Overview
overview
8Static
static
3Avogadro2-...64.exe
windows10-2004-x64
4Avogadro2-...64.exe
windows11-ltsc_2024-x64
4$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
8$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3bin/AvogadroCalc.dll
windows10-2004-x64
1bin/AvogadroCalc.dll
windows11-ltsc_2024-x64
8bin/AvogadroCore.dll
windows10-2004-x64
1bin/AvogadroCore.dll
windows11-ltsc_2024-x64
1bin/AvogadroIO.dll
windows10-2004-x64
1bin/AvogadroIO.dll
windows11-ltsc_2024-x64
1bin/Avogad...ue.dll
windows10-2004-x64
1bin/Avogad...ue.dll
windows11-ltsc_2024-x64
1bin/AvogadroQtGui.dll
windows10-2004-x64
1bin/AvogadroQtGui.dll
windows11-ltsc_2024-x64
8bin/Avogad...GL.dll
windows10-2004-x64
1bin/Avogad...GL.dll
windows11-ltsc_2024-x64
1bin/Avogad...ns.dll
windows10-2004-x64
1bin/Avogad...ns.dll
windows11-ltsc_2024-x64
8bin/Avogad...IO.dll
windows10-2004-x64
1bin/Avogad...IO.dll
windows11-ltsc_2024-x64
1bin/Avogad...ng.dll
windows10-2004-x64
1bin/Avogad...ng.dll
windows11-ltsc_2024-x64
1bin/JKQTCo...se.dll
windows10-2004-x64
1bin/JKQTCo...se.dll
windows11-ltsc_2024-x64
1bin/JKQTMa...se.dll
windows10-2004-x64
1bin/JKQTMa...se.dll
windows11-ltsc_2024-x64
1bin/JKQTMa...se.dll
windows10-2004-x64
1bin/JKQTMa...se.dll
windows11-ltsc_2024-x64
1bin/JKQTPl...se.dll
windows10-2004-x64
1bin/JKQTPl...se.dll
windows11-ltsc_2024-x64
1Resubmissions
06/07/2026, 01:23
260706-brs96acx4q605/07/2026, 22:57
260705-2xm87sgs21802/07/2026, 01:23
260702-br3tlahs6k8Analysis
- max time kernel
899s - max time network
473s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 22:57
Static task
static1
Behavioral task
behavioral1
Sample
Avogadro2-2.0.0-win64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Avogadro2-2.0.0-win64.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
bin/AvogadroCalc.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
bin/AvogadroCalc.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
bin/AvogadroCore.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
bin/AvogadroCore.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
bin/AvogadroIO.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
bin/AvogadroIO.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
bin/AvogadroMoleQueue.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
bin/AvogadroMoleQueue.dll
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
bin/AvogadroQtGui.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
bin/AvogadroQtGui.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
bin/AvogadroQtOpenGL.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
bin/AvogadroQtOpenGL.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
bin/AvogadroQtPlugins.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
bin/AvogadroQtPlugins.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
bin/AvogadroQuantumIO.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
bin/AvogadroQuantumIO.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
bin/AvogadroRendering.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
bin/AvogadroRendering.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
bin/JKQTCommon6_Release.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
bin/JKQTCommon6_Release.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
bin/JKQTMath6_Release.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
bin/JKQTMath6_Release.dll
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
bin/JKQTMathText6_Release.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
bin/JKQTMathText6_Release.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
bin/JKQTPlotter6_Release.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
bin/JKQTPlotter6_Release.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
General
- Target Avogadro2-2.0.0-win64.exe
- Size 115.2MB
- Sample260705-2xm87sgs21
- SHA256 6b2748d55a6e95674bec00baf8c2ad48ecc8dad28c8d25252f68b39bdd9b1bff
- MD5 0b92fd77083787fc6ee3d35ba508d1d3
- SHA1 b4f51cba2a24fa9ced5a6e904bb12a52b2bab566
- SHA512 c60c1f9142e31d6343da5316ed84eecc8ba3538e2ef01f5d9f3a30cca2ca522458da3f9a8b2d10ce9763cee26301fc1c2b126808d12f6a7029565b98f2869337
- SSDEEP 1572864:bgUGyByUhG6/9HIudmE4NOnn3CqZOS4xdtwLfFQ+Oq4/IbmZlZSQR0cAH+akyabG:bqylUTQmEemMfvGPIZlZS209e/nJw
- TLSH T12948330090CFC1E5D03665B3EA6EB296AF36F668C031C1C9639643F9BE6185B7874C97
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Avogadro2\share\avogadro2\crystals\elements\Fe-Iron-gamma.png Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\crystals\zeolites\DDR.png Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\fragments\groups\nitrogen\dithiocarbamate.cjson Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\fragments\ligands\monodentate\nitrosyl.cjson Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\molecules\carboxylic_acids\butanoic_acid.cjson Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\molecules\pyranose\alpha-L-arabinopyranose.png Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\lib\cmake\JKQTPlotter6\JKQTCommon6Config.cmake Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\crystals\zeolites\IWW.cif Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\crystals\zeolites\MRE.png Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\fragments\amino\TYR.zmat Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\fragments\groups\alkanes\decyl.svg Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\i18n\avogadrolibs-ms.qm Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\i18n\qt_help_da.qm Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\bin\plugin_fingerprints.obf Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\lib\cmake\Spglib\SpglibTargets_shared-release.cmake Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\crystals\oxides\SnO2-Cassiterite.png Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\crystals\zeolites\ATT.cif Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\crystals\zeolites\LTN.png Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\crystals\zeolites\RHO.cif Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\crystals\zeolites\RWY.cif Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\fragments\polymers\phosphazenes\di(carboxylatophenoxy)phosphazine.smi Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\lib\cmake\avogadrolibs\AvogadroLibsConfig.cmake Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\crystals\nitrides\Si3N4-beta.png Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\crystals\oxides\RuO2.cif Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\fragments\groups\cycloalkanes\cycloheptane.svg Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\fragments\groups\nitrogen\amide.cjson Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\fragments\groups\sulfur\triflate.svg Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\fragments\polymers\ethers\acetal.smi Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\fragments\polymers\silanes\methyl-phenyl-silane.png Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\bin\api-ms-win-core-libraryloader-l1-1-0.dll Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\bin\data\atomtyp.txt Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\crystals\zeolites\MOR.cif Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\fragments\groups\oxygen\peroxide.cjson Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\fragments\polymers\styrenes\alpha-methyl-styrene.smi Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\i18n\avogadroapp-ru.qm Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\molecules\alkenes\3Z_3-ethylhepta-1_3-diene.cjson Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\molecules\fatty_acids\cervonic_acid.cjson Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\bin\translations\qt_cs.qm Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\lib\avogadro2\staticplugins\PlotXrd.lib Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\crystals\elements\Sr-Strontium.png Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\fragments\ligands\monodentate\triphenylphosphine.svg Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\molecules\amino_acids\D-serine.png Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\molecules\fatty_acids\arachidonic_acid.cjson Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\molecules\furanose\beta-D-glucofuranose.png Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\molecules\halogenated\tetrachloroethylene.png Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\crystals\carbides\SiC-6H-alpha.png Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\molecules\halogenated\chloromethane.png Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\crystals\elements\Al-Aluminum.png Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\crystals\elements\Re-Rhenium.png Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\crystals\zeolites\BEC.cif Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\fragments\ligands\hexadentate\groups.smi Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\i18n\qtbase_fi.qm Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\lib\cmake\Spglib\SpglibConfig.cmake Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\crystals\arsenides\InAs.png Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\fragments\groups\amino_sidechains\glutamine.cjson Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\fragments\polymers\acrylates\ethyl-acrylate.png Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\molecules\fatty_acids\lauric_acid.png Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\molecules\fullerenes\C70.cjson Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\molecules\halogenated\isoflurane.png Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\molecules\thiols\heptane-1-thiol.cjson Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\crystals\intermetallics\PtBi.cif Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\crystals\oxides\MoO2-Tugarinovite.png Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\share\avogadro2\fragments\polymers\ethers\ethylene-oxide.smi Avogadro2-2.0.0-win64.exe File created C:\Program Files\Avogadro2\lib\avogadro2\plugins\avogenerators\.github\PULL_REQUEST_TEMPLATE Avogadro2-2.0.0-win64.exe - Loads dropped DLL 2 IoCs
pid Process 6052 Avogadro2-2.0.0-win64.exe 6052 Avogadro2-2.0.0-win64.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Avogadro2-2.0.0-win64.