75dd17dec37aaea496b5bbdd5b826f553a3812cfaca08d691a41
MD5 2ab934fae67c7830b1a8c86a91caae1a
SHA1 87d2110d5a28400520298f8f60bd7d1928497e52
SHA512 995d7abf604a2d1140fff176a58d9bf1c79a3958fc8f3df4c7a091a9c6f7ff68920300c99c676773147461b44fae3be11ced0427ec9531b10ffafcbe854280e3
SSDEEP 24576:2oiQ0h2Hm7EkuAK3xV3tk3tLjN2VMbxR86mHx/YY/izSI2sBu9EzwwXg/bTYz7Ki:2a0h2GEkuAe73q3pp46zwwQXYPKEnSG
TLSH
T11285AF1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.6MB
SHA256 9077aebcbd6d72839241b801bb4cabd0c1b3bfb92a686dfeac03605d3bc9aa67
MD5 0418fde98583606b25f502dc9ce44ef5
SHA1 2ac086cb9eacb6727a7575d695606bc78b24c7ac
SHA512 84dcc440b2807a341dacf5b2556c5ff79e0e7b1ea95a77e19f029fd32cd99672beb02aedf23a9947f7867e76475c56a495ba097b940abdc5ada85051b520521d
SSDEEP 12288:+hbHjfXl45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkM:+hbHjPKYz7KEMdX6keYnAcer5
TLSH
T17675123D16AD10D1F476927EAAA18506C332BC562B1193EF66C5C27A4F3BEE44C35F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 b53ce57372337dda0220fe92047b0276605eddaa9060a3f020785b2325d2d7fa
MD5 cc4bd174bc4b159946c551997efa30a0
SHA1 193a9ed5fc58651edb90f7dd36c425d9f8064642
SHA512 98166acffb81fed174afa1482957f402f54cdf4f11c7fb651b47f05714748b3c56cf5e55860c78361e0b9e4bf9c8c83946b6b1e289a0a21149bc10754d42f91c
SSDEEP 24576:x3YgnJcRTk4yti+R5dBR/SYz7KEMdX6keYnAcerd:xIgnaTk46pBR/SYPKEnSG
TLSH
T16C45BF2DF2B910B9D8AAD236450147B5FB71782D1F209ACB0170C538AF1AEE85E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 b9fff49b4bda0aff3ef283bf58cc220441f362c459be71ec7b3adbdb791cde2c
MD5 3fc8eab71c992265013af4975d162cf2
SHA1 2c176ba9b457238a3854ed026ad428f207f39141
SHA512 7e363957fb526753661adb1e4845a6f40ad2d723d916aaccc869b0266a87878486fe1d8eb5c2cb3b27dcbb47810a6397157a49a8aeacf78f7b00ba067152b383
SSDEEP 12288:8u45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkD:89Yz7KEMdX6keYnAcerK
TLSH
T1866523088A0B8DC2F85A46BBFBA5850085366EC63B5C43E3DC4CF54293BE6F2453579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 11be4b47f26398ea831f6906821ef2c9566de520e07fcb3bce76284833749451
MD5 cc76081768afa8297fd977b2fc6821ac
SHA1 82ad863fc726af1074774a5468af8971c982357b
SHA512 e07701bbb1d8e33ea23e74c38fe46929c8a196d8c7baabd9025ed8a8b39c09c43e214352219e3bde5a7118ac2a7adadf1da34e800e145236c77d7299b665c2f6
SSDEEP 12288:cObMA4LWOsvAYFT345Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRku:BML3UTIYz7KEMdX6keYnAcerD
TLSH
T1DC950114E79500F5E86B813DC9B28A12D272B89D1764E7DF03AC8B561F637E24E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 793100708bd9b54dde6466f14c796c07a12ea3194cf3e0edfaa9600f539c6fa8
MD5 0a2982d86e34d8e9d62abcb362574fa9
SHA1 0b7d2c10b52502e1a812dbb0460bf099f858d489
SHA512 dd10a557534f354616046c8f110fc0f4e57ceef12146cd47f730ab561719d4428efa71a2163ceb84d2813e7ac2615cc48aefac59202f26f53c268cde3f2db105
SSDEEP 12288:MpFtOO745Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkP:hOkYz7KEMdX6keYnAceri
TLSH
T16175121937ED10E1E47A913EDA928209D372B8A61B1153EF46C0C16A4FB7FF85C3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 929921589db1f88a6403d8ace98c3fa84715c305cc16b45dd99b155825889226
MD5 cd0d9153e2d6570c3bce5b74ac6fbb6b
SHA1 794c2ea3bd39faa742260d7e803472f39f541a6c
SHA512 dde195b14db2b318369734d53c28e43b1c0c7a31bf4c5826c3c4ad94cae05d759de96c8341974e2d4530ac568bf84cd9d1766ba53b56700011a34aac661a0581
SSDEEP 24576:q7NM9YqZqmWMUkPjZM48Mv6bEhsBYz7KEMdX6keYnAcerR:q7cBWMpPjN8DbEhqYPKEnSG
TLSH
