shodi | 1145aabc15bf64e3c0a694f1471caa20f35e2908f298e26e2dbb6abeff096339

Analysis

max time kernel
93s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 17:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
Size 5.1MB
Sample260708-v5rs2aex81
SHA256 1145aabc15bf64e3c0a694f1471caa20f35e2908f298e26e2dbb6abeff096339
MD5 7db5897dcf53ade46ecb3493fea0feca
SHA1 1dc33d33a4b99dbe508dc794aff126bce6f37b0d
SHA512 ab7cc8ecb6122b7118f5f0aa8316d1704c6b484b50b352a126231491ab2e4219162b039f560119b876559fdfa1eb71f7ab1e08ddbacd0b79f43eae6450ae3ea2
SSDEEP 49152:OhkwqK/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+p:qkBVWQtZ/K0tGOFWVRuLftCTF
TLSH
T1AE466B13F5E941A8E0AAD178CF759B319B32BC1A4BF164DF269076D11E72AD03B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery shodi persistence ransomware spyware stealer worm

Malware Config

Signatures

Family: Shodi
Shodi is a Windows worm written in C++.
worm shodi

Detects Shodi worm 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c52c-14.dat	family_shodi
behavioral2/files/0x000b00000001c728-1091.dat	family_shodi

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
1256	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.usa
2080	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.usa
4888	chrome.exe
3484	chrome.exe
4352	chrome.exe
4912	chrome.usa
4716	chrome.usa
4804	chrome.usa
4812	chrome.usa
5116	chrome.usa
5260	chrome.usa

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\UsaShohdi.asu	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UsaShohdi.asu	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\ssvagent.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Mozilla Firefox\updater.exe	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\uninstall\helper.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\javaw.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\ONENOTEM.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\7-Zip\7zG.exe	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\javaw.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\javaws.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\msoev.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Google\Chrome\Application\chrome.exe	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\PPTICO.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\protocolhandler.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\firefox.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-container.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\7-Zip\7zFM.exe	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zG.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\OLCFG.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.usa	chrome.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.usa	chrome.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\uninstall.usa	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\Client\AppVLP.exe	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrome.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5140	chrome.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280056956928563"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{B136AC3D-A28A-4327-8FCE-84AFB8630974}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{0E854E49-C8FB-4AB7-907F-6DB76908813B}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1312	chrome.exe
1312	chrome.exe
2728	explorer.exe
2728	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	2728	explorer.exe
Token: SeCreatePagefilePrivilege	2728	explorer.exe
Token: SeShutdownPrivilege	2728	explorer.exe
Token: SeCreatePagefilePrivilege	2728	explorer.exe
Token: SeShutdownPrivilege	2728	explorer.exe
Token: SeCreatePagefilePrivilege	2728	explorer.exe
Token: SeShutdownPrivilege	2728	explorer.exe
Token: SeCreatePagefilePrivilege	2728	explorer.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
4992	sihost.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
1312	chrome.exe
2728	explorer.exe
1312	chrome.exe
2728	explorer.exe
2728	explorer.exe
1312	chrome.exe
2728	explorer.exe
1312	chrome.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
1312	chrome.exe
2728	explorer.exe
2728	explorer.exe
1312	chrome.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe

