3b74f3a8d17a7afa673ab350769f71f47d4f0b2ba2401be3db02f35c23ff9c3a

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 09:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Size 7.9MB
Sample260728-lqhr5stdnf
SHA256 3b74f3a8d17a7afa673ab350769f71f47d4f0b2ba2401be3db02f35c23ff9c3a
MD5 d96aab2d4a76eef4ddaa837e29221b55
SHA1 c3d98b73c75c7ed84a46de8043fc9960a13e252d
SHA512 6e70946b7ee6cd6a152b470ca4143291fa53cf9260dd8f16d20bf92b22283557e8a481693eefa59a1bd6a52b82023ee0af022dd9b1276491f36e4df656e8a8dd
SSDEEP 98304:1rzXpkF0J99JITGW45jxvdz4uzBGuB2Yyjl:1/CFE7I4fBGuZ
TLSH
T13C868C13F2A501FCD05ED974CF3956329A317C4A4BB0A2EF269836E11A75ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
5540	alg.exe
4412	DiagnosticsHub.StandardCollector.Service.exe
2740	fxssvc.exe
5100	elevation_service.exe
3272	elevation_service.exe
692	maintenanceservice.exe
3912	msdtc.exe
3716	OSE.EXE
5856	PerceptionSimulationService.exe
2632	perfhost.exe
3096	locator.exe
6008	SensorDataService.exe
2264	snmptrap.exe
5272	spectrum.exe
5296	ssh-agent.exe
3776	TieringEngineService.exe
892	AgentService.exe
1280	vds.exe
6000	vssvc.exe
3336	wbengine.exe
4324	WmiApSrv.exe
1312	SearchIndexer.exe
4360	chrmstp.exe
2544	chrmstp.exe
3108	chrmstp.exe
5128	chrmstp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d106f731905883c7.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86218\javaw.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
376	chrome.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f5c7c3b5751edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005a6de7b4751edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297054699622710"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d84081b5751edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006acdcbb4751edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000000db85b5751edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000781073b6751edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000064e8fcb4751edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
5980	chrome.exe
5980	chrome.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1864	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
5980	chrome.exe
5980	chrome.exe
4412	DiagnosticsHub.StandardCollector.Service.exe
4412	DiagnosticsHub.StandardCollector.Service.exe
4412	DiagnosticsHub.StandardCollector.Service.exe
4412	DiagnosticsHub.StandardCollector.Service.exe
4412	DiagnosticsHub.StandardCollector.Service.exe
4412	DiagnosticsHub.StandardCollector.Service.exe
4412	DiagnosticsHub.StandardCollector.Service.exe
4196	chrome.exe
4196	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5980	chrome.exe
5980	chrome.exe
5980	chrome.exe
5980	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2240	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeAuditPrivilege	2740	fxssvc.exe
Token: SeRestorePrivilege	3776	TieringEngineService.exe
Token: SeManageVolumePrivilege	3776	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	892	AgentService.exe
Token: SeBackupPrivilege	6000	vssvc.exe
Token: SeRestorePrivilege	6000	vssvc.exe
Token: SeAuditPrivilege	6000	vssvc.exe
Token: SeBackupPrivilege	3336	wbengine.exe
Token: SeRestorePrivilege	3336	wbengine.exe
Token: SeSecurityPrivilege	3336	wbengine.exe
Token: 33	1312	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1312	SearchIndexer.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5980	chrome.exe
5980	chrome.exe
5980	chrome.exe
3108	chrmstp.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1864	2240	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	86
PID 2240 wrote to memory of 5980	2240	2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	87
PID 5980 wrote to memory of 5924	5980	chrome.exe	88
PID 5980 wrote to memory of 1676	5980	chrome.exe	114
PID 5980 wrote to memory of 1676	5980	chrome.exe	114
PID 5980 wrote to memory of 376	5980	chrome.exe	115
PID 5980 wrote to memory of 4284	5980	chrome.exe	116
PID 5980 wrote to memory of 4284	5980	chrome.exe	116
PID 5980 wrote to memory of 1956	5980	chrome.exe	117
PID 5980 wrote to memory of 1956	5980	chrome.exe	117
PID 5980 wrote to memory of 5196	5980	chrome.exe	118
PID 5980 wrote to memory of 5196	5980	chrome.exe	118
PID 5980 wrote to memory of 5328	5980	chrome.exe	119
PID 5980 wrote to memory of 5328	5980	chrome.exe	119
PID 5980 wrote to memory of 5300	5980	chrome.exe	120
PID 5980 wrote to memory of 5300	5980	chrome.exe	120
PID 5980 wrote to memory of 2204	5980	chrome.exe	123
PID 5980 wrote to memory of 4360	5980	chrome.exe	124
PID 4360 wrote to memory of 2544	4360	chrmstp.exe	126
PID 4360 wrote to memory of 3108	4360	chrmstp.exe	128
PID 3108 wrote to memory of 5128	3108	chrmstp.exe	129
PID 1312 wrote to memory of 5476	1312	SearchIndexer.exe	131
PID 1312 wrote to memory of 4728	1312	SearchIndexer.exe	132
PID 5980 wrote to memory of 5544	5980	chrome.exe	138
PID 5980 wrote to memory of 3344	5980	chrome.exe	139
PID 5980 wrote to memory of 404	5980	chrome.exe	140
PID 5980 wrote to memory of 4196	5980	chrome.exe	144