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.CML\shell\ = "open" Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.CJSON\shell\open\command Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mol\ = "Avogadro2.MOL" Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.MOL\shell\open\command\ = "\"C:\\Program Files\\Avogadro2\\bin\\avogadro2.exe\" \"%1\"" Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xyz\ = "Avogadro2.XYZ" Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.XYZ Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.CJSON\DefaultIcon Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.MOL\shell\ = "open" Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.MOL2\DefaultIcon\ = "C:\\Program Files\\Avogadro2\\share\\avogadro2\\doc.ico" Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.XYZ\DefaultIcon Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.PDB\DefaultIcon\ = "C:\\Program Files\\Avogadro2\\share\\avogadro2\\doc.ico" Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.CML\DefaultIcon\ = "C:\\Program Files\\Avogadro2\\share\\avogadro2\\cml.ico" Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.CML\shell\open\command Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.CJSON Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.CJSON\shell Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.CJSON\shell\open\ = "Open with Avogadro2" Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mol Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.MOL\shell Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mol2 Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.SDF Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pdb\ = "Avogadro2.PDB" Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.CJSON\shell\open Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.MOL Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.MOL\shell\open\command Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.SDF\ = "Structure Data File" Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.SDF\DefaultIcon Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.XYZ\shell\ = "open" Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.XYZ\shell\open\ = "Open with Avogadro2" Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.MOL\DefaultIcon\ = "C:\\Program Files\\Avogadro2\\share\\avogadro2\\doc.ico" Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mol2\ = "Avogadro2.MOL2" Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.SDF\shell\open Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.SDF\shell\open\command\ = "\"C:\\Program Files\\Avogadro2\\bin\\avogadro2.exe\" \"%1\"" Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.XYZ\shell\open\command\ = "\"C:\\Program Files\\Avogadro2\\bin\\avogadro2.exe\" \"%1\"" Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.CML Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.CML\shell Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.CML\shell\open\command\ = "\"C:\\Program Files\\Avogadro2\\bin\\avogadro2.exe\" \"%1\"" Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.MOL\shell\open\ = "Open with Avogadro2" Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.MOL2\shell\open\ = "Open with Avogadro2" Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.SDF\shell\open\ = "Open with Avogadro2" Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.MOL\ = "MDL Molfile" Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.MOL\DefaultIcon Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.XYZ\ = "XYZ Chemical File" Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.PDB Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.MOL2\ = "Tripos Mol2 File" Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.MOL2\shell\open\command\ = "\"C:\\Program Files\\Avogadro2\\bin\\avogadro2.exe\" \"%1\"" Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sdf Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.XYZ\shell Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pdb Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.CJSON\ = "Chemical JSON File" Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.CJSON\shell\ = "open" Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.MOL2\shell Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.PDB\shell\open\ = "Open with Avogadro2" Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.CJSON\DefaultIcon\ = "C:\\Program Files\\Avogadro2\\share\\avogadro2\\cjson.ico" Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.MOL2\shell\ = "open" Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.MOL2\shell\open Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sdf\ = "Avogadro2.SDF" Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.CML\shell\open\ = "Open with Avogadro2" Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.XYZ\shell\open Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.XYZ\shell\open\command Avogadro2-2.0.0-win64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.SDF\shell\ = "open" Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.SDF\shell\open\command Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.PDB\shell\open\command Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cjson Avogadro2-2.0.0-win64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Avogadro2.PDB\shell\open Avogadro2-2.0.0-win64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Avogadro2-2.0.0-win64.exe"C:\Users\Admin\AppData\Local\Temp\Avogadro2-2.0.0-win64.exe"1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6052
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4064
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:5248
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Avogadro2\bin\avogadro2.exe
- Size 1.4MB
- SHA256 df4849abdd9cf62ac5322343c44932bf3eaecd9f12b65c6182b04c68938e62ad
- MD5 bf41e8001108dc4b77e20dee087543bf
- SHA1 47e779ba6f5891490a28ba517b7788d44d5c3980
- SHA512 4b340ce080deed611e5534cafed0d6b75a7c8616d8c583c74562f1d98e73542107b3f71d5e90266a503a08bda5cbaa6ae803c55d2e53b989b731ef8062dff20f
- SSDEEP 24576:QX3B2HgbbnVuuO+VZG9BQiCPwZ+5seQb3l4sLqFFRNj:QHBKGBuuO+QDCr23b1ARN
- TLSH T19F65F12B625102E6EA7AD37CC34BCE02D477700687A29BEF46368D151E732E57E7C684
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa50B8.tmp\System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa50B8.tmp\nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH