4415bd6a2d443fd416b488b0c7e36e4de2a5824b274ce5ccc61383f3210c2fb3

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Size 4.3MB
Sample260522-d1cd4sgv2y
SHA256 4415bd6a2d443fd416b488b0c7e36e4de2a5824b274ce5ccc61383f3210c2fb3
MD5 14914c720564471c660561191c58ac5a
SHA1 a984b3b93d92921678682cf84f892e2f1fde3939
SHA512 4c64cdb92d9e5ba0ec3804779566717763f7aa7c271c03420bd0016079f85cd76256f1e36a15b6e8168dd8994f36ee49c17e13a62c1cfb23589686f9273b4aed
SSDEEP 49152:YY9CEJUnhoX4C2zQ1bu+pYWzoqStXt8QuFbtuUTVQtixT2tdnYz5d6JgCg:GEjWz8i+pRWalvTySVz50GC
TLSH
T1BE269D17F68903F9C09AC1759B579162F626BC2A1B3562DF364CB2241F7AEE0477E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 22 IoCs

pid	Process
2544	alg.exe
2156	DiagnosticsHub.StandardCollector.Service.exe
540	fxssvc.exe
4344	elevation_service.exe
3180	elevation_service.exe
2232	maintenanceservice.exe
2520	msdtc.exe
4640	OSE.EXE
3356	PerceptionSimulationService.exe
1576	perfhost.exe
4880	locator.exe
1708	SensorDataService.exe
5272	snmptrap.exe
5780	spectrum.exe
5356	ssh-agent.exe
5648	TieringEngineService.exe
5692	AgentService.exe
5508	vds.exe
5828	vssvc.exe
5884	wbengine.exe
5904	WmiApSrv.exe
5504	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dabe1a0b3a3ba122.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\scoped_dir4444_623975667\Default\Login Data	chrome.exe
File opened for modification	C:\Program Files\scoped_dir224_2052043499\Default\Cache\Cache_Data\f_000002	chrome.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File created	C:\Program Files\scoped_dir224_2052043499\Default\Local Storage\leveldb\000003.log	chrome.exe
File opened for modification	C:\Program Files\scoped_dir224_2052043499\Default\Safe Browsing Network\Safe Browsing Cookies-journal	chrome.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\scoped_dir224_2052043499\Default\WebStorage\QuotaManager	chrome.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File created	C:\Program Files\scoped_dir4444_623975667\Default\optimization_guide_hint_cache_store\LOG	chrome.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\scoped_dir4444_623975667\Default\ServerCertificate	chrome.exe
File created	C:\Program Files\scoped_dir224_2052043499\Default\shared_proto_db\000003.log	chrome.exe
File created	C:\Program Files\scoped_dir224_2052043499\Default\DawnWebGPUCache\data_0	chrome.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files\scoped_dir4444_623975667\GraphiteDawnCache\data_1	chrome.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\scoped_dir4444_623975667\Default\Site Characteristics Database\CURRENT	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4444_623975667\Default\Cache\Cache_Data\index	chrome.exe
File opened for modification	C:\Program Files\scoped_dir224_2052043499\Default\Top Sites	chrome.exe
File opened for modification	C:\Program Files\scoped_dir224_2052043499\Default\Network\Cookies-journal	chrome.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File created	C:\Program Files\scoped_dir224_2052043499\Default\shared_proto_db\metadata\000001.dbtmp	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4444_623975667\Default\Network Action Predictor	chrome.exe
File created	C:\Program Files\scoped_dir4444_623975667\Default\Web Applications\Temp\scoped_dir4276_603428984\Icons\64.png	chrome.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\scoped_dir224_2052043499\segmentation_platform\ukm_db	chrome.exe
File opened for modification	C:\Program Files\scoped_dir224_2052043499\Default\parcel_tracking_db\LOCK	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4444_623975667\Default\Extension Scripts\LOCK	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4444_623975667\GrShaderCache\data_3	chrome.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\scoped_dir4444_623975667\Default\History	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4444_623975667\Default\LOCK	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4444_623975667\Default\Local Storage\leveldb\LOCK	chrome.exe
File opened for modification	C:\Program Files\scoped_dir224_2052043499\Default\Service Worker\Database\LOCK	chrome.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files\scoped_dir4444_623975667\Default\Extension Scripts\000001.dbtmp	chrome.exe
File created	C:\Program Files\scoped_dir4444_623975667\Default\Session Storage\000001.dbtmp	chrome.exe
File created	C:\Program Files\scoped_dir4444_623975667\Default\Code Cache\wasm\index	chrome.exe
File created	C:\Program Files\scoped_dir4444_623975667\Default\Feature Engagement Tracker\EventDB\LOG	chrome.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\scoped_dir4444_623975667\Default\Extension Rules\LOCK	chrome.exe
File created	C:\Program Files\scoped_dir224_2052043499\Default\Extension Rules\000003.log	chrome.exe
File created	C:\Program Files\scoped_dir224_2052043499\Default\shared_proto_db\metadata\000003.log	chrome.exe
File created	C:\Program Files\scoped_dir224_2052043499\c4f48f14-4a71-4ae0-afec-98c40c06b12d.tmp	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4444_623975667\Default\Network\050162c5-393a-42fd-8074-5bd0211ad29b.tmp	chrome.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\scoped_dir4444_623975667\Default\Service Worker\Database\LOCK	chrome.exe
File created	C:\Program Files\scoped_dir224_2052043499\Default\DawnGraphiteCache\data_1	chrome.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\scoped_dir4444_623975667\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\index	chrome.exe
File opened for modification	C:\Program Files\scoped_dir224_2052043499\Default\Code Cache\wasm\index-dir\the-real-index	chrome.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File created	C:\Program Files\scoped_dir4444_623975667\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png	chrome.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files\scoped_dir4444_623975667\Default\Site Characteristics Database\000001.dbtmp	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4444_623975667\Default\Session Storage\LOCK	chrome.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File created	C:\Program Files\scoped_dir4444_623975667\Default\Web Applications\Temp\scoped_dir4276_480535541\Icons\64.png	chrome.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1468	chrome.exe
1316	chrome.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ccaa2d1a9be9dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134238941070153638"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000082bc5f1a9be9dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000099cdb01a9be9dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb99fb199be9dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000820c4f1a9be9dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003ea4c81a9be9dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e65d001a9be9dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a697391a9be9dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000005be41b9be9dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{DFF20505-B08F-455B-AD70-4FBD055088E0}\LocalServer32	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{DFF20505-B08F-455B-AD70-4FBD055088E0}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{DFF20505-B08F-455B-AD70-4FBD055088E0}\LocalServer32	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{DFF20505-B08F-455B-AD70-4FBD055088E0}	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{DFF20505-B08F-455B-AD70-4FBD055088E0}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4276	chrome.exe
4276	chrome.exe
4932	chrome.exe
4932	chrome.exe
2156	DiagnosticsHub.StandardCollector.Service.exe
2156	DiagnosticsHub.StandardCollector.Service.exe
2156	DiagnosticsHub.StandardCollector.Service.exe
2156	DiagnosticsHub.StandardCollector.Service.exe
2156	DiagnosticsHub.StandardCollector.Service.exe
2156	DiagnosticsHub.StandardCollector.Service.exe
2156	DiagnosticsHub.StandardCollector.Service.exe
4344	elevation_service.exe
4344	elevation_service.exe
4344	elevation_service.exe
4344	elevation_service.exe
4344	elevation_service.exe
4344	elevation_service.exe
4344	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
4276	chrome.exe
4276	chrome.exe
4276	chrome.exe
4276	chrome.exe
4276	chrome.exe
4276	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4932	chrome.exe
4276	chrome.exe
4276	chrome.exe
4932	chrome.exe
4932	chrome.exe
4276	chrome.exe
4276	chrome.exe
4276	chrome.exe
4276	chrome.exe
4276	chrome.exe
4276	chrome.exe
4276	chrome.exe
4276	chrome.exe
4276	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4444	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeAuditPrivilege	540	fxssvc.exe
Token: SeShutdownPrivilege	4276	chrome.exe
Token: SeCreatePagefilePrivilege	4276	chrome.exe
Token: SeShutdownPrivilege	4276	chrome.exe
Token: SeCreatePagefilePrivilege	4276	chrome.exe
Token: SeShutdownPrivilege	4276	chrome.exe
Token: SeCreatePagefilePrivilege	4276	chrome.exe
Token: SeShutdownPrivilege	4276	chrome.exe
Token: SeCreatePagefilePrivilege	4276	chrome.exe
Token: SeShutdownPrivilege	4276	chrome.exe
Token: SeCreatePagefilePrivilege	4276	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeRestorePrivilege	5648	TieringEngineService.exe
Token: SeManageVolumePrivilege	5648	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5692	AgentService.exe
Token: SeBackupPrivilege	5828	vssvc.exe
Token: SeRestorePrivilege	5828	vssvc.exe
Token: SeAuditPrivilege	5828	vssvc.exe
Token: SeBackupPrivilege	5884	wbengine.exe
Token: SeRestorePrivilege	5884	wbengine.exe
Token: SeSecurityPrivilege	5884	wbengine.exe
Token: SeShutdownPrivilege	4276	chrome.exe
Token: SeCreatePagefilePrivilege	4276	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4276	chrome.exe
Token: SeCreatePagefilePrivilege	4276	chrome.exe
Token: 33	5504	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5504	SearchIndexer.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4276	chrome.exe
Token: SeCreatePagefilePrivilege	4276	chrome.exe
Token: SeShutdownPrivilege	4276	chrome.exe
Token: SeCreatePagefilePrivilege	4276	chrome.exe
Token: SeShutdownPrivilege	4932	chrome.exe
Token: SeCreatePagefilePrivilege	4932	chrome.exe
Token: SeShutdownPrivilege	4276	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4276	chrome.exe
4932	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 1608	4444	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	86
PID 4444 wrote to memory of 4276	4444	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	87
PID 4276 wrote to memory of 4280	4276	chrome.exe	88
PID 4276 wrote to memory of 3280	4276	chrome.exe	92
PID 4276 wrote to memory of 3280	4276	chrome.exe	92
PID 4276 wrote to memory of 1468	4276	chrome.exe	93
PID 4276 wrote to memory of 4428	4276	chrome.exe	94
PID 4276 wrote to memory of 4428	4276	chrome.exe	94
PID 4276 wrote to memory of 1280	4276	chrome.exe	97
PID 4276 wrote to memory of 780	4276	chrome.exe	98
PID 4276 wrote to memory of 1280	4276	chrome.exe	97
PID 4276 wrote to memory of 780	4276	chrome.exe	98
PID 4276 wrote to memory of 4660	4276	chrome.exe	100
PID 4276 wrote to memory of 4416	4276	chrome.exe	101
PID 4276 wrote to memory of 4660	4276	chrome.exe	100
PID 4276 wrote to memory of 4416	4276	chrome.exe	101
PID 4276 wrote to memory of 692	4276	chrome.exe	103
PID 4276 wrote to memory of 692	4276	chrome.exe	103
PID 4276 wrote to memory of 1792	4276	chrome.exe	105
PID 4276 wrote to memory of 1792	4276	chrome.exe	105
PID 4276 wrote to memory of 2796	4276	chrome.exe	106
PID 4276 wrote to memory of 2796	4276	chrome.exe	106
PID 224 wrote to memory of 4020	224	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	110
PID 224 wrote to memory of 4932	224	2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	111
PID 4932 wrote to memory of 1528	4932	chrome.exe	112
PID 4932 wrote to memory of 3020	4932	chrome.exe	117
PID 4932 wrote to memory of 3020	4932	chrome.exe	117
PID 4932 wrote to memory of 1316	4932	chrome.exe	118
PID 4932 wrote to memory of 3792	4932	chrome.exe	119
PID 4932 wrote to memory of 3792	4932	chrome.exe	119
PID 4932 wrote to memory of 5264	4932	chrome.exe	121
PID 4932 wrote to memory of 5264	4932	chrome.exe	121
PID 4932 wrote to memory of 5312	4932	chrome.exe	123
PID 4932 wrote to memory of 5312	4932	chrome.exe	123
PID 4932 wrote to memory of 5388	4932	chrome.exe	124
PID 4932 wrote to memory of 5420	4932	chrome.exe	125
PID 4932 wrote to memory of 5388	4932	chrome.exe	124
PID 4932 wrote to memory of 5420	4932	chrome.exe	125
PID 4932 wrote to memory of 5708	4932	chrome.exe	126
PID 4932 wrote to memory of 5708	4932	chrome.exe	126
PID 4932 wrote to memory of 5948	4932	chrome.exe	128
PID 4932 wrote to memory of 5948	4932	chrome.exe	128
PID 4932 wrote to memory of 5628	4932	chrome.exe	131
PID 4932 wrote to memory of 5628	4932	chrome.exe	131
PID 5504 wrote to memory of 6588	5504	SearchIndexer.exe	140
PID 4276 wrote to memory of 7032	4276	chrome.exe	141
PID 4276 wrote to memory of 7072	4276	chrome.exe	142
PID 4276 wrote to memory of 7072	4276	chrome.exe	142
PID 4276 wrote to memory of 7080	4276	chrome.exe	143
PID 4276 wrote to memory of 7080	4276	chrome.exe	143
PID 5504 wrote to memory of 5788	5504	SearchIndexer.exe	146
PID 4932 wrote to memory of 6816	4932	chrome.exe	148
PID 4932 wrote to memory of 6880	4932	chrome.exe	149
PID 4932 wrote to memory of 6888	4932	chrome.exe	150
PID 4932 wrote to memory of 6880	4932	chrome.exe	149
PID 4932 wrote to memory of 6888	4932	chrome.exe	150
PID 4276 wrote to memory of 4720	4276	chrome.exe	153
PID 4276 wrote to memory of 1352	4276	chrome.exe	154
PID 4276 wrote to memory of 900	4276	chrome.exe	155
PID 4276 wrote to memory of 4720	4276	chrome.exe	153
PID 4276 wrote to memory of 3976	4276	chrome.exe	156
PID 4276 wrote to memory of 1352	4276	chrome.exe	154
PID 4276 wrote to memory of 3976	4276	chrome.exe	156
PID 4276 wrote to memory of 900	4276	chrome.exe	155