Suspicious use of SendNotifyMessage 45 IoCs

pid	Process
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4344	StartMenuExperienceHost.exe
2728	explorer.exe
4676	SearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 1256	3216	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe	88
PID 1256 wrote to memory of 2080	1256	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.usa	89
PID 1256 wrote to memory of 1312	1256	2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.usa	90
PID 1312 wrote to memory of 1888	1312	chrome.exe	91
PID 1312 wrote to memory of 4880	1312	chrome.exe	92
PID 1312 wrote to memory of 5140	1312	chrome.exe	93
PID 1312 wrote to memory of 4880	1312	chrome.exe	92
PID 1312 wrote to memory of 2760	1312	chrome.exe	95
PID 1312 wrote to memory of 2760	1312	chrome.exe	95
PID 1312 wrote to memory of 1532	1312	chrome.exe	96
PID 1312 wrote to memory of 1532	1312	chrome.exe	96
PID 1312 wrote to memory of 1544	1312	chrome.exe	97
PID 1312 wrote to memory of 1544	1312	chrome.exe	97
PID 1312 wrote to memory of 4816	1312	chrome.exe	98
PID 1312 wrote to memory of 4816	1312	chrome.exe	98
PID 1312 wrote to memory of 2436	1312	chrome.exe	100
PID 1312 wrote to memory of 2436	1312	chrome.exe	100
PID 1312 wrote to memory of 2808	1312	chrome.exe	101
PID 1312 wrote to memory of 1856	1312	chrome.exe	102
PID 1312 wrote to memory of 1856	1312	chrome.exe	102
PID 1312 wrote to memory of 5024	1312	chrome.exe	103
PID 1312 wrote to memory of 5024	1312	chrome.exe	103
PID 1312 wrote to memory of 5852	1312	chrome.exe	105
PID 5852 wrote to memory of 5872	5852	chrmstp.exe	107
PID 5852 wrote to memory of 4936	5852	chrmstp.exe	108
PID 4936 wrote to memory of 3364	4936	chrmstp.exe	110
PID 1312 wrote to memory of 5628	1312	chrome.exe	111
PID 1312 wrote to memory of 5128	1312	chrome.exe	112
PID 1312 wrote to memory of 5628	1312	chrome.exe	111
PID 1312 wrote to memory of 1800	1312	chrome.exe	113
PID 1312 wrote to memory of 5128	1312	chrome.exe	112
PID 1312 wrote to memory of 1800	1312	chrome.exe	113
PID 1312 wrote to memory of 3208	1312	chrome.exe	114
PID 1312 wrote to memory of 3208	1312	chrome.exe	114
PID 1312 wrote to memory of 4748	1312	chrome.exe	115
PID 1312 wrote to memory of 4748	1312	chrome.exe	115
PID 1312 wrote to memory of 5568	1312	chrome.exe	116
PID 1312 wrote to memory of 2544	1312	chrome.exe	117
PID 1312 wrote to memory of 2140	1312	chrome.exe	118
PID 1312 wrote to memory of 5568	1312	chrome.exe	116
PID 1312 wrote to memory of 2292	1312	chrome.exe	119
PID 1312 wrote to memory of 2544	1312	chrome.exe	117
PID 1312 wrote to memory of 2140	1312	chrome.exe	118
PID 1312 wrote to memory of 2292	1312	chrome.exe	119
PID 1312 wrote to memory of 5980	1312	chrome.exe	120
PID 1312 wrote to memory of 5548	1312	chrome.exe	121
PID 1312 wrote to memory of 4768	1312	chrome.exe	122
PID 1312 wrote to memory of 5980	1312	chrome.exe	120
PID 1312 wrote to memory of 5548	1312	chrome.exe	121
PID 1312 wrote to memory of 4768	1312	chrome.exe	122
PID 1312 wrote to memory of 1108	1312	chrome.exe	123
PID 1312 wrote to memory of 1804	1312	chrome.exe	124
PID 1312 wrote to memory of 1108	1312	chrome.exe	123
PID 1312 wrote to memory of 1804	1312	chrome.exe	124
PID 1312 wrote to memory of 4156	1312	chrome.exe	125
PID 1312 wrote to memory of 4156	1312	chrome.exe	125
PID 4992 wrote to memory of 2728	4992	sihost.exe	130
PID 1312 wrote to memory of 4888	1312	chrome.exe	134
PID 1312 wrote to memory of 3484	1312	chrome.exe	135
PID 1312 wrote to memory of 4352	1312	chrome.exe	136
PID 4888 wrote to memory of 4912	4888	chrome.exe	137
PID 3484 wrote to memory of 4716	3484	chrome.exe	138
PID 4352 wrote to memory of 4804	4352	chrome.exe	139
PID 4716 wrote to memory of 4812	4716	chrome.usa	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Users\Admin\AppData\Local\Temp\2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.usa
  C:\Users\Admin\AppData\Local\Temp\2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.usa
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Users\Admin\AppData\Local\Temp\2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.usa
    C:\Users\Admin\AppData\Local\Temp\2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.usa --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x2bc,0x2c0,0x2c4,0x298,0x2c8,0x7ff66216b618,0x7ff66216b628,0x7ff66216b638
    3⤵
    - Executes dropped EXE
    PID:2080
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1312
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffbd7eac728,0x7ffbd7eac734,0x7ffbd7eac740
      4⤵
      PID:1888
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,14364535720558532921,12408161959208360327,262144 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:2
      4⤵
      PID:4880
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1512,i,9884943654272040939,18150158951406850285,524288 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
      4⤵
      System Time Discovery
      PID:5140
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,3169533742426880266,1610808093774116762,524288 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:13
      4⤵
      PID:2760
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3148,i,11143910758682406995,8773629725955822393,2097152 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:1
      4⤵
      PID:1532
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3188,i,11852205130009848475,11426297157801327109,2097152 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:1
      4⤵
      PID:1544
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4660,i,16857082994754479708,4599655209188149567,2097152 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:1
      4⤵
      PID:4816
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4700,i,13161680197604965381,1133446773686583403,524288 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:14
      4⤵
      PID:2436
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5320,i,978018887974909799,15335479186020272656,524288 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
      4⤵
      PID:2808
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5356,i,3241883397689716361,7002391238770342767,2097152 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
      4⤵
      PID:1856
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5384,i,10513055559203114015,15242289661604038156,2097152 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
      4⤵
      PID:5024
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:5852
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x250,0x29c,0x7ff655db55a0,0x7ff655db55ac,0x7ff655db55b8
        5⤵
        Drops file in Windows directory
        
        PID:5872
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4936
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff655db55a0,0x7ff655db55ac,0x7ff655db55b8
        6⤵
        Drops file in Windows directory
        
        PID:3364
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5468,i,8572840062616840475,10675162387912325285,2097152 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
      4⤵
      PID:5628
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5748,i,520053850720078282,11214161633544546453,524288 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
      4⤵
      PID:5128
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5696,i,850919892819325989,12504139334512979421,524288 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:1800
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5348,i,10209621394919664450,17231038150323845028,2097152 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:1
      4⤵
      PID:3208
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5376,i,7784004583047979793,25077939629628210,2097152 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
      4⤵
      PID:4748
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6468,i,3080443576003726409,17700165808240281780,524288 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
      4⤵
      PID:5568
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6612,i,12785483550206926974,6308476902797662158,2097152 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:1
      4⤵
      PID:2544
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,631763853507617978,13738940363452330487,524288 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
      4⤵
      PID:2140
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5524,i,16879865062311127148,3038625183041249632,2097152 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
      4⤵
      PID:2292
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5656,i,1078614553669378633,16269869840001304714,2097152 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:1
      4⤵
      PID:5980
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6424,i,9400598510139481433,15127611345556523266,524288 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:14
      4⤵
      PID:5548
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,9896371637331231345,11370864317865252115,524288 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:14
      4⤵
      PID:4768
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4836,i,6150276959145031412,6342851815573292045,2097152 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
      4⤵
      PID:1108
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5516,i,15600458185199587918,4671450943211608274,2097152 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:9
      4⤵
      PID:1804
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6880,i,11113069374948824284,13409116664943945315,2097152 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:9
      4⤵
      PID:4156
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6860,i,14212312422480476936,10812606300923017112,524288 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=256 /prefetch:14
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4888
    - - C:\Program Files\Google\Chrome\Application\chrome.usa
        
        "C:\Program Files\Google\Chrome\Application\chrome.usa"
        5⤵
        Executes dropped EXE
        
        PID:4912
      - C:\Program Files\Google\Chrome\Application\chrome.usa
        
        "C:\Program Files\Google\Chrome\Application\chrome.usa" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffbd7eac728,0x7ffbd7eac734,0x7ffbd7eac740
        6⤵
        Executes dropped EXE
        
        PID:5116
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6864,i,8135170201323028800,751141726627782944,524288 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:14
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3484
    - - C:\Program Files\Google\Chrome\Application\chrome.usa
        
        "C:\Program Files\Google\Chrome\Application\chrome.usa"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4716
      - C:\Program Files\Google\Chrome\Application\chrome.usa
        
        "C:\Program Files\Google\Chrome\Application\chrome.usa" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffbd7eac728,0x7ffbd7eac734,0x7ffbd7eac740
        6⤵
        Executes dropped EXE
        
        PID:4812
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6868,i,14620443388969333176,6816064438671365409,524288 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4352
    - - C:\Program Files\Google\Chrome\Application\chrome.usa
        
        "C:\Program Files\Google\Chrome\Application\chrome.usa"
        5⤵
        Executes dropped EXE
        
        PID:4804
      - C:\Program Files\Google\Chrome\Application\chrome.usa
        
        "C:\Program Files\Google\Chrome\Application\chrome.usa" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffbd7eac728,0x7ffbd7eac734,0x7ffbd7eac740
        6⤵
        Executes dropped EXE
        
        PID:5260
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5580,i,10140403930253073931,16186086308158613381,262144 --field-trial-handle=1932,i,9370993410627771956,7874804402833747999,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:10
      4⤵
      PID:6696
    - - C:\Program Files\Google\Chrome\Application\chrome.usa
        
        "C:\Program Files\Google\Chrome\Application\chrome.usa"
        5⤵
        
        PID:4608
      - C:\Program Files\Google\Chrome\Application\chrome.usa
        
        "C:\Program Files\Google\Chrome\Application\chrome.usa" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffbd7eac728,0x7ffbd7eac734,0x7ffbd7eac740
        6⤵
        
        PID:6732

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5824

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2728

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4344

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4936_13428005695969684.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\4936_13428005695969684.pma
Size 696B
SHA256 da9a8ae0c04da6ceae900796a026f4777895bf149eed2c495fbdae098362f596
MD5 3f5af086a83b749aa34a3aac1b986a0a
SHA1 0e67e17122beec914722d98cef0e669541560ff3
SHA512 0a12749b3971d0023cc1dd4f87113c94cc2c961ef824009c89a32ba24fe51de83357bb0757af7612ffb3a638302f5a298a2fc823dec8d117cf27255d2996191b
TLSH
T153010E49A3144F77CC828D3584FE27412BB0FA501B821BBF7B10724F2E021C9AED9168
MD5 SHA1 SHA512 TLSH

Submit Download

5852_13428005696025758.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5852_13428005696025758.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

chrome.usa

Path C:\Program Files\Google\Chrome\Application\chrome.usa
Size 3.1MB
SHA256 fdcfa390134b6d9a6bb68f9b7c452c01701e2b27fca1b9227e5b92f652df2457
MD5 fa63967c128ae8a0849c916979790211
SHA1 7064ec510e9828d290aacdee2af26855ca816c84
SHA512 db167c33774c8032501e36488c9f6724a7394f9e7134a1c9235df8bc7f71658132bc39a84967cf98ef8a61e68ce2d4c813f156ae445a8f6273c811e746fe181f
SSDEEP 49152:VyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJKcvaAcPTY6Y5AX:Um7vj1BDlZG
TLSH
T19DE58C13F2D940D8D059D079874A9232EA72BC494B3166DF0A90BB562F7BFE06B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 3c3262392edc83806dc9a62c68c713892d5db3c4f5a18d9ff1df8af59b877f74
MD5 57986bf2d1cc7eb068a711af9e2f0844
SHA1 8aee92199406c5f54259d7db4eadba04cb54e98f
SHA512 51d4be0bf8bb43edee914ba0787fafd8d39fd3db033252347bc7d741180fb617acfb87991f3c5a669b4f701b4930a45bfb780f9e23a0b09491e9b5405960bcf1
MD5 SHA1 SHA512