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\Temp\2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-28_d96aab2d4a76eef4ddaa837e29221b55_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=150.0.7871.187 "--attachment=C:\Program Files\chrome_installer.log" --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater_history.jsonl --initial-client-data=0x2d8,0x28c,0x2dc,0x288,0x2e0,0x1406c9980,0x1406c998c,0x1406c9998
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb3363c728,0x7ffb3363c734,0x7ffb3363c740
    3⤵
    PID:5924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,12078099371931375909,4588281121250011701,262144 --field-trial-handle=1992,i,4405877101497968432,11278548596823902287,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1988 /prefetch:2
    3⤵
    PID:1676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1940,i,2908850319980020161,1498258157933776652,524288 --field-trial-handle=1992,i,4405877101497968432,11278548596823902287,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2228 /prefetch:3
    3⤵
    - System Time Discovery
    PID:376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,16085400266354934065,17861358904045384362,524288 --field-trial-handle=1992,i,4405877101497968432,11278548596823902287,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2536 /prefetch:8
    3⤵
    PID:4284
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3188,i,4165230255332577080,12355056502396459208,2097152 --field-trial-handle=1992,i,4405877101497968432,11278548596823902287,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3200 /prefetch:1
    3⤵
    PID:1956
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2996,i,15551600451740814907,672426344962090666,2097152 --field-trial-handle=1992,i,4405877101497968432,11278548596823902287,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:5196
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4296,i,4455776470227723065,11518963004474675941,2097152 --field-trial-handle=1992,i,4405877101497968432,11278548596823902287,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4276 /prefetch:2
    3⤵
    PID:5328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4588,i,8963590846956507899,12247621578377853416,2097152 --field-trial-handle=1992,i,4405877101497968432,11278548596823902287,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4668 /prefetch:1
    3⤵
    PID:5300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4448,i,5752083620976052319,10546877316889283457,524288 --field-trial-handle=1992,i,4405877101497968432,11278548596823902287,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5464 /prefetch:8
    3⤵
    PID:2204
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2a4,0x2a0,0x2cc,0x29c,0x2d4,0x1405755a0,0x1405755ac,0x1405755b8
      4⤵
      Executes dropped EXE
      PID:2544
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3108
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2c8,0x2a0,0x2cc,0x298,0x2d0,0x1405755a0,0x1405755ac,0x1405755b8
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:5128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5988,i,2635773430545057079,1360636175648689783,524288 --field-trial-handle=1992,i,4405877101497968432,11278548596823902287,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6000 /prefetch:8
    3⤵
    PID:5544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,3823220109632682757,7480798788809451875,524288 --field-trial-handle=1992,i,4405877101497968432,11278548596823902287,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5960 /prefetch:8
    3⤵
    PID:3344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,16957523001065637510,10644917388895957506,524288 --field-trial-handle=1992,i,4405877101497968432,11278548596823902287,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6092 /prefetch:8
    3⤵
    PID:404
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5940,i,18161779800211906919,1695064703745321932,262144 --field-trial-handle=1992,i,4405877101497968432,11278548596823902287,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2900 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4196