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=149.0.7799.0 --initial-client-data=0x2a0,0x2a4,0x2a8,0x29c,0x2ac,0x140396af4,0x140396b00,0x140396b10
  2⤵
  PID:1608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --disable-features=LoadLowEngagementPEHFeaturesToPrefs
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Program Files\scoped_dir4444_623975667" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\scoped_dir4444_623975667\Crashpad" "--metrics-dir=C:\Program Files\scoped_dir4444_623975667" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff53afc728,0x7fff53afc734,0x7fff53afc740
    3⤵
    PID:4280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1888,i,8031321704185125318,3602607429102742142,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1884 /prefetch:2
    3⤵
    PID:3280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --force-high-res-timeticks=disabled --field-trial-handle=1888,i,8031321704185125318,3602607429102742142,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2132 /prefetch:3
    3⤵
    - Drops file in Program Files directory
    - System Time Discovery
    PID:1468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --force-high-res-timeticks=disabled --field-trial-handle=1888,i,8031321704185125318,3602607429102742142,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2388 /prefetch:8
    3⤵
    PID:4428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1888,i,8031321704185125318,3602607429102742142,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3136 /prefetch:1
    3⤵
    PID:1280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1888,i,8031321704185125318,3602607429102742142,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3192 /prefetch:1
    3⤵
    PID:780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1888,i,8031321704185125318,3602607429102742142,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:4660
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1888,i,8031321704185125318,3602607429102742142,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3596 /prefetch:2
    3⤵
    PID:4416
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1888,i,8031321704185125318,3602607429102742142,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4228 /prefetch:2
    3⤵
    PID:692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1888,i,8031321704185125318,3602607429102742142,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4604 /prefetch:1
    3⤵
    PID:1792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --force-high-res-timeticks=disabled --field-trial-handle=1888,i,8031321704185125318,3602607429102742142,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4828 /prefetch:8
    3⤵
    PID:2796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --force-high-res-timeticks=disabled --field-trial-handle=1888,i,8031321704185125318,3602607429102742142,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5804 /prefetch:8
    3⤵
    PID:7032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1888,i,8031321704185125318,3602607429102742142,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5908 /prefetch:1
    3⤵
    PID:7072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1888,i,8031321704185125318,3602607429102742142,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5940 /prefetch:1
    3⤵
    PID:7080
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1888,i,8031321704185125318,3602607429102742142,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6200 /prefetch:1
    3⤵
    PID:4720
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1888,i,8031321704185125318,3602607429102742142,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5136 /prefetch:1
    3⤵
    PID:1352
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --force-high-res-timeticks=disabled --field-trial-handle=1888,i,8031321704185125318,3602607429102742142,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5816 /prefetch:8
    3⤵
    PID:900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --force-high-res-timeticks=disabled --field-trial-handle=1888,i,8031321704185125318,3602607429102742142,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6048 /prefetch:8
    3⤵
    PID:3976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --force-high-res-timeticks=disabled --field-trial-handle=1888,i,8031321704185125318,3602607429102742142,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6284 /prefetch:8
    3⤵
    PID:6788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --force-high-res-timeticks=disabled --field-trial-handle=1888,i,8031321704185125318,3602607429102742142,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3876 /prefetch:8
    3⤵
    PID:7096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=1888,i,8031321704185125318,3602607429102742142,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6220 /prefetch:1
    3⤵
    PID:5636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --force-high-res-timeticks=disabled --field-trial-handle=1888,i,8031321704185125318,3602607429102742142,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5948 /prefetch:8
    3⤵
    PID:5728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --force-high-res-timeticks=disabled --field-trial-handle=1888,i,8031321704185125318,3602607429102742142,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5920 /prefetch:8
    3⤵
    PID:5744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=1888,i,8031321704185125318,3602607429102742142,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3796 /prefetch:1
    3⤵
    PID:5608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=1888,i,8031321704185125318,3602607429102742142,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6220 /prefetch:1
    3⤵
    PID:6932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=1888,i,8031321704185125318,3602607429102742142,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5908 /prefetch:1
    3⤵
    PID:3344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=1888,i,8031321704185125318,3602607429102742142,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5720 /prefetch:1
    3⤵
    PID:6924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=1888,i,8031321704185125318,3602607429102742142,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5904 /prefetch:2
    3⤵
    PID:6184
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4444_623975667" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=1888,i,8031321704185125318,3602607429102742142,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3852 /prefetch:2
    3⤵
    PID:5256

