faab7c20eeb91ca479f5f024ee677377a51ed8a7b1e9e85934af958105a8b734

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Size 4.7MB
Sample260710-dabpwsdv2y
SHA256 faab7c20eeb91ca479f5f024ee677377a51ed8a7b1e9e85934af958105a8b734
MD5 9e0dbf7dee489b48daaae7b5a7f274ae
SHA1 dfd1ade48f37e5b5955b0b94afc42b2c15628f0b
SHA512 120994adc6a341e8d2430851bd4fa29c351b7c939343ab6f86e3cc46e8c741ad7417ace8c1563b5c77f48ca79b35122b81e86d3920eb55a6ccb2cda4c5efeb81
SSDEEP 49152:dR4OWAXbQZC8OW1/rN1RHHEtB9zd2CBJaLnIdyCYuewuKwPlUmi3IkC4ICYSZbSy:YEtf5BJaL+8SkD527BWG
TLSH
T1A0367D13F2E941D8F0AAE2749B365332EE72BC568F31A5DF064036151E76EE05B38B61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 15 IoCs

pid	Process
1936	elevation_service.exe
2632	elevation_service.exe
3808	maintenanceservice.exe
4384	OSE.EXE
3692	PerceptionSimulationService.exe
5404	perfhost.exe
2656	ReFsDedupSvc.exe
4256	SensorDataService.exe
3508	ssh-agent.exe
5608	AgentService.exe
4672	SearchIndexer.exe
5928	chrmstp.exe
5748	chrmstp.exe
4444	chrmstp.exe
2868	chrmstp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\34472fe24febf98.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\javaw.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3120	chrome.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000073b31a8f1610dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf413e911610dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005ee388f1610dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e93e1ed01610dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000afc9b0901610dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
5980	chrome.exe
5980	chrome.exe
5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
5980	chrome.exe
5980	chrome.exe
2632	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe
3724	chrome.exe
3724	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
5980	chrome.exe
5980	chrome.exe
5980	chrome.exe
5980	chrome.exe
5980	chrome.exe
5980	chrome.exe
5980	chrome.exe
5980	chrome.exe
5980	chrome.exe
5980	chrome.exe
5980	chrome.exe
5980	chrome.exe
5980	chrome.exe
5980	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6020	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeBackupPrivilege	2656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2656	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2656	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2656	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2656	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2656	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5608	AgentService.exe
Token: 33	4672	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4672	SearchIndexer.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeDebugPrivilege	5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	5392	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5980	chrome.exe
5980	chrome.exe
5980	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6020 wrote to memory of 5392	6020	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe	86
PID 6020 wrote to memory of 5980	6020	2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe	87
PID 5980 wrote to memory of 5648	5980	chrome.exe	88
PID 5980 wrote to memory of 3120	5980	chrome.exe	91
PID 5980 wrote to memory of 2564	5980	chrome.exe	92
PID 5980 wrote to memory of 2564	5980	chrome.exe	92
PID 5980 wrote to memory of 1500	5980	chrome.exe	93
PID 5980 wrote to memory of 1500	5980	chrome.exe	93
PID 5980 wrote to memory of 2028	5980	chrome.exe	94
PID 5980 wrote to memory of 2028	5980	chrome.exe	94
PID 5980 wrote to memory of 3600	5980	chrome.exe	95
PID 5980 wrote to memory of 3600	5980	chrome.exe	95
PID 5980 wrote to memory of 2796	5980	chrome.exe	98
PID 5980 wrote to memory of 2796	5980	chrome.exe	98
PID 5980 wrote to memory of 4304	5980	chrome.exe	107
PID 5980 wrote to memory of 4304	5980	chrome.exe	107
PID 4672 wrote to memory of 1148	4672	SearchIndexer.exe	108
PID 4672 wrote to memory of 5624	4672	SearchIndexer.exe	109
PID 5980 wrote to memory of 4512	5980	chrome.exe	110
PID 5980 wrote to memory of 4480	5980	chrome.exe	113
PID 5980 wrote to memory of 4332	5980	chrome.exe	112
PID 5980 wrote to memory of 4480	5980	chrome.exe	113
PID 5980 wrote to memory of 4332	5980	chrome.exe	112
PID 5980 wrote to memory of 5928	5980	chrome.exe	114
PID 5928 wrote to memory of 5748	5928	chrmstp.exe	115
PID 5928 wrote to memory of 4444	5928	chrmstp.exe	116
PID 4444 wrote to memory of 2868	4444	chrmstp.exe	117
PID 5980 wrote to memory of 1084	5980	chrome.exe	118
PID 5980 wrote to memory of 996	5980	chrome.exe	134
PID 5980 wrote to memory of 1084	5980	chrome.exe	118
PID 5980 wrote to memory of 996	5980	chrome.exe	134
PID 5980 wrote to memory of 1980	5980	chrome.exe	122
PID 5980 wrote to memory of 1980	5980	chrome.exe	122
PID 4672 wrote to memory of 1520	4672	SearchIndexer.exe	123
PID 4672 wrote to memory of 1964	4672	SearchIndexer.exe	124
PID 5980 wrote to memory of 6032	5980	chrome.exe	126
PID 5980 wrote to memory of 6032	5980	chrome.exe	126
PID 5980 wrote to memory of 6104	5980	chrome.exe	127
PID 5980 wrote to memory of 3384	5980	chrome.exe	128
PID 5980 wrote to memory of 5616	5980	chrome.exe	129
PID 5980 wrote to memory of 6104	5980	chrome.exe	127
PID 5980 wrote to memory of 3384	5980	chrome.exe	128
PID 5980 wrote to memory of 5616	5980	chrome.exe	129
PID 5980 wrote to memory of 4072	5980	chrome.exe	130
PID 5980 wrote to memory of 4072	5980	chrome.exe	130
PID 5980 wrote to memory of 3808	5980	chrome.exe	131
PID 5980 wrote to memory of 3808	5980	chrome.exe	131
PID 5980 wrote to memory of 5560	5980	chrome.exe	132
PID 5980 wrote to memory of 5560	5980	chrome.exe	132
PID 5980 wrote to memory of 5760	5980	chrome.exe	133
PID 5980 wrote to memory of 5760	5980	chrome.exe	133
PID 5980 wrote to memory of 996	5980	chrome.exe	134
PID 5980 wrote to memory of 996	5980	chrome.exe	134
PID 5980 wrote to memory of 5492	5980	chrome.exe	135
PID 5980 wrote to memory of 5492	5980	chrome.exe	135
PID 5980 wrote to memory of 3248	5980	chrome.exe	136
PID 5980 wrote to memory of 3248	5980	chrome.exe	136
PID 5980 wrote to memory of 4128	5980	chrome.exe	137
PID 5980 wrote to memory of 4128	5980	chrome.exe	137
PID 5980 wrote to memory of 1104	5980	chrome.exe	138
PID 5980 wrote to memory of 4256	5980	chrome.exe	139
PID 5980 wrote to memory of 5668	5980	chrome.exe	140
PID 5980 wrote to memory of 3724	5980	chrome.exe	141
PID 4672 wrote to memory of 4792	4672	SearchIndexer.exe	142