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5540

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4412

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4760

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2740

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5100

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3272

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:692

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3912

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3716

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5856

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2632

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3096

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:6008

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2264

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5272

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:740

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3776

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:892

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1280

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6000

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3336

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4324

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5476
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 296e89f963b9b32a99453457b59e430b22fddff8e9ae55202a1e3d29c2911fba
MD5 1bd2ea0099a5253e3a54181f731f865f
SHA1 5e849d5decd0c5297e982c46bfdba4d3befb0268
SHA512 968cf8483e831b323f170d56cccd0f8f48c68dc86205019dd6ec87c549b2a4d95f81d0a1913ae004a276d549d4373aad5946202aee538cef9ed9b201e5fa4fce
SSDEEP 49152:Gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnbaB0zj0yjoB2:43q6HjBlB2Yyjl
TLSH
T1BBD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 02bc6b31a6ac67c8f4698a894744c6ff052058c256f1ee40b0b1c571f6b0bad2
MD5 5e444892b626b55d2380bca17715f4ec
SHA1 a8545e5416f1c296847d86023d32d888bd6ee083
SHA512 a67f7db6ced573a9f0adae7fecdc615f7b131f6c8246daf6f6ee501e765533b6b79d5c16531e1c890032cf8331f00b95685c381397f5a062c24c4f361024bdac
SSDEEP 24576:bXYfDtczAWatr0zAiX90z/F0jsFB3SQk0:+tcJaB0zj0yjoB2
TLSH
T19665022977D504F9DC67823DC9A18506EA73785147A0E7CB03E4AA2A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 2e743fb087ad776ace3dcc0fb937748e3f10d4993a8debbbe48bb6d0a3cf1bbb
MD5 2181ab539683c3f10bee425584a272f7
SHA1 358507a22522deb9701af053e535d77bd1b34942
SHA512 d0d33055d6a4b6dc16928d380639d5b53d05fdf6b3a2225ae46bc9884a8c8684190958ab0045d0d0f7d3d3415b564c2a31850e06555c458acc57f84f0d78b5f9
SSDEEP 24576:l0Le5ji0hmxirMjatr0zAiX90z/F0jsFB3SQkl:lPji0AcIaB0zj0yjoB2
TLSH
T1EB859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 027d466b4eca078dbfb29a5ed758c6cc7cc586d9e84a93006aee2cebd7276a33
MD5 0ac462c1d35a9f7ffd1ea0bf7e022c92
SHA1 1f0a4871f3e669e95c94e951497272f741edb6ea
SHA512 b0ac6d36a959305b9f059ab1c7030b9605e0b141d3702db0ad65a8dfdf82f37253058153fba97890c6aa2a9fd0f3df742922b6645cdd3208d262fc6b9cc0dbf1
SSDEEP 24576:ba7/ezSC6vUyD/aqgrvWE6q8wyu5atr0zAiX90z/F0jsFB3SQkv:2/ezSC6vUzPvxHjycaB0zj0yjoB2
TLSH
T120755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8332b2970927693dc343df0988b17ef55f33fb838697768bbb2f0d29d09fd4c2
MD5 64afd086dc2ad539deca0463a93149e7
SHA1 f91d96233d009b50647e31e851e11fa3de88e88a
SHA512 0b8ca29cb902f66dc48fc1c8292c43f9771668c65d47349c9c3a312938ffa2e825f16d4e182b30397f9b4867cea62d9ae8c458e3dbc51a6a817ccf0ece0d74fe
SSDEEP 24576:rVbqPb88hv/l+6Satr0zAiX90z/F0jsFB3SQkg:rVO88hXl+XaB0zj0yjoB2
TLSH
T1E755AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 04296666fa755f6f3b85814165df7e282e162279fe9e4438b0477fda8536e45e
MD5 db3db6f758c49b3dbebc2653f5e69d83
SHA1 9af2dc2a2ec52e94b80857b43e6f3a83394f1cb5
SHA512 bcd4ac9f42565c34cb86b4825ed55ad36e299e875547adcdd5edd41c799520ee0259dda2d80e4f31402ba3aab8e57062f989111e86708f076a17ee218ca15955
SSDEEP 12288:CRvUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8t5:CRvatr0zAiX90z/F0jsFB3SQki5
TLSH
T10A45230B340E80F2CDC32B3566989C4B1AB99EB065E2AF45E1D13F4F9D3C2C695656C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 393bb1779ace35df359a877967077d29f0901fafa6be50ae24918f80834db5b1
MD5 952475105a80264903f4e66e6b116a38
SHA1 64352924bad803dad6064219af7f04b8f834e5e5
SHA512 43f7481c6abf90669ec428424e99053de50bcacb0ff677eea0c60263b5c51716564bce26fe29618982e8e1e16b756235325fb588c70cacee0e37f66864a65e26
SSDEEP 12288:meBNUbTVO86UaUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8U:mJIUaatr0zAiX90z/F0jsFB3SQkZ
TLSH
T1F165CF3BAE28FCE2C27A4D785B90C600D77278704B62A3CBD165930EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 828ba18838118abe80d076ee3e690ea88a6f99eae1cb83ab78c4d07048eb6095
MD5 24c2503870878a9646acdc4c6d369d1e
SHA1 ebfa5732fee9fc05793451d25a9673e3f5743a09
SHA512 9323834ab98ceafff93f91a24a0acc7374ea2adbe700bfda8798eef9982bfa54d5516b728890448679e94a6dc0b5a82641846425dbe95f7dab75ed87278500c3
SSDEEP 49152:vQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THM:vQvGAdlCEL8c/yRNw5CwB2Yyjl
TLSH
T1DD267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 190146c74cae8272f0950544f69211e53496067bbe2ad4a656e6d0f034285769
MD5 05e1538290e2fbe56be16db65e8d5909
SHA1 b87ee5446d81977eb2352a992f074cf37d1f3c8e
SHA512 3afe4f94a3a2985d163cf38578606eedbe01b29177e2144fb3c78f7a9cfe64723df4de03eeb19c6b7af1291df8ec30de103320d7a04cd06daf9082d9cd9c9465
SSDEEP 12288:bAwSfxL/2Dc34DLLmt0LDQewsAj4UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHI:EdewsAj4atr0zAiX90z/F0jsFB3SQkw
TLSH
T16D75E031FE75D032C6BB0DB61B25C706147D7A604BA21AC3E3E86E8E59342D22376E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9e5819aa720dfcf5fdec7c3062766b21b58f77813e294c20e86b218a2333b59c
MD5 3bb3811133b14571aa4790693f2368aa
SHA1 2f9565aef9c8409a1a91e28900e067376651e1c2
SHA512 cd8b3427d34efa85e66e7beaf17c20c72311995e1b28a7af8424d642db226ec11f0f7f00992a3e74c35e780219b5f2b8a3f0701d3942fafb67ccf21f807329de
SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHvZ:PUEtQevvqc2W1cpV2EI32h
TLSH
T191474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 72f0bff843e9155e1819345a9cbcc9c8f0f1e15391affc7611dd42cf28d45a19
MD5 6fa7daaa09a579c6df0b9d13b04d71ee
SHA1 e770c5454b26e3c89f363619f311acf4c05d4d36
SHA512 c28f6b3b727e2309e806528d9319a95230d2b29e89ab4870cdf70077d4be2afc0f89d23e4bc5dd63d2ec4e7daa5b27386e89a24011a038958279af4fcc4114e6
SSDEEP 49152:BCbRquA/m2yL5zQfFiV+XenmE3/zYaB0zj0yjoB2:uoqtVjnm8B2Yyjl
TLSH
T100D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 302e18294e68478472578bd2f2ec1f05d2b6a3a35775e8c78a468d898b7a1194
MD5 c9fc1b0575f19f299230a55badfd9a2e
SHA1 a44a4ee6780d64039f48c5a0c357119c0c15c193
SHA512 c1f3eef05326833a90d8ff558b5fbe4ea0db80bc6dcac8eb24be19ac5f2b155a2923bd9c870a64b0e83ade72ae237b696f43b1104b661fed95041c119b1d9c85
SSDEEP 24576:VAhGLJIFoiwtA5l7S53tatr0zAiX90z/F0jsFB3SQkF:VAMyFoiq59aB0zj0yjoB2
TLSH
T149359D81EBF955D4F5F3AA7899B58571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 a5150ffa7b5a8ebbe610a0dc940c7f4fb191bdf43214a84cbd4d75f47e19fea8
MD5 2b474a7fa599198716d0e57d53859dff
SHA1 8fcdb8b484d4c8a12a91aad0f450d46f1d500743
SHA512 45c4a7e4738f6a9b88762b486db738cfd2191c27aaca556be7227eb9b7e3b2271569ac6b127444e614b31879e0655d02867782ad6cedcff6c5cb3a3112a43dbb
SSDEEP 12288:Mmw5HEjsChNVBFgl0WDm+CZUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8D:pwuoOW8atr0zAiX90z/F0jsFB3SQk6
TLSH
T19D65F14A36A90CF9E9A342388587C536F7F2BC112A61DB1F1360CA5B5F37351AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 0cca902323e64c911cb3dbbbe60e63b8428794c4edc3f973ce60cfe0f89e1705
MD5 cdc81c1859c28732fc01dae29473ea96
SHA1 f3899f0cd8e62ccdb498da8cd28721ac5dc60af3
SHA512 c0f683c7798af374e271eb2e7a41a4063042a40851eb6d869d8e12b63189a0b8067d47be17f42ca96c68d9e4a74ec3231e48f1821b28f2828821ec72e8ef0e27
SSDEEP 12288:XBZ1IyoUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Z:xZuLatr0zAiX90z/F0jsFB3SQkw
TLSH
T14D55124B32A960F6D5D3523C89E48906D7B2786123B283CF12607B5F5F36AC25E39763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 e7eda59a952d969bbed4e6e208025a9d5ea8ed014c732e1b439917b54019310f
MD5 5064766f29f266fd409c39081a75799f
SHA1 e2c50507aaa06328da7a296a55d094140f99d0b0
SHA512 d113b7585a9c5e0763fc883fd6bee79b382683b185d1ffbe2d9f8a973779ea368bb117be45ffb0d7894a2874d97ee557bc0956126fb7ff552bb08f8458f1ef81
MD5 SHA1 SHA512