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2544

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2068

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:540

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3180

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2232

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2520

C:\Users\Admin\AppData\Local\Temp\2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_14914c720564471c660561191c58ac5a_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=149.0.7799.0 --initial-client-data=0x29c,0x2a0,0x2a4,0x298,0x2a8,0x140396af4,0x140396b00,0x140396b10
  2⤵
  PID:4020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --user-data-dir="C:\Program Files\scoped_dir224_2052043499" --disable-features=LoadLowEngagementPEHFeaturesToPrefs
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Program Files\scoped_dir224_2052043499" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\scoped_dir224_2052043499\Crashpad" "--metrics-dir=C:\Program Files\scoped_dir224_2052043499" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff53afc728,0x7fff53afc734,0x7fff53afc740
    3⤵
    PID:1528
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir224_2052043499" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1884,i,8742710896348469886,15023060989371167898,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1880 /prefetch:2
    3⤵
    PID:3020
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir224_2052043499" --force-high-res-timeticks=disabled --field-trial-handle=1884,i,8742710896348469886,15023060989371167898,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2104 /prefetch:3
    3⤵
    - Drops file in Program Files directory
    - System Time Discovery
    PID:1316
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir224_2052043499" --force-high-res-timeticks=disabled --field-trial-handle=1884,i,8742710896348469886,15023060989371167898,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2372 /prefetch:8
    3⤵
    PID:3792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir224_2052043499" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1884,i,8742710896348469886,15023060989371167898,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3172 /prefetch:1
    3⤵
    PID:5264
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir224_2052043499" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1884,i,8742710896348469886,15023060989371167898,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:5312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir224_2052043499" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1884,i,8742710896348469886,15023060989371167898,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:5388
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir224_2052043499" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1884,i,8742710896348469886,15023060989371167898,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3600 /prefetch:2
    3⤵
    PID:5420
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir224_2052043499" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1884,i,8742710896348469886,15023060989371167898,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4420 /prefetch:2
    3⤵
    PID:5708
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir224_2052043499" --force-high-res-timeticks=disabled --field-trial-handle=1884,i,8742710896348469886,15023060989371167898,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:8
    3⤵
    PID:5948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir224_2052043499" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1884,i,8742710896348469886,15023060989371167898,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4548 /prefetch:1
    3⤵
    PID:5628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir224_2052043499" --force-high-res-timeticks=disabled --field-trial-handle=1884,i,8742710896348469886,15023060989371167898,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5936 /prefetch:8
    3⤵
    PID:6816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir224_2052043499" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1884,i,8742710896348469886,15023060989371167898,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6036 /prefetch:1
    3⤵
    PID:6880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir224_2052043499" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1884,i,8742710896348469886,15023060989371167898,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6076 /prefetch:1
    3⤵
    PID:6888

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4640

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3356

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1576

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4880

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1708

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5272

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:6040

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5356

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5648

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5692

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5508

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5828

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5884

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5904

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5504
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6588
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c2978f84233213ec27f25988aeb8144102a2316ffeb0f0d02b798d35bca78546
MD5 5a6076ec92dc28945f672ffe8f0c81f1
SHA1 8f802e29a6716bfebfc38b6255c1593a5822406c
SHA512 c9f1792934635cd5cc3e78236244d2d22c962f54a30eadff1b22adcc9676469a5df59b04eef4e846faff08696ef61517646cd7f73fc9dc073969deefd60e8ded
SSDEEP 49152:pb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnuttdnYz5d6JgCg:/3q6mjBsz50GC
TLSH
T140D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 9a1b2c9bf73f431aaf0fcfa0b214254d1a4841788467fb2014a94941a3d2a9a8
MD5 0858309cb24087198e4372212d18892b
SHA1 5777a6e0b6502ebea89a9208e09507ef61c069c2
SHA512 b27ba54fd153c57838d3811a9a93eff3020f1e32175aecee92b41dfce6f5507f429333815ed50b8670edbfccd0acfdf823d03e045fc6834e1842fb6ca2eeb8f3
SSDEEP 24576:RXYfDtczApttdykir8q0Hsw47opM6g9+JVuOUj7Cg8:0tcwttdnYz5d6JgCg
TLSH
T16185016973E408F9ED6B8178CCA2C501EA737C5547A0E6DB03E4A9254F336C85E3EB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 abd7bb5c1968b654bc5baf6e22c48b62746b4d2cef6d5a264c16c788b8816ebc
MD5 daacecfc79b10f970ede61d72003a1c6
SHA1 95ad3515406a3c8196f0088ae352e74b6c8ae37a
SHA512 1f98f7613a7176984f4a343f41b2a53820aaf5ae7c61c14381f988d742eec6b797c54c50c01ae8947292724b649d90cbb738aa33588f67cefbf1d3ad3c7e8abf
SSDEEP 24576:AwuROW7ttdykir8q0Hsw47opM6g9+JVuOUj7Cg8:AwSO4ttdnYz5d6JgCg
TLSH
T12675F18672A80CF9E9A78239C547C535F7F6BC022A65CB2F5360C65B5F37250AE2DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0e2dacbcfe3e13bf030caf2c7ea330ae6db2497a5f379c1366da428e2d1a5b41
MD5 bf63da08cd7b0c4d2e0a484f8939a4d4
SHA1 c14a39c6b5ab67c3dc74cca1804d215ce0b86fd4
SHA512 d5ff572c5f67aaef9cb0128f6e5c084b3f1d5a4245ce0f8a4c280083833d383297cf0abe7a78c05cad3b6df0ecacdacd7770cafa3c6b0f36c17ce4fd3101829b
SSDEEP 49152:IB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl5ttdnYz5d6JgCg:Cu6JmIxd2d4z50GC
TLSH
T12ED59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Program Files\scoped_dir224_2052043499\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files\scoped_dir224_2052043499\Crashpad\settings.dat
Size 40B
SHA256 f9a66461c005264abc2256685fe8bd9045d109f28d9fd05afeda0037f917b9fa
MD5 56915e1b73be24bcce905960f6e87cf4
SHA1 c002f77609b2699838e765278d70ee5fa1416047
SHA512 a0f74c58d9aac150d09f8675d10822322c47be9b23a1ae86dbbaa48ac3dc134aa516f0ab7ea289e3c153dc26aad0f382c79910f4d060e9f5882d458dc7ea1203
MD5 SHA1 SHA512

Submit Download

Account Web Data

Path C:\Program Files\scoped_dir224_2052043499\Default\Account Web Data
Size 76KB
SHA256 4f3e18eea355690c25b4de99b18e90f0c81cbb088228ffca12c84a53c6dff98f
MD5 b89fd902b32528a846212c73a9bfbe73
SHA1 b2bc3a06c5bf56df8b8245e2947e7f78fb6a416d
SHA512 ae387b21b2d3801abe3543f23d1705b51982e4f076c923cfee764f3ea525ce276d8360623be00d402ed7c804f801e36ba42b68d32a5f6e856e153d6b96ea750b
SSDEEP 96:pv+kOyOFXmT7i04MDDPtg3IM8n0ys5bSAoFLoeqclNz58rx2n:pln06Ca
TLSH
T15A73224A7A342505EDE28A362CF090F75D7C722D8F01A9412DA73028CDA5897F23A4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Affiliation Database

Path C:\Program Files\scoped_dir224_2052043499\Default\Affiliation Database
Size 52KB
SHA256 4cb381b1a653296a38381f16bfd94dd09b9c900c0ed24eb532d372d647bcb96e
MD5 142456354ac4a1d7e89f037c2ebda0a2
SHA1 60b5e6036da7c3c1e4e10dc04c319e55cd125152
SHA512 cad919e47513bfbc050db3a996811643f5381ecbe3224c5ed34bf7dcfdec993d7a5e0af674f36625648866b4fad55578ab7427be38c17f6d9eb74403da02960d
SSDEEP 24:TL9VAlZGUWEKdPq9XUeS0z8jNvN2HhKroyr0d8D4BmhltoVOq6Uwccm5fBGQww:TbBzdPqJZSm86Uu8baVOlU1cWB
TLSH
T18F33DF061B685434C9ADD23498D90EE279B4126FD9D1E9A42DFC1D190FE04546CFD46B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Program Files\scoped_dir224_2052043499\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 db3e9a6a4768aa9f0dd71dfe77bb9ffd7e23abf88dab8a5e3874a1a3022497a4
MD5 8ee903428a18d3613c69adac2236e40b
SHA1 9ff4a2508549e5753d60688f444d16300fc54980
SHA512 56d3a0bdef2bea8d32ecca575bc556bbd5c7cd94c426e9c24c53a39a830f06ab6a79fda6888d4c524655d1ede104e8d69d2e5655989c1f6d32aa5e8a6d65ccef
SSDEEP 6:/FoEXEGCTH9ikNMT0VOcg/91H8l9haFW4vDgkiaPqPwxP+EXIrg/eugnGkllatg7:d7XXKVNE+4H9ngayPwxmE+64L/8zKv
TLSH
T1B213A72DC6E41E47C9D8913D954BAFF623F1C211D79083A332717021354534F704E229
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Program Files\scoped_dir224_2052043499\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 3772489258b92ea0dd5017bfbcc5252336553184a0036a06e06238a94650a251
MD5 6bd2bd9267734ba350467237a6f66d57
SHA1 706fb62478ccd4920aeceda537ba3126edd0a12b
SHA512 47aed4c48c9b0cbe4974c5e5f770bcd012ca41ab4f7d1bdd3bcd0d084cd07697571cd649f277e3a291bfb49436e7f987dc06d720c94ba434afced61fca947b20
SSDEEP 48:uh/SXYdJS70sM1XgmC0X2rMmXWveRydVEPLVBKWwtl:u3dJbsugmn2rjW26VOLHKWol
TLSH
T10C4494F71901DDCAE768DBB81C42933CCE7386261D8DEE79F23844B64091AE321186B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Program Files\scoped_dir224_2052043499\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 7eb584df3c1dd5140da09f04448d26ffa06b0bb59ad82157ab432101412b8701
MD5 828fa368be9787d1afa8a020746241f2
SHA1 80adb3e8dcdbc5035074ee2ffed0e8482cde2eb1
SHA512 f6394340903ea89ca3e604ece53f8f8f415b84264879725a5c1a201a1fc35710996e5182f3142fd7ea63a1e6c1a053fb0b9348cb0ad1decf2461ef6f75726cb8
SSDEEP 48:ppxoZkYK2pS9oBF5g8dKeuvx1GUrGafgo0xHrDFv99X0lZH9/Aufwjj0wf5:90zoeV5dIvx1GUrbmLDFvDX0Vxwj4A
TLSH
T1B3250AF6FE18183BC04355BA4BC17D8BCBE58321C05954534A785518BE19A85C5522AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Program Files\scoped_dir224_2052043499\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 b12551eb9cc165d8048bbbfbfeef362f0486357f6d51e39470d2fb11ea8963b6
MD5 5a4a9032305d30d52f56ce211b94d018
SHA1 0e120b7d2ed1f410d06b698f46f6881cdbc0213b
SHA512 5b8d2d71692f63f13206e0d4fe5d32a3b7b5fb8c97a93d568ab0045ed9d6eea79e2bf656b069c3bf08ee77ba2b3954deed6de0614b708de127905d7437026146
SSDEEP 768:fUfDPLSgcRUv+sahv4FUfDPLSgcRUv+Xahv4pfDPLSgcRUv+Rahv4iUfDPLSgcRw:eaNaaNvaNSaNScD
TLSH
T117164BA20F286E42D681EBB0BBCDDD183CB12295AC975C82E522D2791DF0FC41B8516D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Program Files\scoped_dir224_2052043499\Default\Cache\Cache_Data\f_000001
Size 34KB
SHA256 0c26df9b43c65a8d98ce65b2e0a348266bba18186745b4708cabffc871642e52
MD5 a7d82efb22f09c56bca83f532953388e
SHA1 34d28027778e03f6bf468d82ec8d02df74b0ddec
SHA512 0214ff17d05c500fc91a7bcdd8085309b996987b238c7e8e9d4428a55a7796090868f78246f1b0af5225524a611806bc1b012bbb3bb4c5fc46ca4ab2d3cf2aa2
SSDEEP 768:gkNScq5/GppAKeWBGqrK3WKbrUY+eS/3Sfv2h1Oj:5/q5udDg34L3Sn2h1a
TLSH
T148F2F15778D46FBE8872D4E6B77186B09D14A2CB71100398FDF778A8148E2B9627EC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Program Files\scoped_dir224_2052043499\Default\Cache\Cache_Data\f_000002
Size 67KB
SHA256 8f9a1d2362f66337acbc53b184b0d2357181e528b07deda233bb523975d7a150
MD5 ff494801761ad6200f0dd1ff4a1271c4
SHA1 35f4c6c2ffb330a8f4b524fe605b1e5095a317c2
SHA512 685c2aed797913d1262e8884976fbb1326bcc71936e39c08692f0e0bf6234dbcf0881e30b62732d19c6ffe7935effa819f16ebd0d0ae6f46803fad2a802186c5
SSDEEP 1536:CMZwRZMNj/XLaLeY8MPvAXlkV/xEZh+HfkeRt3nIyXs40eM:YZMR/z6QXCPEAvjs5eM
TLSH
T1EA6302F5BA6DC5AE730A0D76A5CF8003F87A6697223508D58883D13F2DD1798BD602C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Program Files\scoped_dir224_2052043499\Default\Cache\Cache_Data\index
Size 256KB
SHA256 22900df153d0bb57f07717102ba2e77b00b8815917a72ac56b94d10a1c738012
MD5 326626124f2c66604ba29b53d2773194
SHA1 e6d1347f61046e2af69f67c09f5638c5021b6bf4
SHA512 b0508cfbdfcc0440102be9e711ef1fe5133546ac38d6211bc1b875e102bbe7f570f081b55143a9bac13045119655940c7546b81ee4d504ac543407008361badf
SSDEEP 3:LsLllFlklNllkll/lQX/allx/nnllll/jlmNtl3Nl/lell//GlXlNlXl:LsRa3lEtQXGBlllgNHklte
TLSH
T13D4401AD53952F16C2C422FD48438B6063B4D806EE8F87536708A2321DC57546E1F2A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Program Files\scoped_dir224_2052043499\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 2bbcec57969596000aee7957f886f1c94b2aed1f5b3037ca11cc006a15f738d6
MD5 169e6f240cd24ad7b1e0aa32dccee9f4
SHA1 a26dbcfc04419457140a6511b8e965bbdf157607
SHA512 71876e2f7ff18fd84d3136ddf8d00124dc8b23db2afc3ee17e399d476c2b0ad0d431f0a579949d6765c48b56d4ef4be7c12a7a03daea9b13f432351e3d9a42ed
TLSH
T194E02B81824C0F0DD32D97F7CEA703044B0E53C42ABE3603E8C0C2C133125281258223
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Program Files\scoped_dir224_2052043499\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

192.png

Path C:\Program Files\scoped_dir224_2052043499\Default\Web Applications\Temp\scoped_dir4932_643832241\Icons\192.png
Size 2KB
SHA256 e401220b69a76a298b2e081a5424af69791a4caa3936af85d8862c05f4ced4a8
MD5 e063d7ac57fed2391e778c3a5817bfed
SHA1 3fddfdcf2917af9ce0e86eddb03725d4a3cdd7cc
SHA512 0de76ca2917cb2162d73a3d61d83dab2795ef1e9ca0f057091cef9eb79c0064dcd13c4749521163e6f77dfe43e0afa68326a32b7c19d8524da509dfbf4f1cb7b
TLSH
T11651060A0759BDB22A31C07991B8D9E7DE0C1003A5BBDD7E19954FF0A913CE43B23681
MD5 SHA1 SHA512 TLSH

Submit Download

256.png

Path C:\Program Files\scoped_dir224_2052043499\Default\Web Applications\Temp\scoped_dir4932_643832241\Icons\256.png
Size 12KB
SHA256 6e8f581f4cee7f8f8af4a9e1059f0d3088b792de7045067d74254e2a6f1f9a6b
MD5 493ff5acf7b11c3f1147a8d9e25e7751
SHA1 6009b5d4c6cf66b4dea48b5c558fb9dfee261c4b
SHA512 684256b0a9d8169eb1c177068c0c04518dc1c1a6c2554c32beedcaf0bb4429902319ecb32d8c97671ba361de6e10e9275e8ef778f61934f38538f35b60a963bb
SSDEEP 192:Hlx0S8vKsNbVmc/vC0+e9JaSyw2X4RTv+ovsCF3vKY8XejYHvhX2kol0f993M:T0vdNbQ72iNXX6rsCFyYAZkh8LM
TLSH
T19A42BFA1B310ED73E30AEF2045FE64B0516C82217FE4A507D331D85ABF0FC9998A95A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96.png

Path C:\Program Files\scoped_dir224_2052043499\Default\Web Applications\Temp\scoped_dir4932_643832241\Icons\96.png
Size 3KB
SHA256 00f563fcf365eb53a4037624ab3783dd6e19d2c6689c9892aa30ad2b16577848
MD5 43400a5061af952e87a0e06e1062b272
SHA1 5b937e80e93bb5f526a964e2a28aa9579e8dccb6
SHA512 8f3f25039af799f055ea81a2008530562b4b24e8afd65b65566b6dd0cdcc66f3735bf0428bb3c4eaf7079ce15499de3846bcdfc1db0707db50e9f3bc2c5e7d6d
TLSH
T14F819F6325E9E9CAAA5ED62071224074845F04EF59313775F07C18BB13CA56DFD70E26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Program Files\scoped_dir224_2052043499\Local State
Size 230KB
SHA256 66c4b7631f1e04ddab3bf21ee71968a76b886beb9a3559359c7da19b9096a672
MD5 0afbc12d2eded00e460078bd78d00848
SHA1 94b182abc9426ec5ecd5a86382c0b2509b99a18a
SHA512 6959a0ca1deb50fe91953bd7c4146fcbaafba7682023fc6c1642b8e92d788789fbf10ae8eb4b31daabc5dedb2a43cb857e7855e4fca5bcdf8e3f235b50b1a44e
SSDEEP 3072:HCu8VkV+ugFCrBzBFXxmtoNh3evlmrDA7Gm7D5Lk17ox1tIpud63U8BehbCBi9fX:BV+ugEzBFBnelqzm7Rkm1tYpBeh2BAok
TLSH
T1DA3422774DA1EEB66DF1730FA42E0F6A6FB05AB34B14C9E1C4C42784629ABDC0685D1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Program Files\scoped_dir4444_623975667\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 2a2e922fb3eb8ba39fda6211cff75b9d6d6af138cd1fc1f1732d976a14563a3d
MD5 d2ac5abe72b911a9c4ff245dc873cd18
SHA1 450834c08f82b443801f0eca1ec84b4c29f5aba7
SHA512 7a270e6be5f9c0ffdf199ae0c4bde48e271bb0b2f085f485c625ac9fc9ca368c088df08fb86df4c9b40682040bef87c187a343ba6486b7bd3a659399de750f60
TLSH
T132A00210A2D00B19CFB003B934996759622249B5431353A382D540848DA7FE3C505346
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b570.TMP