Submit Download

200bf4a8-c25d-4f37-8f97-b61079ebc501.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\200bf4a8-c25d-4f37-8f97-b61079ebc501.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\service_worker_bin_prod.js
Size 129KB
SHA256 5de9e74058524e92c88ecfc5e25dee0f3d9f8af92179b33eb52638eb98022965
MD5 a884d818bbadad175baf9bee571fa66e
SHA1 d5d657d1fc86188857246cfb43e28d9e81b55c8c
SHA512 89225dd0b9e62cebc85fc66c80b3c2c4c1315ad47c2be08e1bd94058bec2d6988a96d03e2a09581d3fa7e1146d9d6050d10b117edf3aebf53f8da8c9c9331d5a
SSDEEP 3072:VkbKlHeCWDKPB/UrdJqdwgJSLIH6BTylEeRetlUGo:+oqAB6gbH6BTyGeYt6Go
TLSH
T15ED3D9CDB7A574224363A5F5002F000BB23AB8AAE44C85A8F188D9E97DB546D4737F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1ebf4f1dc69203bc0e265dddcc471eb43f8d449302ceb98b246385f5821c2d68
MD5 faa5f361f42fef471040c9534c0525c5
SHA1 5e9d0d6e18594aa54d41e013b38119ee751701fb
SHA512 b970ceccc4d0f1b33033204eac2b5877f1357e40210d750d04cceb3f211a104f071bbe4b1fdd562ec80e8119b9531f08bfb29564ea23ed575f18bb1a2bec0fcd
TLSH
T1C471ACF3D7D88A6DC45156F4DB217E2FCD2D0A28422D3D26C8E8AE4B53E25B2D20134E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 28b2e63d687a2c8ae9baa4b51fb79b6467c34af3e8876528e3af18eee3a0e0bc
MD5 ff87d501d834e0e85b3dc57441711d39
SHA1 ee2674ca575dd798acd4c3b9c3049e19fa56ac68
SHA512 6bfd677407ff25cddb174e04df9eef36f5d114a9fa09934505a224df3c0a7aa4be44169321dfaca4693ae8066be5b6e0fbac68ea846a7bbc6e3e77c2e835b759
SSDEEP 192:KR+yR7v7ZpAPRp2bxXsb+WNn2j2keeRiyIsnAUge:KR+yRD9UXyxXw82Je
TLSH
T15522623EA961657B6CCAC219FE297A93D3F5103135D42E84E6FC863C21DBACC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 01a7416d15ab3f6e1416aaa27af79a281d32b9289236225b3c5ecaf8ef1ee8b9
MD5 61c8b3b8284f9cd7af466588e7ea5f4e
SHA1 f93a7a45dcfcc30c22ea040d3f080d89f472fbff
SHA512 71429aaf748b5aec34c140872fabfe890f2505aa2d931d1240c15538c57de6b41b00c3d35b07a6f46ee6a6ebba8c2930f4d52a3ce0516636d00867519242d8df
SSDEEP 192:PROyC9R7v7ZpAPRp2bxXsb+WNntjYQee2iyIsnAUgE:PROyWD9UXyxXwBYaE
TLSH
T18C32852EB961657B6CCBD219FA257B93D3F5103135D42E80E6FC8A2C21DBACC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 278f86b341484f8fbca3dee443562f710824377b4da80f429cee0cc21019568f
MD5 112c2fc853fa5f9f49959ded8c0a3cd8
SHA1 844a89ade03b0eae1d3d3e4f214f3e07d091c775
SHA512 ebeac6aa778ea98f237e8057c76c9a46b99757d5af0ada425141c2056441d0414f7dad0fc65bd1399a15bdbc26afd0a2609a1fc135213c915473b8bbec23542f
SSDEEP 192:KR+yC9R7v7ZpAPRp2bxXsb+WNn2j2keeRiyIsnAUge:KR+yWD9UXyxXw82Je
TLSH
T1FE32842EE961657B6CCBD219FE297A93D3F5103135D42E80E6FC862C21DBACC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 5aa9936ee79280485e210166af1dddea609ee65ed83cc122bbb4fe0897a6bb01
MD5 8da85b30e681f0f246674b160a6d71e2
SHA1 f786001246195871e23f6c6ce8b35f673df9931a