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ec612e2e9e2a8ce39de0b91c2b61323b3f1ac6ada579159aca1959a866b8ca03
MD5 665d7e316906bd52259a6282e25f61c2
SHA1 3bb29a05f214c36dc8952c447115c59fbda0f418
SHA512 0a1167b31807ebc094d0e8bb274685769751c61cdc2bcf376d8fe34b445ea1d6da184c1ff8373e1d5f20e1b3a6daedb9da829403abb1bae6621da30d9526aa09
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UY:TQRQyi36YOcPQLvw2gAf+PN3pB2Yyjl
TLSH
T117667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 597a3987dae4c39359a90df75649ed7802ac1968937866ddd9562e3d6550e6c0
MD5 3f803d75d2e33cfb1c3239643c838e38
SHA1 65a44478f418b107ec22ae330d5fa5efed695908
SHA512 6c923aafc24000b5564f7f3fef58f4bb1af543c1e02abbb0bb77540d047bd7498baf4622ced6fc29aff35057789a2c27650c5ffdb29d635756241e5e85f4bcaf
SSDEEP 49152:qB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glmaB0zj0yjoB2:4u6JmVxd2dxB2Yyjl
TLSH
T1FAD59D13F1DA01E8D06AD478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3108_13429705471031537.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\3108_13429705471031537.pma
Size 696B
SHA256 b31d639c6bdc519e6b75ad09090d482d6595156277e9e3776915a7a2d29a9072
MD5 048692921f1bc4c9e964e99915ea820b
SHA1 29193ffd7afa7a7d89ca69f4103b57b0cbf5927b
SHA512 c0ecef20afb168d3298945861204957e0e6fdca33399003598ef789807b8c8de1142274d61ba07244cdafb9515a646eb3de7cd17a4d15d7185f275fe6a06d085
TLSH
T1C601C946A3144F67CC428D3584FE27512BB0FA501B821BBF7B50724F2E021C8AE99168
MD5 SHA1 SHA512 TLSH