Path C:\Program Files\scoped_dir4444_623975667\Default\Code Cache\js\index-dir\the-real-index~RFe58b570.TMP
Size 48B
SHA256 374f9f17d0e52402deb9e95899f412cc2fa6deba780fab322926580a0c7b950e
MD5 242d8c5fef6f213979babe846f7dc437
SHA1 42403fb6e0004125b19b18af0507beceaee7b8ad
SHA512 bf4cf03b844f6b5a17a6e8e973eb8d97fc0d23e63cf101e2a53688ae090dccd4ef3f2ddf116049169d62f648a841c4dfdeeb23e818a811c7ef589a7b5e9242db
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Program Files\scoped_dir4444_623975667\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Program Files\scoped_dir4444_623975667\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.106.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Program Files\scoped_dir4444_623975667\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.106.1_0\service_worker_bin_prod.js
Size 121KB
SHA256 dfd0ec0bc928d34168470caa909b172ce231abeec84c1c1a9f4fb56c5fc24bb6
MD5 c13e4b9d5de348199a68a781d9917134
SHA1 e099a794691befb662079203b41db4cd524d19bb
SHA512 5595a5cc09ce1faca8e808e4ae135bae2cc69b94cf7b52df736dd89ba9175734403f9394ffd8030e9bb4313130fccd41c1fe25c4ba1947e4f36fd586a21599fb
SSDEEP 3072:V8yXpHnHBP5oKvTNcpa/4Ybza33t8ZA7a:V7Z3vTDbza33t8qa
TLSH
T1BCC3E9CDB7A574624363A4B6002F000FB23AB8AAE44C85A8F189D9E97D7446D4377F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Program Files\scoped_dir4444_623975667\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Program Files\scoped_dir4444_623975667\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Program Files\scoped_dir4444_623975667\Default\Network\Network Persistent State
Size 2KB
SHA256 c249dce60f92bffbe5fd01f8a0f4888acd3152341420220447cfb51e49d2274a
MD5 832f6702a3567d0e14795c1ff8b7300f
SHA1 81427d61190b9d20613cb94c6314c7365e410807
SHA512 a49f9adb6fea809630ad851bc57e62f328564bc02476aac7ffc2bb81f70f1dbfb43bb5908a708f496f1b56fdd69758172719c98704556cc73b94ba20509c9d77
TLSH
T123517DB3C2E4866DC85156F4AB256E2BDD3D0A24621D3C5288D8EF4F53E29B2D20175E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe58c52f.TMP

Path C:\Program Files\scoped_dir4444_623975667\Default\Network\Network Persistent State~RFe58c52f.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Program Files\scoped_dir4444_623975667\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Program Files\scoped_dir4444_623975667\Default\Preferences
Size 8KB
SHA256 a2c602ed97333bcf29c0bf2e054f1e64b97398f0b31bcca251d2410989b3bccd
MD5 4896e73829cf01a3ea875ff8a1204ecd
SHA1 8decda3b8cd4e2498c87fe7624242d8b9f88630c
SHA512 38f2ec1536d3214d86bfc7b7fdc6b3f93ed1cc9604370027dfbacf5a6a792b0c664016460e379f061e5f838582a2d9e1c22673305e074f8d7a59f9c2ef95e595
SSDEEP 192:gR+A8Vb0v7u9PRp2iXsb+WNnH3bn2guWiyIsnAUge:gR+AgwGXhXwHLn2gMe
TLSH
T13312812DBD18A53B9CC6E319FA257742E7F5102175E42D04EBFC8A6C18DB6CD222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58c407.TMP