C:\Users\Admin\AppData\Local\Temp\2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6020
- C:\Users\Admin\AppData\Local\Temp\2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-10_9e0dbf7dee489b48daaae7b5a7f274ae_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=121.0.6167.185 --initial-client-data=0x314,0x318,0x31c,0x310,0x320,0x1403947f8,0x140394804,0x140394810
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe1dcbc728,0x7ffe1dcbc734,0x7ffe1dcbc740
    3⤵
    PID:5648
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1496,i,1983381368889648273,18182408739443526636,524288 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1636,i,1917505061891408531,17477125164207826834,262144 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
    3⤵
    PID:2564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2276,i,8586956781093419281,17929942260059376867,524288 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:13
    3⤵
    PID:1500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,4360097971199315788,3653790319313333117,2097152 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
    3⤵
    PID:2028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3348,i,2461351575919954040,13388250692508076622,2097152 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:1
    3⤵
    PID:3600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4668,i,5505900870354556707,14361772220661152408,2097152 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:1
    3⤵
    PID:2796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4808,i,1429701752764720276,14784372757805142401,524288 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
    3⤵
    PID:4304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,16278445579962261600,17142798838284166304,524288 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
    3⤵
    PID:4512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5492,i,13829370349425762237,14675206532332362307,2097152 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
    3⤵
    PID:4332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5580,i,9929387034475680974,17676099396664129712,2097152 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
    3⤵
    PID:4480
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:5928
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x2f0,0x1405755a0,0x1405755ac,0x1405755b8
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:5748
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:4444
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2e8,0x2dc,0x2ec,0x2e4,0x2f0,0x1405755a0,0x1405755ac,0x1405755b8
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2868
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5620,i,10645965670627145161,13652154273453946658,2097152 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
    3⤵
    PID:1084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5472,i,12139497884117480912,14690260073600718019,2097152 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
    3⤵
    PID:996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5612,i,17925987346299024505,7393718831792894829,2097152 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:1
    3⤵
    PID:1980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6528,i,1897165101948676826,15354495538449896930,524288 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
    3⤵
    PID:6032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6708,i,16774162312853986535,5994523714602738157,2097152 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:1
    3⤵
    PID:6104
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6728,i,15933864136953949267,3224840141399327986,524288 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
    3⤵
    PID:3384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6776,i,4204735708722100330,812255187563915104,2097152 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
    3⤵
    PID:5616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6736,i,17744815605264713294,18242523708301741972,2097152 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
    3⤵
    PID:4072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,651710903064037568,15636105689988450694,524288 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
    3⤵
    PID:3808
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4696,i,1138152359708435898,568670857259675059,524288 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
    3⤵
    PID:5560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5984,i,2740571114614312415,14558399887144574219,524288 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
    3⤵
    PID:5760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,13406978268294760585,2984172399046258641,524288 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
    3⤵
    PID:996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4764,i,12513423241694862727,5216978148953441259,2097152 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
    3⤵
    PID:5492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4968,i,12955580732522870578,16670476732250548757,2097152 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:9
    3⤵
    PID:3248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4648,i,997691987078168424,11709924581531157687,2097152 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:9
    3⤵
    PID:4128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6036,i,4363179126715969855,13607003751940062249,524288 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:14
    3⤵
    PID:1104
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5856,i,4047620957058275870,18069883710493058351,524288 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:14
    3⤵
    PID:4256
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6688,i,10213706403100676881,2246872208518889102,524288 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
    3⤵
    PID:5668
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6148,i,4268876734365676658,15263228370573320964,262144 --field-trial-handle=1912,i,8255276614166254514,16177006509748394734,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3724

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2632

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3808

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4384

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3692

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5404

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2656

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4256

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3508

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5608

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1148
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5624
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2900 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1520
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2944 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1964
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4792
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2900 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6060
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2944 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 50a541ecc8147f4ed150e450e1f6bcfb7f01c3a00b591149d1eefcc0333337c9
MD5 e251caf4c05baa3b2a365efcfe1cf9b3
SHA1 bbf9bad77b93be47a1eb21de8fb49b1c582b475d
SHA512 1fda185658b9cea065cb3348f2bdc832945fc4b8a8b3ebc62edfe5aee324f64b308d6f056f7c4235c56b54413947bb6ef26cb26ffa59b779a5a5a47e15888c5f
SSDEEP 49152:Xb+632BuPkFKRrdE6ohvstBhuXjfS4LWxncDmg27RnWGj:F3q6sjBPD527BWG
TLSH
T157D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 89baa258e3773e4053c5c695dc7eb92df1a458445e5be42e82cfb491828adb79
MD5 17da9d52e9db9e44a7a0dbc4be2f6617
SHA1 c80cd56e9e71d36a5adacb4a1fe0eb17b77782bf
SHA512 135cea229fa33ad4152afb6001a3f1d19d0ce691b543379c523ade86e7230b5e0eee35d307b243b2e6f0f1fa6b40a631f0e5e88e9b11b290a997821b77d9b76b
SSDEEP 24576:eXYfDtczA/sqjnhMgeiCl7G0nehbGZpbD:9tcSDmg27RnWGj
TLSH
T15265F129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 70bd5e97fafff90a1fbb836c44397306f6e6e198ee1c76a624d6cdae266c08cf
MD5 6d8c0ac2e51a2e2e0b01bae4748ff08f
SHA1 8f2b9f1af2127ad7c46d69a4514ec41f245d52b6
SHA512 def75c8beb13dc7e7b525106a69c4c08d7e0cb1f5795d6acd7f2363574e950ca1501d86c9656d6d13fea0cd002a09a5ec78081bc0083e73fe0cf1911614f6753
SSDEEP 24576:r0Le5ji0hmxxrM4sqjnhMgeiCl7G0nehbGZpbD:rPji0Aj1Dmg27RnWGj
TLSH
T10B859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1af268699aff31e4b2eab561677d1d376daec2a7208a2d96e284645fd1b4fe37
MD5 c3285d2d386b3452d1b7a21fc5157174
SHA1 6e904dac56cc6e073e6ad604d507beafa2b00c05
SHA512 8f01987a2cb13cd8d658227ee6cbf525beefcdbdd4f11b2f7c143878aee670abc6a11a50e802a68a944d1141f0210b5389664dc619669419ce186d0627494af2
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWn6q8wyuOsqjnhMgeiCl7G0nehbGZpbD:m/ezSC6vUzPveHjy5Dmg27RnWGj
TLSH
T10E755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c3d62afbe3608a1d4e975c94387272f3b997a926f7d70c6abbdc73972b22056a
MD5 78b7700fea8ab7def4899d73c7552b28
SHA1 b69fe9b7b2d9e0ca20fd576120a10638d5dd6a77
SHA512 702e67132f20715078494c4f39952fffc753721c500dd2514e74f7a08d8110acd8008be0c3569a89bbbde1b632c7125d8ca654f0f7b6c5c70caf0ec559ef4977
SSDEEP 24576:zVbqPb88hv/l+YrsqjnhMgeiCl7G0nehbGZpbD:zVO88hXl+6Dmg27RnWGj
TLSH
T1D4559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 2b50bd9279b4cb0510ce9254b5507f4ac140142b4b764b58fc981e6216efca09
MD5 637170c2b1b4044cb34ed170bc3a5314
SHA1 08681579985c5047aa8367820b011e5450eedafa
SHA512 506bc8d9fb3dfd8b99dabf72ba9c214c3b1156010bf28c6563a8f7a02ccea2720376e1ad31873f274446ba1106a36afdebe7357f084277a3bfeb7c8780ddc6c3
SSDEEP 12288:0mw5HEjsChNVBFgl0WDm+CuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:xwu4OWlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15765F14A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 be6f615e1173efe6bd4bf995a90b04ce2b7c92563e623893f33e95040105fc8d
MD5 18723551611715dd526b04794beca96a
SHA1 01ef815e9b593a2d054a65aeeb294b6af6d904db
SHA512 35263885a276ccef4771e779e532d363d5cfaf09b6a1ef7e2679d1510201854f575ea84f93348cad5ec0e18579d1bf8f881297c3ba0d329e3c8dbb20f40b728f
SSDEEP 98304:GQRQyi36YOcPbLvw2gAf+PN3LD527BWG:tQyiKa/X+PN7VQBWG
TLSH
T1BA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d848bccd67fbea9925eb0184beba85315b3b7fb4e63404b3f0f2f9232f9986c9
MD5 9dbaa793b75bf1d8252f027db765e296
SHA1 2880a6bddf7ac041b83032f9e21932c7f38f3322
SHA512 b8770cefcc633f76c08016e693b0e328dd0b2f1c16b0d5105cee4241df52033e15089b37aa2f7d4c5ba27a7c4f6f254d61bce958e81924e74d1ecc8496a5e5e8
SSDEEP 49152:pB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gliDmg27RnWGj:/u6Jmdxd2diD527BWG
TLSH
T1F2D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4444_13428125289980734.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\4444_13428125289980734.pma
Size 696B
SHA256 da9a8ae0c04da6ceae900796a026f4777895bf149eed2c495fbdae098362f596
MD5 3f5af086a83b749aa34a3aac1b986a0a
SHA1 0e67e17122beec914722d98cef0e669541560ff3
SHA512 0a12749b3971d0023cc1dd4f87113c94cc2c961ef824009c89a32ba24fe51de83357bb0757af7612ffb3a638302f5a298a2fc823dec8d117cf27255d2996191b
TLSH
T153010E49A3144F77CC828D3584FE27412BB0FA501B821BBF7B10724F2E021C9AED9168
MD5 SHA1 SHA512 TLSH