T1C565AE2E6BAC81E5D477D13DC9E28205F6B2B4611B318ACB5152833E6F37AF44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 9665411d362b85296ac5add22c4ea2811c2b9305fb7363a0766c6af7f7517e44
MD5 29a5f4dcabecb2862ba2aff98fef1f84
SHA1 e50f82aefc023dd62f5052a70fda5697993b8ebd
SHA512 b8842506cebe9c087b0065549cad9f944d897a57e97194955580fb725859a91bfe9f79b2c5814b2e023fd3c69df57892e4718d7c34331cd7f3bab30d8f30a4c6
SSDEEP 24576:JW6BApg2YuyuNDYTabvcdvNYf8km1bYz7KEMdX6keYnAcer5:JF2YuHNETovAvNYf8kmhYPKEnSG
TLSH
T1A1858E2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 33f2256e38f8a56bfc85c7b7e19525f4ba0990f0e582fd2298de20bd91288e40
MD5 25db9962587e7d293d0fcbe9671deeb9
SHA1 35320bf33f1c2f6cf21ec7eb9902581c71b10e1d
SHA512 b263e099ca4698ef3e5270fcdd0ea8de8e57625a8ca29c0f81a45a146d42ea309881f7795b4ccb29121d1de1079a2f9bf14c16210806c9a07b52ad28186d2de8
SSDEEP 24576:KAFs06+Omlf3NXEbToAYz7KEMdX6keYnAcerU:TFs060lVXu3YPKEnSG
TLSH
T11965BF2F66AC00D5D07ED17E8A97C91AF6B1746307255ACB0160C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 4d7130246ea43a5cb8f08fe4dee208cb23f4e1952cdde0c2d48383cb749adaf0
MD5 06bde6cdbf145add5e8eb37380f4dba6
SHA1 1878b74e0dc97ec6d64b98fa5a28a72a0836bf7e
SHA512 dea67ae41296739ed0f0c28a0ce7d83b84edd244ad6cd715732246d5e89e621eb8f92206f3920a1eb30fb080372abd6e39edda3762c723abe7a49251d67ba230
SSDEEP 12288:bCJnJ5D3Vkrmzxa45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkS:WJnJ5D3WO3Yz7KEMdX6keYnAcerH
TLSH
T17285D02DD2A810E4E4B7C274829A1745FF72386D2F226AC728B4D5357F12FE09979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 81f3d49bd928edb17fd3901eb506ee0fff0db1f3c0a95a532b4e040d539cbddb
MD5 5e2c268e0f4e13ec7968aecf739a7cc7
SHA1 3199e193acb351ff704cf67c7f49d867a1c98d67
SHA512 d229e1a6d9cb7ac83a64f794a2925da3f2c2d04ee2aa025be0bb1c154d9beaf73e708bbed24f1112dbaab4bebda6f135e99aa5e0c2ea271c98181d99e68d5c17
SSDEEP 24576:dEPghm6/7IIXdwcXrif7qQncjlP65i3VuSYz7KEMdX6keYnAcerQ:qg06DIKdwc+eQnSt65aV1YPKEnSG
TLSH
T188956C15B7EA5294E8B3CAB1CA6291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.6MB
SHA256 a6e84bc100b7653646acb6946b6932e57036d35e1eddb4bb5410951c9ab55408
MD5 41b0ce3dd1a20e12dca885ce128e1fb9
SHA1 67d60951c07ff88338b6f7f6bb4c75994a858bfc
SHA512 8b557daf12d58decc59016e61e31ed2a230712e90eb45737d479a60c7c90ff7208be313506f91ab307f86f380f441553f13b29b02a5ed957ed3deced5156ac65
SSDEEP 12288:2EP3RGZ45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk7:1GmYz7KEMdX6keYnAcerG
TLSH
T16975121D2B9D60E1E42A913EE6A18500C372F0A12B5267EF56C4C23E8F7BAF51D3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 1b0a1c8b8292c22b81165cb9ca59e2f44ddced50226a6f7bb43fead4a64ea8fb
MD5 c4bc1e6a6cf3a6203434d8c8e07501e3
SHA1 31b2f75987ebbc5aabd22384f9375ab9d2b5ad09
SHA512 e22051b4c9bed0ccc1884bb3b31daa6982c8c52c4df32d345e94145c0c472a6a90638c65d7d3340ab4e7f75fbd0623238cd3f48538a09a8cf361e132d75c06c2
SSDEEP 12288:ajky145Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk2:aIyaYz7KEMdX6keYnAcerT
TLSH
T100751204539855C1F8BA4639EAB28190CA35BC612F1493EF9484F63F6F7BBE09C34B56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 f9467b75590226cc8feeb8f69258ba7092a0d03624185302d59f6565f4a18774
MD5 aa8c45ab5968ac2f92418d40fb5e6e96
SHA1 6716ef1d0cd66bc18a6814a1eb390b6526cddd05
SHA512 fe2ae4b712f795ceb737f01a889a599cb3c3f265194e4eba3b60e80475e6964dfe5a4e2e3f1de0617d34b2476caaf817d40603862104010e229c9f876b6c70d0
SSDEEP 12288:rQL45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkS:M0Yz7KEMdX6keYnAcerP