Path C:\Program Files\scoped_dir4444_623975667\Default\Preferences~RFe58c407.TMP
Size 7KB
SHA256 855d5ce4db32c023344f0d9df268977b03ec6ca4fffc61021586936610f16f59
MD5 a14ce89c757ef2b4830e9c9c99cf3c40
SHA1 44f811da5f70d085475bbc1b361247410b119cc7
SHA512 b3e93a5d9c09d5cc7fd9ef6612dc79187fb321d4af6d6d730770af266dad15886c67fd3389ff6e493a5c55b9c1d0c6009581671dbd42aca6cdccbe3a46b9f77f
SSDEEP 192:gR+AYv7W9PRp2iXsb+WNnH3bn2guWiyIsnAUgR:gR+AEmXhXwHLn2gMR
TLSH
T159F16129BD18A53B9CC6E719FA257742E7F5102179E03D08DBFC8AAC15DB6CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Program Files\scoped_dir4444_623975667\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Program Files\scoped_dir4444_623975667\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png
Size 1KB
SHA256 bff3a19327fd09a24c1aa4e7f34c508d7e668a8eb32f2cc7c33bcaa7e9ee2319
MD5 2f1881da261cfaea89605ee7a5e33e40
SHA1 fe61ed428aa3636adcfbeb66162f43f0ee091d25
SHA512 a9d8a4172c83030bf4472e900540b2ef3bbbb5e565c39f278cb8aae355354f063a4723c5ed8c3b32dcea45c70903271d170e56879a096b169697fc28dc768494
TLSH
T1FC413B2333F81ABFD81CD69BE465C8A50F395483DA39060706031CE8116343B19DDAF9
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Program Files\scoped_dir4444_623975667\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png
Size 2KB
SHA256 afbfdd55b59a6385a28bfe27ef81ffae07f9d77b8c073dc299c6060b5d964a89
MD5 4d5d17c7e7c06b887bb383077131f50e
SHA1 8b29cf29af8358672e31bee5472025b7b07e7df8
SHA512 ccb20424ba2566e11a359bd04cbcb54bc21947bc254f4939c334f7db8c784a1da35461f60a1fc559ab5bde5cda443c82b633b8cc5bda89f5019b391148050be3
TLSH
T179515DED0389C698FB6F764206866917621D39F824EC51E09AE816A3EB101AC1CC1FD2
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Program Files\scoped_dir4444_623975667\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png
Size 3KB
SHA256 02bd0f5d045eb5247e576d8151da19d36dc0eee7746c9a426d4dc92ee83125c8
MD5 aceb6eccca82014c9472e49e8b4b6eb4
SHA1 91d2c703fe33ea1867dd3d87b760aa2e5e68a55a
SHA512 b18d0edf51fb6245dc730b5aca21601dc40c762d6c3d96c950b38312406bce16fe7165e786bd0d6ee106d95c90139094bfc4fca08b0f37eb88c086606821ade4
TLSH
T111814D53467373A8BC788965CBCDD0EA8D732D594E4244F884CAD93429D54049825BDF
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Program Files\scoped_dir4444_623975667\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png
Size 1KB
SHA256 97bbe02ee0327548d5b3bf2b6f00b507ca4425425e04f95e072b3617b3e4e6bd
MD5 398cdbfaa7de9f8a3931365e364d27f4
SHA1 ed1a3d000aca1e13108f0c0dc68235e444126d5c
SHA512 998dc6d33b867dedf26dd9e773e37038c697407b5d0600e9fbff01a9d30e50c004b9ca00e5ff4f13a18bfe4cdd7669e23a28b8c547c8cfa2fff1fe323506f092
TLSH
T13F3107848DBA44924EC31A70239760AA3C18F91EE235D48A109ACF527B063099BDFE51
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Program Files\scoped_dir4444_623975667\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png
Size 2KB
SHA256 444572dc6fc2eb8f1a880711379a0ec4a80d041549fad959fb5678b4c0b08689
MD5 ae3b722b45c677f2b47afa1d9f0fc94f
SHA1 609c3dc27cb90e805157537c673e6b4e7a6c3d96
SHA512 7cd894c041a3c7530698931a93639ed7fd9131aaf1bfeaadc6d29867f5b0a49e101dd0b1572eb113a465d5adfc497f872617cc8c51270d08227f9981db71d19e
TLSH
T1F6516C2378FA9142C8345043D0EFADAD71FF52D3C74A451B31E64020ACAFAE121A139E
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Program Files\scoped_dir4444_623975667\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png
Size 3KB
SHA256 bc6ae87a22ff2fe7feca2cb3f83aaebc8f02ad707cda77b51dab26bc9c5be710
MD5 ca441c15198089107955d8c8e5635b7d
SHA1 fc8403f74ead7b83017b9ef45c909576cacf2ddf
SHA512 2db07cb52541df66ebe059d1ada731315f87f0c46b553e72370c006ed313d8d754d8fd15ae317258fee0bc0bc13724219a5de9db8400e81193e4b4ffcfc01abe
TLSH
T158817B01730F99818D289BA9733E44F1526A3C04820775368035BAFA85D2DF618EFE03
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Program Files\scoped_dir4444_623975667\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png
Size 1KB
SHA256 23fb4d1613fb426612119928a7222ca84a9cba4ba081a8b1be7f2565c013c590
MD5 520121a67f0bdc7a327bd49d50090dac
SHA1 648e3fbcbbffa431fd2480edf0a342b6920fb3b5
SHA512 36a89b73c4de9d9ef98becbbd31f286014163617063600ed22779e1e87ac35cbfb8341f9e4300994352570b1223719256c0d698dfa4aeb38e7d3907927a79a92
TLSH
T12D11E5B643275C67A2B3011708E03ABC8D605898F02B4A9C90148799360BBAAA4ED3DD
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Program Files\scoped_dir4444_623975667\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png
Size 1KB
SHA256 7b1aa50219251762867246b79677fac99c1b61a4ef4e471ae3473c10ada2c50b
MD5 c633806d580f67b98743782c74dde9fa
SHA1 8acb5f35cd7ee2e7d3174ce06d399d46dd275ccf
SHA512 04cbe1571369525f4aab0b2a9fddbb425e9a935d9307d3b4fd2623899644e15419d0f7e0d33372a46442778043c03448e8130d892b4978aedbbcc0a785eaa9e7
TLSH
T1A9210BF662715F4EC79B05AC1FC14A676310122D665033AC5C2594047E4BCE78DB4D17
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Program Files\scoped_dir4444_623975667\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png
Size 1KB
SHA256 2a560cdee5965876269d30cf82a85b83aeac16903d4f325209ca3354b971c25b
MD5 310d0edac146f7ce3e4394c066348637
SHA1 b1f1be49560ccb7007700fdf86a5121eb99eaffb
SHA512 1db1aebc30d4912eb9f3474476a2ca3683d078e3e141fbb7964402d01cc5fa5c2e24a1af7b4fad2f19b731d4b26ec9616f5406bf84d66d164a716e9084921156
TLSH
T19C3187F0F47B2D96DF75AD3427028960E6559E962D93DC109D482EE94B0C70981CE163
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Program Files\scoped_dir4444_623975667\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 ccefdc2d816137b5954b591e8954c392e0cf27388fef2e437991e3999d9ad3d8
MD5 efa437b6fe5031994d5917a91c19990f
SHA1 d46a1115227ead4e92346b600c28e9ac72cce96f
SHA512 ab52261f15a3f21728b41b4765da5ec6c9e71051b720204ee2decf6f09ac8a0c9a5c12313d921f232f1e698a7425d34415eca8db21a37f423535806bcdf238bb
TLSH
T1F3310AC7644047BA52EDDAF37F6B0C57DC12210107D4A440599F56E17FEEEC86015478
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Program Files\scoped_dir4444_623975667\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 bff87e21fa845d8ce3c266db6d904e9c7a3bf9fc2b95a1f1a5ca375f3fdb045a
MD5 097f67b0d583db3f8487ac27379c7eae
SHA1 18acf62fb9bc4e95899c4597cd72de66b6bef763
SHA512 0b6b323fa14e5b0dd6bb87fce791bbd0b7a867988d8332385ba76a35d93d4dd5b67f6be9be5a69fbdcd5da68c30bc840712daa83b9a0187b727d963dc9a9a045
TLSH
T15E514C54BEF34CB2EBC67C7254E65BF5A564C1E62D407A0C86B9CA1245BDD410CCD003
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Program Files\scoped_dir4444_623975667\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 3KB
SHA256 abe4eaa1a6fa423bcef61b423dc72386a9cf1968b1041de5270c56a7780254ad
MD5 8e589c60e0ba95ca1b178bad0a8298db
SHA1 d981cd3f9eb63636471e3bd4c0fd7585460ad6fd
SHA512 e8c7b5d340e698f3b1b42d6c3b7653b666e0add095611c00f502782928eb788070ca977b54b42f9515127861e55138a3cc0f02540f0bc2e44694fb0ea595ee34
TLSH
T196517D1B4B8AC56A0E53770E02E57ED454996C569EF383CC2106E7C0081A99F43EBBE7
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Program Files\scoped_dir4444_623975667\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png
Size 952B
SHA256 e566796c18517e7084e3a892b3291cc189b85e7830800503c256998ab697a507
MD5 bf7aa030f9cbc7aba123d10adb3ab321
SHA1 d210f3194a494a65d1e32ade703e24fbbef7b444
SHA512 3be8123811222e1d5aa92e7144d41a8ace20ea1d5b082aa51d11df8f573c17f294ead72ee9e94b31259035ebd0eecb904686cf4bb22f0e5313a02756e210b8a6
TLSH
T1E311889E6EAA8CBDD1C3AE4FBD2D22904F13CE54C534BA1B4C4759573A26E54704B501
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Program Files\scoped_dir4444_623975667\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png
Size 1KB
SHA256 6a379d8e9545ee7885dcff4c53f1ca553dc9fb0cbaa18a0c71c0b75c8883d044
MD5 c053b2219c4c9e7e7080cbe4e6e3981e
SHA1 0470cf45babbbe1fad32b4dec3593e8ab7a8ac39
SHA512 1271ac3ef670f3b7104c3f4e678ef4bc9990d9427826b104bfa8d31f904895da50ed0f1b673727d39355428f6270d015c0953521b26d8f10f842854b79ec5525
TLSH
T1E021B7BE5B25DE1B97EEA61F72DA9900D89221E27183A6052ECFCB6057145A33C24172
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Program Files\scoped_dir4444_623975667\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png
Size 1KB
SHA256 3772d9c9a6fabba60ac0c7b9c93bf230e3c99ebac9af480efc6c778d9881dd85
MD5 cf9a569f60db18903e86e6612cf90efc
SHA1 379dccdc92399b0e4e658ad8f04276bf99501836
SHA512 58f0b5130318069511452b11b1fbdfd898577c714150f5f88a4a4ff80320b33c287c103e464ef24c8543d90de71713f2ee293f538fb078ec2099f9871cef2caa
TLSH
T132210853AFCF4AAE5834129F565C460FFBA3623E2952D409DB2A41AB08CDC14E8462C3
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Program Files\scoped_dir4444_623975667\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\32.png
Size 1KB
SHA256 06c00fa3cb29713aa4317b352fc1e1e035c0c7720a42f107cf758fbb21eaed0c
MD5 247675501d3cf1f7987fe8e20dc4a994
SHA1 c0630fbc0c9c7c2aec627667b21b5b9add1d7925
SHA512 6b6f5e0feb15ecde82191178df36fcf9cebb762289116b88a466ab31152d6f8e769e97252e3a41f7f538867920866ce12bd60c9c87fbb5019783de0c5158bfd8
TLSH
T1C721DB9786803C5AE71F76BD5402AE9BF92060197254970E1A560A15C93C5D3FD873A0
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Program Files\scoped_dir4444_623975667\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\48.png
Size 1KB
SHA256 bebe7c8f23573efeedb8259fd9e866662dfad2c8e974d2715bb5aebdac870f6d
MD5 93f26885517b76f003062053ad718275
SHA1 eb97bbd3de38ad8efd87e112ad76d6a6d78ffda9
SHA512 34f8a81113a9ca950a07c5f5c3511e3f11f8f9e9a2a1040872015064e2146154d4eb31b33d8ee291434535881f82685c0e90c52e76ea731ecafde73771595520
TLSH
T10031F95284AF0C128406F5E5CD57910B7F37ACBA9AC2A589023B7E7A105824D7B6C449
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Program Files\scoped_dir4444_623975667\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\64.png
Size 2KB
SHA256 f5fcedc00655f8a9b63b379feb04ef904a64328e9ef79e7a411de5139d398ebe
MD5 18b13f82a338cf91ce3ec3ad9702622f
SHA1 403a48626de0cb33ddea61e6de7c895eb7482bca
SHA512 08a6fac277ffdbbc18c5166032b426e7d8a7856f7dd03ab01938000b28a869d80476017164a6728643ae8908616c574fddd8fabf946bd66b841ef13f5906969b
TLSH
T1F7413AD73E887CDDACB22A746A6175C1F0E846B24687DF44E60D6918CF61C43001638C
MD5 SHA1 SHA512 TLSH

Submit Download

128.png

Path C:\Program Files\scoped_dir4444_623975667\Default\Web Applications\Temp\scoped_dir4276_715236751\Icons\128.png
Size 5KB
SHA256 63be4dfbc222f0c026579113af9aa7dea61e78a166ab9af053b46c1e172240ff
MD5 9cafc16ce8040254ec411cc5a8f954f2
SHA1 0d9841be48e134edf43c7ef970d24ddf852d155e
SHA512 aa1e0ac8d0647ee6c0b481e671b20fc68ff253dc72748b2aaf22f15bd8decd2b9723b16f8cd4c19d9a250abaa8d517101bad6ebfed7fd3a90ceefce02c1b3b75
SSDEEP 96:ALdfTPsPOWpgaNHQxO20qtLppvSFLtGaoFuPhQd1YDzpsE60tkuuAaw:m16NHQgoLjvSVtY2h6CDzpsErVu0
TLSH
T119C17E55555D711FD09D157110AF4A0F31A7E2AAC3785720C97E1BD0F88DE4603A3EB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Program Files\scoped_dir4444_623975667\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Program Files\scoped_dir4444_623975667\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Program Files\scoped_dir4444_623975667\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Program Files\scoped_dir4444_623975667\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Program Files\scoped_dir4444_623975667\Local State
Size 115KB
SHA256 7c38c8ae85d6c815542781afc37a72d827f7fb57c5e48878922653c6d933bb74
MD5 4f8b2461e7898d71910e555fb47067e7
SHA1 1cd772485d5476795a6334b873361cc0ad4dc7cb
SHA512 17e8c04588735dde55f95a3568ac045b18efad636e933d9a67e6191b881cdab8990b10ba4d2194e0f88d9e80ff160d57aea5983b0fc81db593265e0c1ba254f5
SSDEEP 3072:vIGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMD:bm7Rkm1tYpBeh2BAoD
TLSH
T145C3122B5E75EC3B5CB5A74EB48E0F1E2EF149A6C920DE9288D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Program Files\scoped_dir4444_623975667\Local State
Size 115KB
SHA256 4ec4643d04756fdc0f0c73e4f4eb2465b5434ab74ec1e498d1ee7da73784096c
MD5 db9fa910b5657e6808dbb4ee63113b7e
SHA1 a0e3be9b65b3e21076bdfb60291c6e44287bedfe
SHA512 90fd3ac74bc90e0cfc7d9a932f67698a3a354b18f04aa8f72242b5552d337cb2b8cd24e9c13123b92076ecba94212a1ef1f74e99ed2f6c0c31793993d06e9c29
SSDEEP 3072:zpGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMC:Em7Rkm1tYpBeh2BAoC
TLSH
T1CDC3023B5D75ED3B58B5A74EB04E0A1F2EF149A6C920EE92C8D85A0437E97CD0A44938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 9218ece111fd7ff74a91644cada428358010583f7d85a50d1bdbef3b50efc442
MD5 3e641733b1a52c94b6e46b29c94e9f4f
SHA1 9659d61cd39a026d85a1deac797c6b01638b489c
SHA512 3fa76eae69ae74d841926a27e0424de807b23d89d422264957daa69fa5b2a395eee61edaa0154f5cc9cc7d27b3fd53c6eb0a8d6edfc8fc7a1c1f19ceb5d8a542
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4276_1415406190\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