Submit Download

5928_13428125290092180.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5928_13428125290092180.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 280b5ef7db86878192387e8686ac33abb76a55dfb29531b46e7e50b1b3601226
MD5 a59308049ea42f84c92086113b75272c
SHA1 d6edcc0e1e6827ac8562048ee70ea1bf6b8bb373
SHA512 4cbb48ed3db0f6c6f4712a6619f8cecc34faa6232d1d660edf04d846e5ddbe88da2606eb3e28ee86d4683ab50d43bb3e20d0e81ee4c34aad9ae2a2d2575543bf
SSDEEP 24576:bfwvUk9RX6wkyAIEsqjnhMgeiCl7G0nehbGZpbD:xMnYIgDmg27RnWGj
TLSH
T19685D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3a1faa507d6e3a96bc6fe1165dba7bb70bf42898d803586d3c0a3fe9d15a6002
MD5 a064628d78221227dc5aff723836fbd7
SHA1 8f86b4067d1892231201465156af828d8f4bf4c9
SHA512 b8fd07f09e256d5a00da72424fb14d7bdb15f2b910cc304658d7fe559042d5502669711ff69872394e0cadd026fc08969e555b14c951fb873deff922e0d501e0
SSDEEP 49152:5YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0DDmg27RnWGj:UySzPrD527BWG
TLSH
T197066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e8cdf94d19466af4398f958cc103f35f91ee4b9cfab67f48084d51d7e7a29c49
MD5 4ae6c29baafadc383aac0c3d4ea11434
SHA1 f0c4d0f6662cad4ace44c70eb78ab13b9a9359a2
SHA512 954b4ba735bc5115f1b0a4c8ec6b07ab0e18e175bfc0c72818289ba08ab6a4502b11a9966b2296848efce8cc8420105a45b25416139ed38f82e86370c87146a2
SSDEEP 24576:547Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYdsqjnhMgeiCl7G0nehbGZpbD:547JUQjTirIhCnDHUPfF/TDmg27RnWGj
TLSH
T1EE65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 fd12973ebb54adabe13b4376747ed998c78e74e79cc03975f2283c11ea31047d
MD5 2dc214d8a2b7e6f3882d471d40f52dd5
SHA1 ea3755d4974a7d3ce322e8f9dae44505ec1575a3
SHA512 e5ff287efe9cb6fd34711d63e3d642aba2f994f7f329e55014b1a7c1992575dd33f588b9538ed36ee90fb41810f44672e527838cf3ca15002ccecf23170b87c4
SSDEEP 24576:UDfryUPGCuPZbMoZs5HJtO/s9ZQ5HZ/v:eyUOJMoe5fas9q5HZ/v
TLSH
T139553841762AC78FC6A950325E32D6CCA7707C01EE04AF1773C9873ED476669BAF6281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.1MB
SHA256 76cbbc6dfa27daf10ba2a5dde4749f5398daadc2b9166ba663163b7d0c9833e4
MD5 9e7d1b06b5a7eb47480b453695b5d3a7
SHA1 72738b0f1bfd1ef6b7f10d641106624bd26d9f6d
SHA512 c71c2ec93e8fa658c7efd04b256b214446e35b0f9c5716a219a662c3637206f46b2d06216a005345335fdd86ee4cf8550cd7728c6428e7ab8ceb989c4b63d4be
SSDEEP 12288:HKE28oZwed0BnMEfgX3YjWN/LPoprFcvW+uvO4TN92pa7D3FOx14RS9czX:qEYAMEfgYalLOxcv5a90sX
TLSH
T15935294165B7E75FC8BA90370331868DBB78AC06B7493F147340893C986A97EB5E63D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 95cb62b42698e7f06379df40c942fe0fce2247fc09a055fbd4067a1415770e80
MD5 0aed033326e24dfd351e48d099e4af90
SHA1 e813b2ae43ac30d036c421e5f17ab707fbdd9f81
SHA512 fbb6f429690618fc3282cbe579539d91e3408878f2b220a977cdf48285600dfd42494ced9a6aecb4b17c0ab3df982d2fe7b4ccc0dc78b9523cf9eac0774198e8
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\service_worker_bin_prod.js
Size 129KB
SHA256 5de9e74058524e92c88ecfc5e25dee0f3d9f8af92179b33eb52638eb98022965
MD5 a884d818bbadad175baf9bee571fa66e
SHA1 d5d657d1fc86188857246cfb43e28d9e81b55c8c
SHA512 89225dd0b9e62cebc85fc66c80b3c2c4c1315ad47c2be08e1bd94058bec2d6988a96d03e2a09581d3fa7e1146d9d6050d10b117edf3aebf53f8da8c9c9331d5a
SSDEEP 3072:VkbKlHeCWDKPB/UrdJqdwgJSLIH6BTylEeRetlUGo:+oqAB6gbH6BTyGeYt6Go
TLSH
T15ED3D9CDB7A574224363A5F5002F000BB23AB8AAE44C85A8F188D9E97DB546D4737F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 3b1b86fb64aad02142aea6c25b1388f08af1887f5feea62b590d4a38485b73ff
MD5 912d0fc78a780ce179cfd3bbe55dfcd6
SHA1 c488142738ed61f48fcd3cdb0c472ad00ab65857
SHA512 63a6b4c6fca8bda688fac41e5f963fefb3286314ee50da8652d2441958c4906b337a1bc092e1d570528f8b84782a40d5c7e72c2a77bd24c03734c1ad77e5f1c1
TLSH
T13A61ACF3D3D8866DC91156F49B217E2FCE2E0A14522C3C66C8D8AE5B93E2972D21125E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 b786673f0a0a11071a8ee59c043dbd0dec682d58c97855837f3d4789307ebe34
MD5 deeb90db60f831a4aae47e26696e56ed
SHA1 d9846a4c3d86409178d86724c2002d8ca890da24
SHA512 04f791bf950d7a98b6bbc97e7aeb6704f514f68f99d990f43f23175c74695e5be1514c70752f4d3589c16c18654fd41a2ad9a290fb9a23e0d4d1c43939b0af7d
SSDEEP 192:GRrrcYv7rexvAPRp23Xsb+WNn1t2NpiyIsnAUgR:GRrrcEHex6XMXwj2CR
TLSH
T1EC12732EAA24757B9CCBD21AFA727B93D3F5102235942D44EBF8C62C58DB5CD2227107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 85f712a049818c60a0d6fbd36bcef0c31bc32a03f1700b878375174041f2721d
MD5 2809c407bce2ce6380f56b2efa8f0aa7
SHA1 1a446a0bab5398da0eb9b2177f3864d1b3acbe43
SHA512 8faf96e4be8843e171bbedb4fab451ed9bfe48f0d83498300d757cdd1aa7abdb3165157eca2c821aeaeb9f22c51009fccbba9e2b23caed9878ce8de1d48270bd
SSDEEP 192:GRrrcYv7rexpAPRp23Xsb+WNn1t2NpiyIsnAUge:GRrrcEHexUXMXwj2Ce
TLSH
T19D22742EAE24B57B9CCBC21AFA767B93D3F5102235942D40EAF8C62C58DB5CD2217107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 20ae1067556fe0b77fcb4715e34115b04b9ffe9f49e10fdabb2644c69e3cc04b
MD5 fb4dc19df87dc1febde9b38e588edca2
SHA1 2cae4816bfdbd537d161111a5d8aced028e07b6c
SHA512 3b0cd01b0b886d6e5fa3ff46335e7112136d7c2fbff690f82d296a52c24fe8cf972224985b805538f78a18c2aca1591189cd6eda8e0854355e219fde4e19675c
SSDEEP 192:GRrrQ8s/mYv7rexpAPRp23Xsb+WNn1t2JTiyIsnAUgE:GRrrkuEHexUXMXwj2UE
TLSH
T1E632B41EAA14B57BACCBD229FA767B83D3F5102235942E40EBF8C62C59DB5CD2217107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5913dc.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe5913dc.TMP
Size 3KB
SHA256 3943fd0affba30d03a85144959f9da166367197a2755cf1c4fd36cd23a36e1d0
MD5 36711802be9e62295bc52ec07b897760
SHA1 5806030580e60e36ff771bd3238f7742e86bedc9
SHA512 de6d6a0659ffd082af4b00c123031fc72bac49a905f0ddf44cf8f568d3993970431a4066598ccfd659d8014ec76487ed2713d4153b1582d8fded99c45960df6b
TLSH
T18761742DD8A81DAB1DB6B275B86A2741FE21533F1581180A3DBD48CD0FB7D278040F5A
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 561f23d63e33f2b4f5106cd79a93af93abb083aded5198377e83397d5dc1a209
MD5 1f54a7503542d9911197ba9792e650da
SHA1 a081eb331bbb8d14795972bb236a352e417986dc
SHA512 797f71652b78c13e2a91eeff726cdcd7ac00ab6e8e8e412168188a4c5e502fefc28229c7abb77c339544bb84d086d5fc730a4af87611759ec200cb5784b02b41
SSDEEP 192:eLE4K6Xn7KxkXqK4I40pUZNCgVLHrKHfFKslEiTtXzKD/ML+ErUkKN9cn50i4AXf:uEjEn7KxkXqKf/pUZNCgVLH2HfgslLtr
TLSH
T15932D827A48E9E7F4FD8E51DDC537F4BACB502577278082497FB9C0403A978E224A1A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 0ed3d074047b2a28bbaad5cc3979f76a8b3d488626df7cf5c0b3233178c8956b
MD5 d6d0d3ffc691af7eef45c110b91399ff