SHA512 42071cd3b08bfc9aa1f7a1fe864ae3c14569146444846cc93f0cb213ab2d3b3aa597a10c5fc6b3e8dda8906fa88544d557d0cb104ba5c1a998862f72986b5088
SSDEEP 192:PROyF9R7v7ZpYPRpWbxXsb+WNntjYceekiyIsnAUgE:PROyBD9MXSxXwBYqE
TLSH
T1D932852AB921657B6CCAD259FA697BD3D3F5103135D02E84E6FC8B2C11DB6CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 73fb13aba4f898c196acdcf88942f25a3a64f5810998c3b65d7ea5455ccb5b48
MD5 1ea566f3ceb86f6ac4e9243ef1c0760e
SHA1 0ac17d95f17ac52e1aaca2cff1e08ec0065b552a
SHA512 252b853f13619fe5b4264f8075449597415896c163e7680d20c2f8744998d4f91c62415e68a864886e255a4b530366207504fadaff026e577392b7c0e8d6a543
SSDEEP 192:6RSyF9R7v7ZpYPRpWbxXsb+WNnCXrq06eekiyIsnAUgE:6RSyBD9MXSxXwIrq0cE
TLSH
T1DC32852AA921657B6CDBD269FA297B93D3F5103135D02E84E7FC8B2C11DB6CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe595913.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe595913.TMP
Size 3KB
SHA256 9d076f8e6545eb52332d8997ce407ce6f14f6648574c32a7ba9d541e70e4be21
MD5 52916ba291e897894a9b58d78c4860cf
SHA1 97b5cd58b0c0dc2e9c21309f863f1efc577b9847
SHA512 00cc233d25bb095dfbf763503ef6beeaeb0748899cb52e06230206f5b71acec13b4d5ca62fdd06c3a62690dc66da1f39e1b659fabe0e11fff3a02acd4d616f30
TLSH
T1896163A8C6755EAB1EFA7674B87C1781FE61433F110008563A3D058D0FB287B8044F5A
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 82c984a4c2eca5297653e2d1d944ac01d1a705ceea5068f870bcee7f0152d1e2
MD5 ddb0e54a89224783e3b77b3cc205be81
SHA1 e0eb7089ec5ae9deb03c358a60381cb9e5334e5f
SHA512 1ddffd5f2dc62088d6e2dd521923fca2d65ed5ee3b0c0323463b639dd36834b33c77277fb0c2a8055f9a1fa4d5a260e7c2f83db936bb49b0e32123f53cdb2f30
SSDEEP 192:eGZ4K6tV7KxkXqK4I40pUZNCgVLHrKHfFKslEePdXzKD/K1+ErUkKN9QlwpBHIG8:3ZjyV7KxkXqKf/pUZNCgVLH2HfgslrdR
TLSH
T18F32EA27A98D9A7F0FD8D51CCC566F4BADB5029633640C2452FF9D0803A97CE114A6BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 07f5c630afe69cc1e803f18701213177b331b8274e7013c61ad7709a8e8f8a65
MD5 38d81854ab227ca66659b5b4f5a9519c
SHA1 30a6899950f7ab01c004e0d962c249b8ab25ac26
SHA512 939a21149bb39ff192088166fcf4e0cb83147e5af7d31b3437750c999823afd284d988f3b14da0ea761c0a051e2f45c9a76d3c7b7e14d5d513add3b38c9b4c62
TLSH
T198B0120DC04E2F41CC0046B02909108832516F22A4005743D6D05AD5CCA71F08292236
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 40e4465efe21232e42b36436be9fab0479a42568822d99755e8b2d06b19c8f6c
MD5 2caf491cf4a7ad6c393a689cc894cb29
SHA1 12a192fa4e5f15499bf90851b51ab2121c5526bb
SHA512 1c2e28df81615b0c71b8c1a3f7b6c4edec1eaa07f64d8aa3aca88392a6f09fd470266768103ad48808de30b8acb8ce5c97144da8249b7f9f8d9b62d10efb6234
TLSH
T13EA002724EC01411DDC043716871478F62525B542975934354D30689DB6B5D58541501
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a9e2.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59a9e2.TMP
Size 48B