Submit Download

4360_13429705471153634.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\4360_13429705471153634.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 647c31ac317ae2f73f7221d6d5870013d751f6a95ed1606fe8e97e73b18254b8
MD5 ab3f01948eb6fe000e771c6977457a02
SHA1 beae1584d51e1384e7702f99a9e48c4271c5a784
SHA512 e303a5683af3c19fabefb672edaddb76620d0e98822b920f59fa1808592a6c28223c9dd60229c770a204531a8695f6824c95480eff33875e9fbe1df8701df53b
SSDEEP 24576:9cP4mcvIjkGOxhKP2l71nNKbrh/8KBzatr0zAiX90z/F0jsFB3SQky:CP4m4IpOO67W8KpaB0zj0yjoB2
TLSH
T17365AE2DABDC0096D0BB913485658A4AFAB1742A1F3286CB1160A33D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 7KB
SHA256 1272a77c1e904590115cbf0617cc850fbc680d3f505220ddaca852e072c52ac0
MD5 a3e3ec0aaa249b1839153f8c0189dac3
SHA1 93d9922fa57c8883500b7474e2347cca2c765749
SHA512 5f105a0d5b6a16908f61134404dde221becbdd9f6c3da147b52fbfc3d0d7c39fd0c652abb9723959e1bb13d5cfec3241709f32506550cd36c62c6d9bf1de659f
SSDEEP 96:L4ae5zDpJz7MkO84FJhK3oK3ptYQ8FUwz7hK2KK2z/VQDoiYmP8:7W7z7MkMTYb8Z0h3iYmP8
TLSH
T1D7F1C09E9E02487F3BC18B6B335326956E9B100AC7E4A6723FDF8115F0CA975101F9A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 9KB
SHA256 e7b8ed1f96754a5b122c41d9ea721c815530d59b817ff8c54bd4a94db0f56b53
MD5 fd85f5cc9aab677e653d20b0d85ee0ca
SHA1 9af05fc1e7c8a069f645615025cccbe16c928717
SHA512 913f2eb3b84478e68cd526fddde4bee2b15bc2caf98a5f09220760478f9bf97c80e2703409ba59bd81097d76bad625d7082c247f453464da3d3100421b4cfd48
SSDEEP 96:L4ae5zDpJz7MkO84FJhK3oK3ptYQ8FUwz7hK2KK2z/VQDoiYmPbI8oDThK3KK3Y8:7W7z7MkMTYb8Z0h3iYmPEfZZ8
TLSH
T1D912B19A5E02487F3BC18F6B334326956E9B200AC7E4A5723FDF9615F0CA974101F9A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 934e8a2dd0b8fc2347eea4a5fcd1e0271ad9d5a2afa5dffa8aef017283231eb4
MD5 f0d9cdb92f2136d897525d63ed1a375f
SHA1 ef4e84f76ab149db1d7def9088d5e039eac018fe
SHA512 df19c50bb58e85cdd1b10d5ef14c6e5b0a2d4cb19e1a0fa5c4162ed9647256cdf4b62690daf9898df15c607728b24f1f1b75426cd85f7748ba211368898599ce
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0aac23a4985fa8f8d37b73dd4fb67b9404bfa90f82932af2672dc2c25d6abe0d
MD5 99bcc54b41219ba049079fb447bf2aeb
SHA1 708ac142ae49805327acea6cbdd63eeed5011da4
SHA512 f1f9382b7e3b6ace406bcca5629b289287729c1f4dcb6d3b537ab62dd4d76bb12bd4642bd438c2f93c74120f01335b75eb95de24734a6c4127eda1319f9129e2
TLSH
T148E0ABB9C920AC2B08FD036924080A46E24023172B4048AB3A3DC6088FBCB365596C1C
MD5 SHA1 SHA512 TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3e40e52f72d959ea04f3f98268f3babd933649f4160462c8aa8e3bb18e079b28
MD5 c0f729a415c79ea6ccd6d79d457006f9
SHA1 52b55a58944f0f9a9c0c0a2c2df92f9960465f3b
SHA512 c8012b2c129ef33980dd7d5eddbdacd285b008468a4350044f10ff458a8e2ce61d3e83e6a5fa5008aa7def30d7780c71dc4591c3c716b8f6301b9c824bb6d2d5
TLSH
T1BB519EF3C3E8997D891152F4EB106E1FCE6D0A28021C3C6289D4AF5B53E2972D20138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5f96c9b1fead5e78d1d043f6a27d06238324368afa8751632ed566b2b982b9fe
MD5 434eac9fd1e592b722d4cb1b9d98a711
SHA1 c1b721f59f4cddf8628d199b336001412b5ce966
SHA512 2997fd80fdc3abecd3ad605f7db750f20357a1ea02b778cdc93457775d98df4c2a180d90fc37d2bad445aa553386162a44bc1e74182c4171a268e0972e30573c
SSDEEP 192:pR8ElypAeMv7xwMPRpfaXsb+WNnQn2EJJwkwOa92+iyIsnAUgraJ:pR8EYlYlLXSXws2puacHe
TLSH
T1F842A27EA914697B5CCAD26AFA557F03D3F5243162C82E84E7F88A2C14DB6CC2327117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 7bf00c0c200831b77e524248dbeb0eaf5a29d8463ae4db76c367c9a7774e7f9b
MD5 3bb252a5f3673a91c9b5348a92bb59df
SHA1 26d42e46e9668f3929a1331d9322b7a3c92d7c71
SHA512 a2b547e344d435728772cc73cec17896a0292bbe01993548afc2ca6bf94ec33572d54479e1259dd36885f43a597a9b2b0eea9ce1b3c0431ba0683ff3c3de2f8d
SSDEEP 192:pR8EkeMv7xw9PRp2aXsb+WNnQn25JJwkwOa9V+iyIsnAUgtaJ:pR8EfYlcX5Xws2iuabH8
TLSH
T18232923EAA54657B5CCBC21AFA657E43D3F5103162D82E84E7F88A2C18DB5CC232711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b1ea77fcc2bdb54c49f8f4cdd907b33212e39bad4ead845dd50b17c898fd4083