SHA1 1adcd81fde98629e5eeb18078c252217cd47b8b4
SHA512 e0bbb7d49eb4d320477d27a99424b2fdce7af5c054e3557705f2be08a4855c65bf3d644c83f2dea3443c515c7ba410cda5d9addce75ec57b78cf0138529d2b23
TLSH
T17CB0120C804B1B01CC0041B0510610843211FE2190125747E7D059CE8CD70F4A252716
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 be95df50438598ab76eeb661c9304c6e9a4dee620a6a88ded9f6a8c89a8bf4a1
MD5 7754206937a1a78a23b5be2d9a206b26
SHA1 a1c49d61217484275bcd109867b9b40d7b3c20b7
SHA512 2e780af5998a994e796082c492620351495b86aa22a99d43025b1fb29a2b5af36e0b933244673317feb5a5e3309b3422a983713f15d840b616b83dd4ae12f27a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 5cae3c78812571e220b5fe425fce80bfae9228e7cf0f7ca2388a3678d2607ce0
MD5 0121afe692b0c99bcc770e5d7f1df91e
SHA1 efca200ab5f57d1e963eb2988bf3a1fa337f6e0c
SHA512 915a359cba7fbb9f29f4b26fe93ae4bc1bfe4e13823dbcbd2d56369251540898be25d3140fbd1b85066051f332a27c8aa78f869cb0446525947e1a93a62ca8d5
TLSH
T1C9A0022C52D01911DD208275746109422671B85C95AF8307F4E12549C8EF1F04519600
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 d497691ea87aaaade8d35b311f3c3299c7ec46109cb33994d9fea6460351ee60
MD5 579f1d805e9ee5947ce90431d29b61be
SHA1 6de7b5b68740d0539f66c663e55017f97dbb1bbc
SHA512 a15577be4726a68eabd2579723680b36685c9b9872e4513d838a0d6dd385b34555c58cc62d11e7c35c2c9e3c27aacf94bb127eed7a1a60fdaa517b468e05731b
SSDEEP 3072:y2yQKi/aan+I+umtcbRY5NSYYl2gZmVCQ0eMy1KUXpJD:ryQKeaPI+umN5NTrD0C1KUz
TLSH
T1B3C312779CB529700DB29927204F9DE62EC0D45BCA90FE7C7DC0598A34C68CE750B9A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 891add07618622265497b650217026f6420d24c74b17c457ba3378accedb81c5
MD5 a544fa1824f35b83bcd113ad6649e20e
SHA1 80491a42760bfc4a9e059ade51c6e339917be124
SHA512 bdbabde730dfd8b5239a9922687e0afbc20748cf7c5894ea32e26e3accf5801ce38f53216718003af8afe81fa661cf78f44c2a92d1d39a070d598c3be391298c
SSDEEP 96:EC65d+Ar2aetJRxW2rgj0+f+U+/EfezSSl8h4otop5k3D0B6JGyvTNchCzb3TfLC:ECuNr7OJRPrL9/EliU2o49IcMnTfRylt
TLSH
T1BDC14A72687EACB35EF7945AB4063747CEA4607B5A60AF54DAE91B0C10E30DC13CB923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 d5928f2197a36a6ef270d5d67140444e6100aa0a1ee1fed7c42b5276b307d31a
MD5 57301a237191cd2781f7f6d0c3c797ba
SHA1 f330fbc2e1e9424a35305ccdcb8ff3acee500047
SHA512 d47d831806ecbe1af94a304b6184c592c1f7a51916decb1bd06267d8e9d1d76fdac56bfc061cef16283a363f6207a438f8c248eb789321069134f7ca6fb6022d
SSDEEP 3072:yrQKi/aan+I+umtcbRY5NSYYl2gZmVCQ0eMy1KUXpJD:cQKeaPI+umN5NTrD0C1KUz
TLSH
T157C312B79DB5693109F2963B209F8CE63FC09456C590EE7C7DC4558E70C68CE310B9AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 1047e77796970743c963447671150f8e0358dce31a451890bd82546ce1226267
MD5 02f3fb94d7200954047a0f3fb1812d0d
SHA1 20b39fd66b53cc06c7b3b634f5f41809e124366c
SHA512 828eda17bbf1571c1d6cfe0bd4ba5e22f95ec26e2e40cfb4d7c0829172ce108c914ce88aff6ca8286eb760739f22cb31788e0e48757cbe547a59055ba4a211d0
SSDEEP 96:mC67d+Ar2aetJRxW2rgj0+f+U+/EfezeRDotok5kVD0B6JGyvTNm6zjl+PEhiv4a:mC0Nr7OJRPrL9/EtDUDO49Imgjl+shM
TLSH
T1C3A12932647E5CB75AB7C449B5563B03DFA4616B6A21FF84D9ED2B0C20A70DC1382A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5980_1908792489\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