SHA256 1c112fbfec89cd24b1c30f48955904b665fa7d0d24750d4f682f56904765d09f
MD5 08d22be0a1b1e18017b7317814da8927
SHA1 8eefd0e84bf6928fc6e90b0b6b930fd8b08413fa
SHA512 aeebd331225d27b70b6f1a00acc42b4779ab0c21b94b94dcd7355b2b13d2df589d6ef75eddb435d357f1bba012c58e52a177689a14036ae15761aeb8ad24f030
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 237f56324048d7c5c709b85e1267fb18962cecd8c9c84daa02ffbad479fdc185
MD5 c28420d1301aeeec0d4f12c43a89734c
SHA1 4676342ae51b44cc8d7e0ea99b70c4429a5edf46
SHA512 5ac5b3cfb4e31b62f90d7825ef925112f15b7c8533c575c03d76d608e9ee33ef775d9168e7c6fcf435dbf613d1bd28ec7b288b4d4b4ff173f01e4a0fe204a63f
SSDEEP 3072:R53f8x/K0pi89c6pHPUUJ/+V1nFjf5H7rY:RpaK0pVCc8K/qnltY
TLSH
T1EEC313E194B4AEB70AFE2814B21322F95C744B54E8551DC4BBFB9F9740596F01BCF904
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 03a0659ce427faa881474354b0e444cb1f645257c69fece6bf9ef57bc544247b
MD5 3f29bcafd34927b0232a25f0ed058c91
SHA1 c6b8c0a9c437af53250cd36ecda7c9418cda6f32
SHA512 639210b38529bcde22a213d7134360e8f9c19381c4476afb16fa0e478bb900d409db7938e729050b6462bed9f4b8160114dfc3b783cc1ae9e12f1ade90e7f4aa
SSDEEP 3072:C3f8x/K0pi89c6pHPUUJ/+V1nFjf5H7rY:gaK0pVCc8K/qnltY
TLSH
T165C312E1A4B4AEB30AFE2814B21322F95C744B64E4551DC4BBFB9F9740596F05BCF904
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 8a8ad49ce6b01c4bd6207ffd5e162b08451e9c6237eecd35b3b4cee0942bfe95
MD5 ed4075b50ab83148f9a46923fab7cba7
SHA1 2c45bdf99d1fabdb682d562ca926bf494df2f1a7
SHA512 f3736c45697b8bd0e27ec6b44e02df4f9f73316ec8ed4c43b15101101bad2180e7cb3f36f8428fed6f4b96e28b608abfcaf9f8b1cc09526440fd34fa5d493f1b
SSDEEP 3072:i53f8x/K0pi89c6pHPUUJ/+V1nFjf5H7rY:ipaK0pVCc8K/qnltY
TLSH
T173C313E194B4AEB70AFE2814B21322F95C744B54E8551EC4BBFBAF9740596F01BCF904
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 4340b124b059fab485e4d07874efab025d6071035b606859b8ab56d02924952a
MD5 3034f37b09d33ec269ca0c113c07884d
SHA1 9f4ad3e1aa7ac78579e6341fbfa70bad488af947
SHA512 7b48001781d2f4f2096877b7f613bb64fde9510eb773537307109d66e5309fe22ccc1171e2c2eb396a809b36e53922016a70c22a72529c33f19f7ba5344d881c
SSDEEP 96:FuC6Cd+T5Kj8OfQo1LrQRDotok5UsD1B64GyvbNsbZYbcLDqv4a:8ClTjVWDUD7LgosbZYbcLo
TLSH
T1F0A1E972E4699C77647AC488B5427B43CFBC70ABB5919FC8A9E81F0C10F74A91302A26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 2318cc325396e4af5fb747ecabbdf12c0f753e407a94e020d746b3e032935d05
MD5 28164906fbcbfc6ee85aa2348d38adfd
SHA1 9ed5f1d1c1d94978b08c3d6a535c4af0353d9ed1
SHA512 ecc9c0a021f243133ea1089cee99d0773c65f3a50022ac595c2ad0ba96666f689572f6bba65f35b1771a4fc447b0e435aff3deb8863b97c2e27971eb7a1fc60c
SSDEEP 3072:y3f8x/K0pi89c6pHPUUJ/+V1nFjf5H7rY:QaK0pVCc8K/qnltY
TLSH
T11AC312E1A4B4AEB30AFE2814B22322F95C744B64E4561DC4BBFB9F9740596F05BCF904
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.usa