TLSH
T14F65230C461B59C2F80A427BFBB54940853679D63B4852FB98CCF562C7BE6E24435F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 a9f3f9cec5c6d9f3ec723577e3fdf7c1840e8972ce80e4a8739ab192238fbc63
MD5 28d4bc4c720bc2c7b36146e23ab112cf
SHA1 87cc7251cf961c2aaf33f29ff0a223c879da6b10
SHA512 765c0c57f06cb748d2f843d04d6f453602737b3883bb6073b58a8515cc07368e59b4561eca72870a257bc844e6fc1af8077b01e4adbcdca124ac6cbc5e460c60
SSDEEP 24576:1Q9MxZKdcz9dw3ZYz7KEMdX6keYnAcer/:1VKZZYPKEnSG
TLSH
T1DC558C2DABE9058AE177D27595A240C3A633B4311B35D6CF2448D03D4E7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 ec865bd39b914fbfb5b6f99eb83456e8f64b34f1902ddbd2880f8930e00a7d57
MD5 6bad3ec96b8df23223887b0dbbd84645
SHA1 8e750e8863949b42411b8f563a1503cc29b7d966
SHA512 5cec32dbbc2c628d80826c889ed088eee6957d5923f1145a5d15be641fd5c785fd3807477e51b5f9f48703512816bac9557f8f6fad424849df642e451b3d91cb
SSDEEP 12288:UyoKo2oRple9pJ45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkw:UyocOApWYz7KEMdX6keYnAcerl
TLSH
T15285E01FBB6E40E2E066813C89858745E773B0702B6253DB5581C33E8F67AE9BD34B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 e8fa6891adfd1c348ed610e54d680d13bc778835b03f09ade4adfd4baa94d115
MD5 714cdae95d1d4e3ea9624fd83caca8a0
SHA1 ec59de83f1a1bb73dd2318a57cbf727d46e76848
SHA512 912b9513274c33bdb41436eab20fd16ccacadf748da50dbcdc78a6926906c867e0fb7d46fd99b82088dee195d905a1ca8195c5eb2bd9294866b958a3a61daea6
SSDEEP 49152:zWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKWYPKEnSG:z0zuNIIYPKES
TLSH
T156A57C3DA2BC00A9D8AAC375C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 74bd39b42d45fb9be5fd531aec83fa8a443fa0f79a0436d06add5ff8e8cadabf
MD5 125b4d9e3ea0c8a0d430744f5d2e78d1
SHA1 20596fc86a25cc8efa056ae0d30b5da67df17055
SHA512 19052b6462065f0eb146425cb6bc33a1c28785f736bfd22b1107b317cd83479900dca9c4a08b5e966ca4c49fd3a75846e7727ea5d8739adfda8edbf9d9869d5e
SSDEEP 24576:r1QT7EcpfxR+N5AWAz3ooiYtjMqbzYz7KEMdX6keYnAcert:WTDxR+N5YzTfjMEYPKEnSG
TLSH
T1C155B02EA7F905E5D1BE85799B23C502FA727861033193CB42A0C17E1F6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.8MB
SHA256 336aa1c1f90db503fc9652a8e8326f91c4812119e6a7033cfb3b28dc7f8e7ead
MD5 7cc3eda32f9376db1649035fb46f9a7a
SHA1 2a9218d5c1bc6cdc1ff5e84f3b91b842d7582f93
SHA512 4fabf9d7396f3babf07f51ab1931d7e10b8a5aa5646f5f46a392d953a01856e1acbe6c4bbdc12a0ff726236c29e587e273e74cd9c63894560f0cb437c22e93d0
SSDEEP 24576:rTMdOz0FFS+RmSLPYz7KEMdX6keYnAcerI:50K+RmSLPYPKEnSG
TLSH
T1B385F13EA36D14E5E47BC27DDA538906E67234620321A6DB06D0C1792FABFE47939F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 c3eec2d3e6f563ab91ed5616b1ded42c47b807266e86cb54071d33db85593ad8
MD5 ee97435f884294540618a4f7430d81dc
SHA1 ee5ece2bfa23f405e3ca823a1b2da20eb722c96c
SHA512 d0a528760842d55e782ffba93ed13515d6ceef9eff44bebb4b525416c59acd7f304403e6f7d92d80252e571702ab69395e5c727661194976e32b56e15b3ba0f3
SSDEEP 12288:m4/345Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk2:5IYz7KEMdX6keYnAcerj
TLSH
T1B175120C13ED34D1F466827AEB764101C631BCA6272857FF28C8D5768F7BAE18939B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/900-175-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/900-166-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/900-172-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/900-433-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/1344-359-0x0000000140000000-0x000000014017E000-memory.dmp