MD5 83e7c878cf133a110dd1788bb49d87db
SHA1 d1d588ad5a6da0139f19676c7d8fb88bf272940d
SHA512 b91450e74c06ca1431778c53f212bbf3a1c48b99af21dee5579be4cca20119b338bbdc2b2a5e715f843f2191f90dd8db11d69d8e09d97e71b986e8c403ac5607
SSDEEP 192:pR8ElypAeMv7xw9PRp2aXsb+WNnQn2bJJwkwOa9M+iyIsnAUgraJ:pR8EYlYlcX5Xws2cuaSHe
TLSH
T1EB42A37EA954697B5CCAD32AFA553E03D3F5242162C82E84E7F88A2C14DB9CC3327117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5856d5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe5856d5.TMP
Size 3KB
SHA256 58ce07f35a92b0b2f685c0cf09199bd1d559ee9f0bf2d44407fb1b90c6a068ee
MD5 fa9f7adc5b6f9d46df59553d324a70c7
SHA1 b1401d70939d08f9c02f7cd99afadf67b8a537e4
SHA512 0f48c71678ca9aa1fd5db9bbcbd0f9e2124a5c67d4edf71a4e8fed77002181cb14b97edcad5d37152086390a662e90534dfef91603fdfe15cc0e8b89e20ebabf
TLSH
T10A6131A8D0A44C771DF26BB6B4690741FD92037F074158067D7E684D4FB3A2B4045F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 6c46408e1888f515b6d87fa5bffcbabd91ae22e5ca4b3a47305c61fb7725c6ec
MD5 805d45fea9ead9935c11b06d8b98558e
SHA1 62d0b70838968639067593caef8d080391dcfe4c
SHA512 08057ca195be7e8ab7929931daa170fbd8a1c9818d7a37072ded12d939b6ba6136e22bd352c5dab3cf082f904d8ebb70d7bcc9f6eed59106338a5f3dfa858f2d
TLSH
T153B0128080016601C44A07F4118254C872149F14960A170153E4692788256A1C439071
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588cca.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588cca.TMP
Size 96B
SHA256 07dd1263438ffacf9e9ac2cd4c0172f3e15b134375013c8a7af4c22e51d9dfa7
MD5 f100d6674bcf1d6fe662507776483083
SHA1 4b999384831e3d14dbebb851c117ea96bbe3bf42
SHA512 c4dcc1f42cf9c4ff7ab34c4a09ae540b0f79f7ee3fad09f87a0d51968a144dba5d5ba33adaad7e585536ae973449b66066829735bbe1f85ab7b89339b0d3be58
TLSH
T1DAB02202C223A22AC28203F028C080CF3020EF30C203822282F00B22CC202E20330032
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 e1ed4583aa226e87dea8953491c7ee216072759f5e61a3c113035d900d0c5471
MD5 5fd19c6b2654d7dc3afbb7588470a61f
SHA1 68c17c12ee4ce1072aed64f4cecd8795765c1944
SHA512 e0c6e754ac3e94a2f95a8237e32571c6a57086f7ba0d727233a18da83500a1e001c978f5e63bb0d61cf5f33a7ee6812d1e1477def19e870dacca631d372bcca4
SSDEEP 6144:vgr7pLhUhkeXdVbftwBmCru+g0tiphpqZ/ZLW3Exl:4rtLMVbftDCru0iphpqZ/piQl
TLSH
T1BA34233B9F425E328DE1CB38E012AD5B3BF4554BD518C246AB6F3B9F78479125E03888
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 9b65f60752c67b4623c610845b39946f115374086fdc1fdc99f26db0cf7dfd53
MD5 b80c2c1b176b43aa14bb785afaaf8fa0
SHA1 efb184b8eabdabb127765feef02d55c9f062155b
SHA512 3b870c3d93b35a2c36ae547f13e692bb55b3d645b2c710eec3e3361713d2ef859aec48a66e734c3dc06e0800e6ed1cb3207732129269b8dd7a387989aea02514
SSDEEP 1536:TIQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:Bqfd7NtZL8cHQRZEQ6Spsk
TLSH
T137C30237DBC21F339D96CB60B9530FD697B644A99034D301AA6D77BF6C83491684289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 4028f81d72d9e3d6e3d8fc150a8ae2ac76fb3ff4aa60fcbf0e73ad26f4219aef
MD5 a1def013505ba86123855d70c4902580
SHA1 74b26f2c62370bd358d5ddfbe7d6c1e3ef9dfa84
SHA512 36c48d677ba2048511320ea9b76341dc76e657d751759f07c73332ab96729d540504fb7acf9f46d33959b0313b071773ffec5e5886c558eb4b26d3dad93ac8e8
SSDEEP 6144:rPr7pLhUhkeXdVbftwBmCru+g0tiphpqZ/ZLW3Exl:rPrtLMVbftDCru0iphpqZ/piQl
TLSH
T13A34223B9F825F3249D1C738F4229E9F77F4044AD568C2429B6F3BAF68439561B03998
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 641ded2bd50f6bb76eb9d93f7bb8a998169e361f42007b63fc1a1755701741fb
MD5 26e989a906f1db6bb76bc1ebda61886a
SHA1 0dd919d6e7f3c1772cc9b530ec6f0e672e86b365
SHA512 6a0e1c371b5887037c834c48b6bb981d552422e87c1fcb7f61c96694a020021b0570221089d65d2be8d81c97f5a0f434d2a72c7af84b05696909cdf76e7b6f6b
SSDEEP 6144:yPr7pLhUhkeXdVbftwBmCru+g0tiphpqZ/ZLW3Exl:yPrtLMVbftDCru0iphpqZ/piQl
TLSH
T18434233B9F825F3249D1C738F4229E9F77F4044AD568C2429B6F3BAF68439561B03998
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d106f731905883c7.bin