Path C:\Users\Admin\AppData\Local\Temp\2026-07-08_7db5897dcf53ade46ecb3493fea0feca_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar.usa
Size 4.3MB
SHA256 a8c4ca099a07dbd87d9045f22be0e4acb34857323b8633d7fac46c97dc41d6ef
MD5 c451c81ed46b64c08d9db05237dcee8d
SHA1 ac63c873facf263439de14edde1b03f51514e0fe
SHA512 55649b927b706ba5fdda88539236e8344df8ed7ae6cb2976b8bff1b71bb1ba2dd88d3aea488ad178f6b184941ea38cdf49a19fbedc98bd8bff2fa6039c6fe763
SSDEEP 49152:B/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+lpSt3B:6WQtZ/K0tGOFWVRuLftCT
TLSH
T1D2264A03F2E941E9E0AAE178DF3596319B727C5A8BF1A5DF214032D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1312_1421911548\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

UsaShohdi.asu

Path C:\Windows\SysWOW64\UsaShohdi.asu
Size 5.1MB
SHA256 1145aabc15bf64e3c0a694f1471caa20f35e2908f298e26e2dbb6abeff096339
MD5 7db5897dcf53ade46ecb3493fea0feca
SHA1 1dc33d33a4b99dbe508dc794aff126bce6f37b0d
SHA512 ab7cc8ecb6122b7118f5f0aa8316d1704c6b484b50b352a126231491ab2e4219162b039f560119b876559fdfa1eb71f7ab1e08ddbacd0b79f43eae6450ae3ea2
SSDEEP 49152:OhkwqK/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+p:qkBVWQtZ/K0tGOFWVRuLftCTF
TLSH
T1AE466B13F5E941A8E0AAD178CF759B319B32BC1A4BF164DF269076D11E72AD03B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 fc8ef022f157b64bb639dc2c62ebe6be538b38a335682e989c9f543d61814669
MD5 5720ad28921adbd386e70e7bae57a921
SHA1 906437d950f98f412a3d2eb673a478a382b37372
SHA512 e43d2c8fb6bda927fcce8f16f33d241c1758b4327d263e43d296085f25aa16e499c98c8cece54a427c1713f1005f4e0b28ec19b084dd09f211eb1a5ee15d7c91
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 6KB
SHA256 a3c9698245260215d30d963804770e6ae709fdb2c5ac740ec3f9c0c73fddcf0d
MD5 81da7482b3d611437caa6ca802e07b0b
SHA1 ac9643234bc80453bc1ee82bd2f9fe9b10aed2bc
SHA512 ece880e0501e01cd73f16a97b255cd9a11f53996895f2f717741e24d60f523efdf5a508b7424b5a0ab04c2d11ba5f7a13df77a092d8cc90f39d1fa4a9522eabe
SSDEEP 96:8aHpNrj8U6hlwsk1/wZvvaRhK25K20c2qWAu41rbVHHhK3wK3F00:THfb6hlwp7Sn4JHjwZ
TLSH
T19DD1CDDA9F0648AF7BC58F7B324322915DAB141AC7E4B4727BDF9606F0CA964001F1A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path \??\c:\program files\google\chrome\application\chrome.exe
Size 3.9MB
SHA256 848a9404392ff3dce342d37db780aef406b8ffdfab1dc542e9d390cc584dbcc5
MD5 9b9b1a2563d753b018947d457a65e9e7
SHA1 80cedd0def2f6e69028d729f9991456fd66fe8f4
SHA512 686d9fa6a9839a16754ab5337e831b88481fa9c18ea48a4c9e4dd5ea969d3532065d40e24cb9ef7f6992a1d33cfb1aff12cefd885d937a064f964f7121bcb7db
SSDEEP 49152:OhkwqUyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJKcvaAcPTY6Y5AA:qkB7m7vj1BDlZ7
TLSH
T1AC169D23F1CA82D8D059C079879A9B72E526BC15073065DF1BD0BA522EB3BD12F3E725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3364-1052-0x00007FF655840000-0x00007FF655E6C000-memory.dmp

Download

memory/4676-1224-0x000001CC0BBE0000-0x000001CC0BC00000-memory.dmp

Download

memory/4676-1179-0x000001C409A40000-0x000001C409B40000-memory.dmp

Download

memory/4676-1189-0x000001C401340000-0x000001C401360000-memory.dmp

Download

memory/4676-1191-0x000001C401780000-0x000001C401880000-memory.dmp

Download

memory/4676-1208-0x000001C401580000-0x000001C4015A0000-memory.dmp

Download

memory/4676-1180-0x000001C409A40000-0x000001C409B40000-memory.dmp

Download

memory/5872-1047-0x00007FF655840000-0x00007FF655E6C000-memory.dmp

Download