34472fe24febf98.bin

Path C:\Users\Admin\AppData\Roaming\34472fe24febf98.bin
Size 12KB
SHA256 4b69615229532804953a53e4af739257694beb06b55c8daa04464dd3fe400cc9
MD5 6a819999e751ff9fc549f0b3026007aa
SHA1 3bbe02421af3876c0a8da4ed3392b12999ea6e56
SHA512 a7ad97a9ce7803b2bb1f7e878f08f9eb4ea917e4f838ddbde0da8bdd58e79438bfffc1d755c0a6fb1443b4867c350cc68eb0f19680a63ce898126bfb9192d0de
SSDEEP 384:GIph63N8fn7/edTDY1rHP34cMlJ8smp/1ngZ:GE63Wf7GD2rHPDXPdngZ
TLSH
T14242C034E6C8CF11C96D10857085ACF510229D9851B53CF624B5EADFE127BCBE8F7892
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 dfa0f026b4283ed8b414435829a0dd1f4dac82a3ee9890cfb931c80804f32f61
MD5 11232ee3afdd3280a5ae0d6e9186010f
SHA1 c601079ed79a087b32d70b435907adcc0e5f4c7f
SHA512 623e72a4e6ca1d7e1e7f4fc3b1502ba2fa1f4c4dfd647df541aca9dc63686fd1e6ebe0dde4a03950f22f76bd78970d810a099f0eb32123b85cdb1a971224f5f2
SSDEEP 12288:W07YXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13C45237B934C518AF83605B482EAE12D681B7E669F1044C3BA4778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b2a1e0eda9f5ce5f1881325940afb4fd28c404621370d72b11e48691d5738352
MD5 ea22a640474c82a25964c16cc30a0d29
SHA1 59e2e488a72f9678dfb5d400f5bfe07de455c4a7
SHA512 69092f57da4427d9f30bb5b729b83106576c62a60555fa6685d87c30e3f4061cf4dc09274e1eeeee42ecc11ee9940f528715685f0ef56e1064dacfde59827e90
SSDEEP 24576:Hgb6bmBIi49WNNFpg1rSvFv7bYOsqjnhMgeiCl7G0nehbGZpbD:Hgb4mBIBhGFBDmg27RnWGj
TLSH
T140659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 960ed3928c5f7fc7737d5bf1af98d2c5f193526eac4a0846bc72ded167ddd62d
MD5 d420b256fde4a4aed18213f27f417608
SHA1 8a7066371222b4ba28418bac9465413987425ee1
SHA512 d7bfb7852e567de690e1c6363b2ca87fe9404ff8cc9e045ca4fbebdc9a06a91ceb45d9063bd6405bcb74be649dd0c523d9eed7402dfd7eaeaf786ee5c5c7e424
SSDEEP 24576:bG88u8FpJqH1bzria7/mNsqjnhMgeiCl7G0nehbGZpbD:67ZFPqVea7/6Dmg27RnWGj
TLSH
T19485016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 7b3a4d34bd2a2ec1f4c4f042319a29d034bf24b54059e28c87523fb46ef91379
MD5 a9630c2fba80151a65853cdce51ec520
SHA1 3372eab4e4869a61315ed649f1128d2bf43e02cb
SHA512 2d502ae20832c4269ba4bfba5f147371af23fb5c6e552c264245462f283ca5ef191492992dff8a89e8c96d0996f6b70c86af3267976b528aaa0e2c7bd0a35fcb
SSDEEP 12288:fHvUrBFrEjwaQ5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:fPUr+NQ5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A165F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 86b8abf5731c9efe2bc2528934d39e8412fafee3074f6800743da3c23c35e82a
MD5 62177180948df16ed44d88029fba0fe3
SHA1 dd3c45f14cfa2933d1190643f6dcdfd15267505e
SHA512 e3d4edbc14e99edc3b92705aea35d0ec0ae1ee7043e46fb1685529bc0de30f1e6cd7a02967719d7052ee2283e2df90fc31b3951e1f8ba1c38d3fa4311944654d
SSDEEP 49152:OBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjtDmg27RnWGj:RG05lO43b4D527BWG
TLSH
T192D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ac17b5e31f82df1162cdabf89462cc0ee7fedf3255b81244841d3ceeb06cdd97
MD5 0b146bd83317e8e22952d0d7e490a280
SHA1 83dcd8bfde2ed423c7fa54b421f875497caa21ee
SHA512 df1e1d1e98bb6461e0eeaf70231be330382bad9a7beec49a8fa954f3df678a2302d36ff3abffd41c22d78f65db5e0c19e89449b275c02b9dc129caf4a8735413
SSDEEP 24576:Qfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnfsqjnhMgeiCl7G0nehbGZpbD:oa5POZ3BJt2pasx2+m1Dmg27RnWGj
TLSH
T1C565BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 45ecda620516f2a90bb7cf9c76058d2259df7c490bf9444fb53e4ba5bf41ca2c
MD5 8a1c2d273e8ded88dbc723fe48e5789a
SHA1 1d90043d3637537e4d31fa86b675c5f8cc92ba4e
SHA512 ff121ed02ca14dda69c18bc5205b8f3e607dd9a5bbb384470bb28bfe9c798626dca6dd55c731b43b48d7b44073cf619c99ff155441de58f1a2895ec5bd251cb0
SSDEEP 24576:5NcwHdjbyQ4nLC18lb/EOjowL7FkFsqjnhMgeiCl7G0nehbGZpbD:5Nc/zEOVHFaDmg27RnWGj
TLSH
T105857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 bd274b5c301601ac241872541de8e413813a90932cc93302d4fcf0b2f9695e37
MD5 d2f2c39ef9cb8c7bc8d90cd8d053bb46
SHA1 52b6fb05d46d9da2c2eb66a7fdf8e0f13a89c6a1
SHA512 3ba21c1864880849f3ca9d3427b35c6869f002e1aeec577771c076f68a19ab86fe73cef6f5abf9a55b6e3560132c879db51243cce5fdacae06547df85208920c
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 7KB
SHA256 afd0a213090e5101af558db74af2e9f235721959551d0da68bbf39e8ddef61fb
MD5 1738d9e16ebd1f635b007a69b384908c
SHA1 649b8b4382ffb2ee7e9a50a7638dd55537bcbdfe
SHA512 2c4806be16a4d323ebfc34d83b41816830becc4d3f65961d918e1865dd06e6d03f8ca6c6295ae5d3b2a165ddf272a8ea32cc5e1bc4c557c95e29873835a63694
SSDEEP 96:naWoYIULVESWBrhK2PK2WeoUkWoTz6N2u4hK3s8K3m7Bme+o:akxVoBcxzta59n
TLSH
T1F3E18E969F0288AF3BC28F3B334335525E6B240EC7D4A57337DBA106B0CA9A5151F5A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 84dc835595b606e940dd9f0f4f24b7a1426ad0ecff1e5b25393fbd7b7556215d
MD5 23465b4874ecdd7e60c8056398429b6e
SHA1 37ce0b3028dd65a253400eb330e60a053639be57
SHA512 1fa258eac1c55bfa3f4b386b08a72af8b608c053afeec283e6199d61b93db4bc8bf70784e8f9dd213cd41f302144465a4721e5f62bd21cbc90bfcbbceb975c9a
SSDEEP 24576:ITkNvNnaFeYhJNtmZBmCsqjnhMgeiCl7G0nehbGZpbD:ITMwBtOmGDmg27RnWGj
TLSH
T1A855AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 6621ff44bcb927bd327194499a188b4ac307c14d88825ebd662ca29693e7c607
MD5 8e2d0f7c945471c171ecade549e0ba4b
SHA1 8bf2e708029d8da1c3f405fc724b41c36688a3c9
SHA512 441a3f4438eb409f24c9eb4ab994780a7b49bc15f5815f66c225ddba6fad1f47eb09637a344a76a9726bd901c26132fd666ff30c90994abfc7426c4b51827001