Path C:\Users\Admin\AppData\Roaming\d106f731905883c7.bin
Size 12KB
SHA256 8530abc8135f2f906f30e7156bda0b97e31b69bfa26f986ada93ad22c78d5a5a
MD5 80793bede68a94b120febf0885833482
SHA1 95ba4de621b87714bdfb4fbcc87558b13c1bb3c5
SHA512 66d027c3f36058505aca8b48b8a14deb594dcb22699ca98c26b9eeefdd0227f53952147926341d967a67dc175bdfc66ac80659148a5ce16376c0fdf26b77c006
SSDEEP 384:TP0ATUqGBQalS1J/0v0mnn3DtNIKxiba2Z:TsAIqG8H/0v0CLxim2Z
TLSH
T14942D0358FBE90F636F2B69A2356AC3CC6876C35D4CAD9482083459187FF550E72EA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c120c141f57a86dd6e2d0a649deb7015f0fc8c939321006974d81aad367a6d76
MD5 1edc53006e69c06c9c7aa3b7d2518de6
SHA1 81be415d779354e52128ac1cb3369cf71b7158eb
SHA512 f8a9e7e1d3a9be66fad6fe1a109db997bcfb9a4d263f541748b1f575d24dd17d7b8d9ded0cbc72ac193eea2347661c6ad2edecf4065fe76fef61fb5a8aa5f4a1
SSDEEP 12288:jrUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik84:jratr0zAiX90z/F0jsFB3SQkP
TLSH
T10845230B351E81F3C8E36B301658C81A267E7A746BD29A8BF1813F4F9D385C259356DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ec006ed31a2f462750c4be3103dfa7a9c018d51e0ceed79d64d3db422fd38162
MD5 606dd9853af0e4146e04a60640a59ec7
SHA1 2b60130e676b0c7edc798a1182959bc0cbf9695f
SHA512 1668f8246166938d4242cf60a0899d97ca4d7334de1c3bb0d5f91f32da8f7eb463f9d16e98eedd6358fe874081f333f36fecac5e93d1c3c1ed79962375a25dd0
SSDEEP 49152:Ca0h2GEkuAe73q3pp46zwwQFaB0zj0yjoB2:Ca0hNYG4JwvB2Yyjl
TLSH
T1C285AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 43484900a84fae3eb95731514747de9974afb14cf9476054c418ad8330958776
MD5 b6632a96781233a41e7344bef8429911
SHA1 89aa1ca735b240e60cf3eef7ddb31e3130c85157
SHA512 3a59548ffb5e84ba5f9f3b88513bd60a8cc84be31f86357bfd95c0c7fbc6ecfcc7cfbebf4473b7c25dbec19f333eebd42ca35c3ae24cd1b76829fc6918176c5a
SSDEEP 12288:XhbHjfXEUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8I:XhbHjPEatr0zAiX90z/F0jsFB3SQkB
TLSH
T17155126F26AD10E5E4B2A23D8584850BC731BC351762A7DF22C1A27F4F3AAD51C35F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 9ba9ad5e265cd472ee7490c4b971131630bf4eb62a7c5925bd0c64a9ee1a776e
MD5 823eb6feecba90492247980743af1f72
SHA1 a85eaff92626a758f5d427833d00fcafa80d15d0
SHA512 c9e8c943c2b6b2a6fd20881d19debb58caa8298e5405f0de24c65c25e176f1a01b5a42c6f5c0a6411ee91a7269b0c5626bb41c03c32474973b60387a35efdabe
SSDEEP 24576:13YgnJcRTk4yti+R5dBR/8atr0zAiX90z/F0jsFB3SQk7:1IgnaTk46pBR/8aB0zj0yjoB2
TLSH
T19D45BF2EF2B910F9C8A6D236450147B5BB71782D1F209ACB0170C639AF1AED85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 9a8c1785957c6ca752b08cb3fb22d5c1caaa44e7ebc6c8404a5f32c8d0ee85dc
MD5 21f8432c3442e9b9e6a0acaa259ab348
SHA1 05d4b31b6f765ee9819074ef311a1e68281c0293
SHA512 b5ab2c7fd35dfcfc87f05d4de24ad5b1c31bf12764552ca23f330fc403e9eec67f976ad5001c3fcc36787337d03862eb48e940d157f222ad3139be578a7350c3
SSDEEP 12288:KPUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik86:KPatr0zAiX90z/F0jsFB3SQkn
TLSH
T14345230B340F80F2C8936B755688884B1A796B7067E36BC7B1917F0F9E386C766356C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 dce307604ca7f26f10e8ca7feda9b293ca73480dbd243a3564050567324d6a6e
MD5 6e63fc0af128bcf1b3d5408b2c1f73f9
SHA1 609489abc6ebd2dc0fd420620924e2e9814903ef
SHA512 286fd542a742180c95897e11d63aa16270acd48cfed51c990a0c56c09afa3ed6fc12957c91e21fff48378da992ffa34c43c29286ca88d9b9d2af8b388fb6239a
SSDEEP 12288:KOb9A4LWOsvAYFTWUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8i:7pL3UTWatr0zAiX90z/F0jsFB3SQkL
TLSH
T152750105F69500F5D867923CC9A68917D672B86C03A0E7DF03A85F5A1F237E24E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 b59461c27eb134c0c643772b705711e4f345b692b1e26504472c42441604095a
MD5 eee7a7cd8680c73f4cdc1feb5f31fd21
SHA1 65c958b6796e908d66f9dbe2329ab0d3fe20356d
SHA512 2e5d3eaaf471f58091dfc91e2f64d29b42a214b71ab128d21e5d0e852b820560e18051a1361e7d9ea4258b1c14b33b2bff4b08940a625d5a3499c56897d6d8df
SSDEEP 12288:rpFtpO6UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik87:3O6atr0zAiX90z/F0jsFB3SQkS
TLSH
T1FE55021A369D10F1D473A23C8A81820ED371B871176257DF42D0A66F5F77BE86C3AB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 53f4f4e3256ad453038f5be4cd294b9f5f70b4598ecaa75ae1f6987677583397
MD5 9b2b83ef1a72c9b256d96af3d061c0e3
SHA1 e616b7161b13c024666994bb75c85349962cbed9
SHA512 f0993154790814410d5d93391a1389819a395a23d07991f7ab827b417bd71c566a91402a3c631cd3e73c1dcf15f76a4575e0ea0e32fbb66f5aeec2ef4caa8d18
SSDEEP 24576:57NM9YqZqmWMUkPjZM48Mv6bEhs7atr0zAiX90z/F0jsFB3SQkd:57cBWMpPjN8DbEhkaB0zj0yjoB2
TLSH
T1FA65AE2E6BAC81E5D477D13DC9A28206F6F2B4611B318ACF5152833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 87fdcda2fc4268189c6404a5945478d27c96e207a695a6bfc5dc77d6bb845907
MD5 52646e29c249d2cc49c15035d3f931dd
SHA1 d7ff76e7344066421027b40541e8a518a8275f55
SHA512 f4e9a7753f0665d8459c3c19527a99eca02d9076ecbdfaf87eaf93cf61eac7bb43f8d4eadbc6244a504f1927c6e000e632cb223367746f7908a1f6858a673d28
SSDEEP 24576:lW6BApg2YuyuNDYTabvcdvNYf8km1xatr0zAiX90z/F0jsFB3SQkB:lF2YuHNETovAvNYf8kmbaB0zj0yjoB2
TLSH
T103857E2A27ED80E4E0BBD27D45B6D146FAB2B8511B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 b9d3d41c710eda831cca464543f85c8d02245032a303e29024df9766f203cc7d
MD5 f3cb358109f5d7572f254b3708be5cce
SHA1 7b5de82b6343e1210b29373ce841a77d783afde9
SHA512 eb79d9dd8a65a1f8068fbcd0da033ffabf77584792dae4b04e825bf3ad9985c1d87d96be9987e454f2285adc3f130eef8591c5fd7a373f75017e7ec766ed7f38