Download

memory/1344-145-0x0000000140000000-0x000000014017E000-memory.dmp

Download

memory/1404-94-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1404-59-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1624-187-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1624-460-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1684-503-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1684-195-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1712-230-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1712-507-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1712-247-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1712-206-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1712-875-0x000000000CE40000-0x000000000CE48000-memory.dmp

Download

memory/1712-214-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1836-131-0x00000000006E0000-0x0000000000747000-memory.dmp

Download

memory/1836-126-0x00000000006E0000-0x0000000000747000-memory.dmp

Download

memory/1836-133-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/1836-194-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/1924-184-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1924-182-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1968-174-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1968-71-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1968-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1968-74-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2388-42-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/2388-43-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2388-137-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/2388-36-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2388-44-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2500-200-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/2500-138-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/2796-505-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/2796-201-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/3360-27-0x0000000140000000-0x00000001404BF000-memory.dmp

Download

memory/3360-9-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/3360-8-0x0000000140000000-0x00000001404BF000-memory.dmp

Download

memory/3360-0-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/3676-156-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3676-387-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3676-154-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/3676-148-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4052-91-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/4052-86-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/4052-78-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4052-84-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4052-89-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4280-504-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4280-205-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4280-141-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4384-95-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4384-181-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4544-136-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/4544-30-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/4616-191-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4616-481-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4668-186-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/4668-106-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4668-108-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/4668-100-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4800-122-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/4800-190-0x0000000140000000-0x0000000140193000-memory.dmp

Download

memory/4800-121-0x0000000140000000-0x0000000140193000-memory.dmp

Download

memory/4800-113-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/4820-21-0x0000000140000000-0x00000001404BF000-memory.dmp

Download

memory/4820-12-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4820-120-0x0000000140000000-0x00000001404BF000-memory.dmp

Download

memory/4820-18-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/5064-443-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/5064-178-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/5380-435-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5380-441-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5380-447-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5380-501-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5424-863-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5424-454-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/5424-448-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/5424-457-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5512-461-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5512-467-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5512-478-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5512-495-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5580-864-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5580-472-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/5580-479-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/5580-484-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5688-909-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-905-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-918-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-917-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-916-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-915-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-914-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-913-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-912-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-911-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-910-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-927-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-908-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-907-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-906-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-919-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-928-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-929-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-904-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-901-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-902-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-903-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-900-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-899-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-898-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-920-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-921-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-922-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-923-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-924-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-925-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download

memory/5688-926-0x0000022458C30000-0x0000022458C40000-memory.dmp

Download