SSDEEP 24576:sD3FHshBIYQgAcsqjnhMgeiCl7G0nehbGZpbD:sDVHeBIAAIDmg27RnWGj
TLSH
T1BF75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34472fe24febf98.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\34472fe24febf98.bin
Size 12KB
SHA256 49f7902f6c3f46d9d46aa2cb3fd782760e3b0283400fe931457098b4914be6e6
MD5 cba06ce5efe7e1db838015fa7be95c68
SHA1 81101af1a14666e1655c388b68be9103d3265477
SHA512 d3fc5e3eecbaaa1fa24ea10518a91394c9f552cf77a3b6ef9131ed4b5b9fd3391f1abb0b3e9a68fb7acfe8a2a6f6c2a6e076f651f1e8dc9cdf246c69a204a317
SSDEEP 384:ye/BBSI4BzuudvqjylxwHVaffhDpXlKCTieob:X5PudDcHU5DpXICTtk
TLSH
T1DA42C0C33A9E0837943C1543F8FD28C6E581C71265456C1AF4239B3AC2779E65AC95EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1936-33-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1936-49-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/1936-43-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/1936-82-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/1936-85-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2632-172-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2632-51-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2632-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2632-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2656-1198-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2656-125-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2656-126-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2656-1197-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2656-119-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2656-400-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2868-478-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/2868-447-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2868-453-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3508-432-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3508-146-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3508-143-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3508-152-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3692-344-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3692-111-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3692-105-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3692-103-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3808-90-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3808-88-0x00000000015F0000-0x0000000001650000-memory.dmp

Download

memory/3808-79-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3808-80-0x00000000015F0000-0x0000000001650000-memory.dmp

Download

memory/3808-73-0x00000000015F0000-0x0000000001650000-memory.dmp

Download

memory/4256-412-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4256-480-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4256-485-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4256-132-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4256-138-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4256-131-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4384-99-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4384-92-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4384-329-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4384-93-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4444-436-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4444-442-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4444-462-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/4672-180-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4672-174-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4672-173-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4672-486-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5392-18-0x0000000140000000-0x00000001404C7000-memory.dmp

Download

memory/5392-118-0x0000000140000000-0x00000001404C7000-memory.dmp

Download

memory/5392-19-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/5392-11-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/5404-115-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5404-384-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5608-156-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5608-157-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5608-165-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5608-163-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5608-167-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5748-1169-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5748-423-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/5748-430-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/5748-471-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5928-413-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5928-419-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5928-468-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5928-428-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/6020-1-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/6020-27-0x0000000140000000-0x00000001404C7000-memory.dmp

Download

memory/6020-8-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/6020-0-0x0000000140000000-0x00000001404C7000-memory.dmp

Download

memory/6020-7-0x00000000020C0000-0x0000000002120000-memory.dmp

Download