b1e1cd29-c284-4ad6-99e0-c8c688190b1a.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4276_1415406190\b1e1cd29-c284-4ad6-99e0-c8c688190b1a.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

01755b88-9b48-4d28-8e7e-b7b838ffce1f.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4276_410830741\01755b88-9b48-4d28-8e7e-b7b838ffce1f.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 ba792f938a874ec18c9828403291e138d3b85ae3a8f95fc195844ebbcada1cd0
MD5 2765aeeb464be53fb7f44bb51563b2a3
SHA1 a137fd7591079bcb43c1f4b3679f7086f173bc64
SHA512 25308309e7f95224e92c2e02da5ca9949240c12e29df0a98718d8b14a05d6f2efa974c904958e8d92080ca470bf76c96bfd70675cad0abb40e05e17ecb8e6019
SSDEEP 24576:t+ttdykir8q0Hsw47opM6g9+JVuOUj7Cg8:t+ttdnYz5d6JgCg
TLSH
T1416523D3B39C456AE9BF86B1880AC914265E7F699DEAC4F7F25432198878DC04634F0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 bc7509e4d847dd36af7a19d47e258dd7cd76f27a5ed14a2b910155dfed17b275
MD5 314830b96064cad436fc0cd51d01e913
SHA1 2d41bd52f13c43550bc7da4cdf48cd7b9b86ef25
SHA512 2ff7fcc93a3b41867bce07456cd066b5c7e741a0a7dad170e07d648bde934652e928fa1dee5033f19d6d78a81ffc404df93518c585d9a12846bebadb5e9c4a0e
SSDEEP 49152:Wa0h2GEkuAe73q3pp46zwwQUttdnYz5d6JgCg:Wa0hNYG4JwKz50GC
TLSH
T108859E1E67EC82B5D0BAD278C9A6854BE6B2B4260B3156CF1150853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 fb7450be5b469b767ec4da96ca95ba7e52ff97bb5993bdb68407d93279619fdf
MD5 cc37fd0a7ffa47981dafde4aa2b71707
SHA1 19feb5e6ae64ba0830d3a7a1f9b3de10259fda8e
SHA512 1c3f26bb4c0e0352cba3f64966ca74038f7f7b2a7f5df018a5f18b778a513c078a4b8875f46bb964e6cd0c467bcdf32074885393dbec05dbb4d80229187a996a
SSDEEP 24576:jhbHjPzttdykir8q0Hsw47opM6g9+JVuOUj7Cg8:jhbHjLttdnYz5d6JgCg
TLSH
T1FA6502BE26AC10D9E576D17989468606D335BC261B6293FF63D0A2794F3BED00D38F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 a11e8569dc13d067ad1b6e6a9f62544174f0b5e345251c1180d8bda15b531cd0
MD5 9c521fcc4db831f97f5aee10ff130159
SHA1 e4b62d1c50a0344ed7ba6cac347d01380d0b43cf
SHA512 cd3128a3d2a700904ccaa0e23ffba59eeb167f79998db09f2c9ed5854789f535bb7083485ac6cabecb0bbe311456905b8d7cd8a40c6a50438c03a3453fa9d0e3
SSDEEP 24576:w3YgnJcRTk4yti+R5dBR/7ttdykir8q0Hsw47opM6g9+JVuOUj7Cg8:wIgnaTk46pBR/7ttdnYz5d6JgCg
TLSH
T16545BF2EF2B910B9D8AAD136450147B5BB71782D1F209ACB0170C538AF1AED85F39F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 d11108ffa9234ab8f5b4bb029ed70ccd38b607edbfe6d1f63414a56966c8783e
MD5 eb28f9bac8b8f14ddd694c8bd3dbb735
SHA1 8ba944f84579acc7faaa6d7e96805dad6a945f5e
SHA512 d29b739f292de9d37adda9214e7fc8b75b12f49ce5c983fd99090841a2c91bff9742932dd6e524a71b6d132a12840057800728b7e8ec112a26c14b68305f7b4d
SSDEEP 24576:o6ttdykir8q0Hsw47opM6g9+JVuOUj7Cg8:o6ttdnYz5d6JgCg
TLSH
T10C6523D3B29C44AAD9BF86F1880ACA04654D7F5A9BFB44F7B16472198879DC04338F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 32f46c8c8aa91eec155f2049c1b12889c811bf488ab204e69d524ebae615812a
MD5 895576880c37231fab546f000c8d62fb
SHA1 0697031facccd524e97033cbdf13965282c4d9d7
SHA512 6c6218607d6e92ea11ed9d623b813e9d11afa647f9a92bcb6c310d29d4bf8f774eb8ef8c522b8e7bc1285f00a20b4d7431046cd364fb7a3782e2ea238447ea84
SSDEEP 24576:cAL3UTpttdykir8q0Hsw47opM6g9+JVuOUj7Cg8:cAL3UFttdnYz5d6JgCg
TLSH
T1FB850155F7A400F9E97BC13CC8668A16E272B85D0764E6EF03A84B651E337E14E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 df7dd7793b6cc3b7d82834f0024976519289ee1b29525c3eace3ce8cdfa2369e
MD5 614087695b9b909d6830ec720c11055c
SHA1 1d223ab326490499cd270fa83266829502704bc7
SHA512 5fbc44402fc6df397d8ba9a6b23112c5a25584852448c2b784620d17050f93d2be675f6b4155bf9e7f970c35e069f0e2a0e1426f0c665d117985709ba6163f18
SSDEEP 24576:cOlttdykir8q0Hsw47opM6g9+JVuOUj7Cg8:cOlttdnYz5d6JgCg
TLSH
T1FB75129A32EC10E5E57A91788942830CD376BC660B6243EF42D0A17E4F77EE85D39F46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1b57df8c7f9eb2c1abf1a5b1225d2d18e272e5f1878213f44b76a8a04ef22aed
MD5 ef6d9c96f01e81d3d213946847e36b2c
SHA1 81ea85b50123c6a6162b153fa21329fe2b1922a7
SHA512 bbade9eefaedc829d11434da032b5950bb486348949e62a062b934fe0dce61552107fa2a643f976f6cb2f682d03185f27652083bb79da8617e66792b776f9959
SSDEEP 24576:U7NM9YqZqmWMUkPjZM48Mv6bEhsOttdykir8q0Hsw47opM6g9+JVuOUj7Cg8s:U7cBWMpPjN8DbEhTttdnYz5d6JgCgB
TLSH
T18965AE6E6BEC81E5D477C13DC9928205F6F2B8611B318ADB1162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 334a83fb6c07cc61a70dc24dc855713c4bc5893ed10d045cb4166c4d34602db3
MD5 776b4348928f424389b906bd863b99ef
SHA1 b78695dfee7234cb33b6cabb9899a5d4aec63e78
SHA512 9dc03ff8671e760f230534cb9aad15a57937857ad1e11062083a4c9ad32e45327bd2569727b9a96ccd782efdaa2b8a9dba7d3ebd02a8618eb83c5e9b6f7b97c3
SSDEEP 49152:RF2YuHNETovAvNYf8kmuttdnYz5d6JgCg:U6BCf8kkz50GC
TLSH
T19F858E6A27ED80A4E0BBD27D45B7D246FAB2B8511B3055CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 560aad7cff080b7e44aecca110b2e29c5ea614ac1d14489d303ec36ba1087ff1
MD5 16b13be6a5c75c84ff11c28ed417e876
SHA1 34ead39c450856b26eb2ed12843d43e34a24165e
SHA512 78738b8194178b9b4b6876c31cd8009e8428620b5f8498b8b7ad364a2924c20a0bf9a95495fcd2f25eb6e8c13b08fd062b46fd5dfe957d24f902346f98aad7e8
SSDEEP 24576:vAFs06+Omlf8NXEbToBttdykir8q0Hsw47opM6g9+JVuOUj7Cg8:4Fs060loXu0ttdnYz5d6JgCg
TLSH
T1EA65AF2F62EC00D5D07ED17D8997C91AF6B1786707255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 f2dd44b3bfaff1218fab4743187ae71ef9a30b1ecee4ce42cef16bf3312af23b
MD5 ec853f44bebcf2f37125c027b4656235
SHA1 1a515f928a6e18a59e5b30bafefdf8f4676b3be1
SHA512 9abc06fa50a6b356123dabf5b145290a514f6dc28e876ccaf58c921ace771df3318855d5694c99e71f78ecd9e7f90e91dd1bc1ef4c1bfef3730145ddf83e7f2f
SSDEEP 24576:1JnJ5D3WX0ttdykir8q0Hsw47opM6g9+JVuOUj7Cg8:1JnJ5DGX0ttdnYz5d6JgCg
TLSH
T12985D06DD2A810F8D4B7C2B4815A5B45FE72383D2F2269C724B4D5357F22EE09A79F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 cc0979e82b8b16a8630f3c311683dcdebaf950e8025a68c361fa964cfcbe9ccf
MD5 419795047f34f52694ec85fb5e2c2d00
SHA1 b960c40c71ab7f82b92d80f48f1f4e86131519fa
SHA512 a5b7b1c4fabebe82d577d0947c9d808b0d629eef7c3236c6f05df870357b3eea70b0292e462b4ae7a90776e3fdead359215c3dff4ada455480a36165f60aabc8
SSDEEP 49152:mg06DIKdwc+eQnSt65aVSttdnYz5d6JgCg:/Jz50GC
TLSH
T140955C16BBEA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 4dce1fb949400cb4ae58177bcd74fb68bcfb2baee4decc09fd56f948aa086d93
MD5 c85a77db43db725078f061548417a002
SHA1 3e4aafd8131cc903df44a9828b65e29a3c1ce542
SHA512 f012a43f132b90feb6a5d6526c75763213464e23d76374f94c334477949fd967c68255037deb3dbcc1afbf0c5fd94e8fa12196f7f3b7b79b2f1db57bd5819fa6
SSDEEP 24576:enAttdykir8q0Hsw47opM6g9+JVuOUj7Cg8:enAttdnYz5d6JgCg
TLSH
T1B46512AE37AC60E9D57A817984418604D3B6F8755BA257FF6290A23D8E37DE40E3CF01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 c0816fa5a3d525f809eab79f2241f8b4738464e8d440b47e58b1eb333c667f05
MD5 1a08f55e5832c4f0bf90c280e5f02465
SHA1 62c34a5800354f619508568d0b73bfff29146f6b
SHA512 b016b7fc8a2e2719a8ab46c4db8e9d9afb5fc4fdfe414e8ec91655527dc98ab84693bfb1763c9f8ce5c3435e3fe5551034d6691477f48e6d8c4ded037f524918
SSDEEP 24576:UIyjttdykir8q0Hsw47opM6g9+JVuOUj7Cg8:UIEttdnYz5d6JgCg
TLSH
T169751285739C50D5DABA4274C92382549A79BC219F7281FFA190F73E9E3AFC05934F0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 5b59596513b9847da4c204a3c2521da18a94c3966d69a0beba0eeadb4e806b3f
MD5 a44b9ee739725d66f1f86ff4ce59d58e
SHA1 aa9aa894cc73d87e767a161988e0de38edca3f5a
SHA512 d89f2dad6899b8e5659abbf19a8bceff086d2c5d165d7e6ff4c8d20b7ea3b1f3aeca54750874ecdafb3b3150ee848e3828824e9a5ba26c95975a04d13e9d0d56
SSDEEP 24576:/Vttdykir8q0Hsw47opM6g9+JVuOUj7Cg8:/VttdnYz5d6JgCg
TLSH
T1416523D672AD54A9D97B81B1880A8E04566D7E3A9BE644FFB1E4B234CC79DC04334F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 18744f2e3d86ac5ecd42d3b25091aa646263dc901aeeebda572faeff39cd0b52
MD5 51afc42247bd56aa4ffb5aebc24e1cfe
SHA1 a62bc411f668a21161eca1e77495934e41b593ce
SHA512 7453d97cd176600b545a24627f1dc1a118ef3c549fa5271e1cf6c85a87e03d4c78725657d189854ecd5b0ef064126f1571a42f1662aea5e3f9a1f3f8555d2536
SSDEEP 24576:pQ9MxZKdcz9dw3mttdykir8q0Hsw47opM6g9+JVuOUj7Cg8:pVKZmttdnYz5d6JgCg
TLSH
T18A558C2DABE9059AE177C275D5A240C3A673B4311B35C6CF2448D03D4D7BEE8AA78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 2b142462c62c7f952b0ff7636fbd2bad3dd1e31c7ed71539efe9a72afc3baf2a
MD5 1f495c1b2d5e9b5c5c16f3b155b88104
SHA1 bf8b7836fae2f4cf840bd01134a620eaa4304913
SHA512 0900fc46b54ef0b4e0d1b0499268ed77a1145cab8f9690dcfbea0d5a1390082a266d9601b4d6ec28eb1729bdf578440ef737616f8aa335d086faae245c6bb1ce
SSDEEP 24576:syocDAp/ttdykir8q0Hsw47opM6g9+JVuOUj7Cg8:RocDAp/ttdnYz5d6JgCg
TLSH
T1B175E05FB76D40E2E176813889858745E7B3B8345B6253DB6290C33D8E779E8BD38B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 672291b5ad15c98d6cdd2c08c5cd15599b8b5d9c3187f392e116dc9b7324baab
MD5 31d47a8284790aa6ed5542a4025e8df1
SHA1 f15aa5b229a48314d2fe701b5dcd5917d9f6874e
SHA512 2e61b3a637735dcd898534fb5f63887d1b3cdecd7bd96f592b47baa3ca25fdd3242f1b36b5b08581c625cd0703f04e926c6a3535b546fa782f11960f44766086
SSDEEP 49152:kWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK/ttdnYz5d6JgCg:O0zuNIoz50GC
TLSH
T18BA57B3DA2BC00A8D9AAC375C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/224-796-0x0000000140000000-0x000000014047E000-memory.dmp

Download

memory/224-794-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/224-503-0x0000000140000000-0x000000014047E000-memory.dmp

Download

memory/224-209-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/224-224-0x0000000140000000-0x000000014047E000-memory.dmp

Download

memory/224-203-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/540-200-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/540-53-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1576-253-0x00000000006C0000-0x0000000000726000-memory.dmp

Download

memory/1576-258-0x00000000006C0000-0x0000000000726000-memory.dmp

Download

memory/1576-260-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/1576-623-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/1708-271-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1708-748-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1708-756-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2156-246-0x0000000140000000-0x0000000140252000-memory.dmp

Download

memory/2156-23-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/2156-34-0x0000000140000000-0x0000000140252000-memory.dmp

Download

memory/2156-29-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/2232-139-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/2232-141-0x0000000140000000-0x000000014027E000-memory.dmp

Download

memory/2232-133-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/2232-198-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/2232-202-0x0000000140000000-0x000000014027E000-memory.dmp

Download

memory/2520-398-0x0000000140000000-0x0000000140262000-memory.dmp

Download

memory/2520-213-0x0000000140000000-0x0000000140262000-memory.dmp

Download

memory/2544-19-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/2544-214-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/3180-270-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3180-127-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3180-121-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3180-130-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3356-247-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/3356-565-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/3356-236-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3356-242-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4344-266-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4344-74-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4344-80-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4344-73-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4444-196-0x0000000140000000-0x000000014047E000-memory.dmp

Download

memory/4444-6-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4444-0-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4444-8-0x0000000140000000-0x000000014047E000-memory.dmp

Download

memory/4444-1598-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4444-1600-0x0000000140000000-0x000000014047E000-memory.dmp

Download

memory/4640-522-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/4640-216-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4640-222-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4640-225-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/4880-267-0x0000000140000000-0x000000014023E000-memory.dmp

Download

memory/5272-798-0x0000000140000000-0x000000014023F000-memory.dmp

Download

memory/5272-321-0x0000000140000000-0x000000014023F000-memory.dmp

Download

memory/5356-507-0x0000000140000000-0x00000001402AB000-memory.dmp

Download

memory/5356-409-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5356-415-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5504-518-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5504-457-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/5504-1638-0x000000000DED0000-0x000000000DED8000-memory.dmp

Download

memory/5504-1602-0x000000000CF10000-0x000000000CF18000-memory.dmp

Download

memory/5504-473-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/5504-493-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/5504-1523-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5508-508-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5648-521-0x0000000140000000-0x000000014028B000-memory.dmp

Download

memory/5692-428-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5780-399-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5780-390-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/5780-396-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/5780-1049-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5788-1618-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1634-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1604-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1605-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1606-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1609-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1608-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1607-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1610-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1612-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1615-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1616-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1617-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1619-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1656-0x000001E18DDF0000-0x000001E18E460000-memory.dmp

Download

memory/5788-1623-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1625-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1633-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1635-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1640-0x000001E18DDF0000-0x000001E18E460000-memory.dmp

Download

memory/5788-1632-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1631-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1630-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1628-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1629-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1627-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1626-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1624-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1622-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1611-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1621-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1620-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1614-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5788-1613-0x000001E18DDC0000-0x000001E18DDD0000-memory.dmp

Download

memory/5828-509-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5884-512-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5904-517-0x0000000140000000-0x000000014026F000-memory.dmp

Download