SSDEEP 24576:dAFs06+Omlf3NXEbToeatr0zAiX90z/F0jsFB3SQkm:SFs060lVXulaB0zj0yjoB2
TLSH
T1C365AF2F66EC00D5D07ED17D8A96C91AF7B1746307215ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 c08942a2ec5903db01d27af0f08519190a528a3439721e27de1e510a3d77ff10
MD5 0b0eb6931895e04ce7770103b516b29f
SHA1 4538dc5e2e7770ff472ddc5dcf773e14d0025afc
SHA512 1df152d17b050fde4ce2b505d2cd455f70af38fe4fed5556d9d2714fdf725a5e7e78a7b7191bf85d26ded32119d1b13ee9ce3c0ad02d95743a2c068a011916c8
SSDEEP 24576:UJnJ5D3WXlatr0zAiX90z/F0jsFB3SQkD:UJnJ5DGXlaB0zj0yjoB2
TLSH
T15B75D02DD2A810F4D4B7C37482591B46BF72387D2B226AC724B4E5357F22EE09A79F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 2984a6a3f2857a29d6481726f63e26abf9488f89ae5318191645a2bb7127b758
MD5 488f83be11feffcf16be7d3bdd9da415
SHA1 ce33f658f23e966f568c2dd40a89b1c6b3cfe404
SHA512 8229a0befbf2de78b551b903be8b639d9a7bab43aab9e91a5b6c86bdb17d6c29b5dcade97e3a238c3b26d1f4ca8505e67f9a2c587f5ca3bc1ab2317ad72dd727
SSDEEP 49152:xg06DIKdwc+eQnSt65aVXaB0zj0yjoB2:64B2Yyjl
TLSH
T168956C06B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 688019e91078ff3b5de5c8a9196ca1e260b0cb82ea6187e61f9f935d6e08aa9d
MD5 e5e4180bd022e95b06b0f98b0393c192
SHA1 f09eb5e227e7c2a1d048e22bdb1e9b9eb3a054a1
SHA512 895cd1b25c38a44babcd3e3df73b81f6d4eec2dca3bf5136fa0e022baf0563a0d8886999f72851189f1dc8de600550351b1bed159b373eb4b05128ddf00143be
SSDEEP 12288:PEP3RnPUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8t:UnPatr0zAiX90z/F0jsFB3SQkg
TLSH
T1FC55125E365D60F6C463A13D85908506D372F07027922BEF52D1E63F8F36ADA2E39B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 eaa83e303f145b0615c7d4502ad592d7cab267798f7c4b70876acc7faea10bb0
MD5 f9d0ba52632e230cfa87223e68864a0c
SHA1 05ff0bd2891cc0521c9c8e3fe7a21963d20d5f1c
SHA512 01d2e2c2fcc6fb0097fa35d9bea9996c9df649bbafc1a326aaaaf6c593b7e0526ad96f56d42bd7082a7c6491128484846a2c7a647c58b5853ca8d170866faa78
SSDEEP 12288:Ijky0UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8z:IIy0atr0zAiX90z/F0jsFB3SQki
TLSH
T15755120A335950E1D9B316389AA181855B75BC306BA297DFA0C0FF2FAF357C16D34B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 87470a092bc40e5bfbb6d6680141a504ff0c9db56829e311e5c85929492880e9
MD5 ffc0ada12db536048363c0ccf905146f
SHA1 a3f60985d4343b8fbd9b237180510e8a942d567a
SHA512 e264c837d4cd1ef4bf6a575b2e456543322c46d09c8d1fad0f243f860ee33d31d59522008273a88a62ef1213f6860d13b3b75c964ab66959facefb3571a8323f
SSDEEP 12288:xyqUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik80:gqatr0zAiX90z/F0jsFB3SQkx
TLSH
T1F845230F341B50F2CC931B3952589D4A16757A7027E26AEBB0D1BE2FCF382C62575AC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 4e38363813a7f6256e58949c59b207832be083b573e1dd54679d971b444834a8
MD5 37bf53843242512f701254743ccf88b3
SHA1 f544a88876f36c164b990bd448231426d1c757a2
SHA512 fd49b89d691ff85bb5ab34c946806493342a2928f81c56edb51cfa6ea8455d57239b6b9ac068f49a4e8c94ba1534ab4c96f4e7dbb360ca55e383839ad94be51a
SSDEEP 24576:aQ9MxZKdcz9dw3Datr0zAiX90z/F0jsFB3SQk+:aVKZDaB0zj0yjoB2
TLSH
T144558D2DABE905DAE173D23995A250C3A673B4301B31D6CF2448D13D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 ceec9926e25fc61df5c2418b597efb51380a4cb8764532a1814a1732d26874fd
MD5 fe34599ddb7ba0371085c79bf667dcf5
SHA1 408733624fd02fecc920706bdb953fd1858355f9
SHA512 1ed21a18144e37451088ef015612849d5073d065f460eea8c8de4daeebdc29d3e39dc400d389ea2574f625a6b90f58dfed037f0a8a925bcd168f9c3cfaba86d7
SSDEEP 12288:9yoKo2JRple9p4UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik88:9yocDAp4atr0zAiX90z/F0jsFB3SQkd
TLSH
T10465E01F7B6E40E2D063923C89848645E773B0705BA257CB6191C73E8F27AE9BD34B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 ab12ed7b7bc8b0bc74bc30ceaa2b87317c6e57df8992529eb0faf962f4244926
MD5 f216fcdf8f8ef2d3c3db91c1b9ed68af
SHA1 c8d081940c1e8860531fb03a7121337387ee14b6
SHA512 44cf20cc27563bfa7072dc9da85fdae9070f34de3b877259e63de8139f81245812e3f22a2f0fa715b6b06259cfb8909a90b80e1ec814540d6bd84775982e7a45
SSDEEP 49152:5WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK4aB0zj0yjoB2:h0zuNIhB2Yyjl
TLSH
T16FA57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9864dd32796615b36debbd46875077e230f2b268d5f98bcdfe8e40888f40c6df
MD5 b971a5eb58a92aed09a16b064a820b22
SHA1 f7adc48500d8c8e93054be349e9d4336eecc1621
SHA512 03f8574ec303f92185600c70f340e7542e4f153bd8890f57e5e82805544b8d264f85153b4726ce84d0a0a1809ef43b192bddb2245ca1cde28f33700a19d28a6f
SSDEEP 24576:j1QT7EcpfxR+N5AWAz3ooiYtjMqbZatr0zAiX90z/F0jsFB3SQkD:+TDxR+N5YzTfjMaaB0zj0yjoB2
TLSH
T13555B02E67F905E9D1BE86799A23C502FB727821033193CB42A0C17E1E7B5D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 3d19b0d0b1553452ccac89d956344d752ec2a5ef5c43471ba53c94677f72b01b
MD5 4aaa54a3a86cd25646509749937c2a94
SHA1 b25c0754e64026fcbb5f0f577f5e27f3f507b034
SHA512 bc3b37357f71e4ef88325f1f05bef7bed6b9ca2b7efd6c5475c59a117716fe26b6e7bd7a3e449169b628582888e87a3ccc42f001123d4edc6dd1c96b9b1b2383
SSDEEP 24576:3TMdOz0FFS+imSLNatr0zAiX90z/F0jsFB3SQkm:F0K+imSLNaB0zj0yjoB2
TLSH
T13575E13E636D14F5E47BC27D96428906E67234710362AADB06D0D17E2F6BFE43A39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 e0ee36f86e6bd142918cc561023f0442696cdb33d86be15f77feb9bac518a42a
MD5 0780bf5e6922d8dbfe4093a510f888f8
SHA1 1102092a811e98b55bc670727c17f20dba636b44
SHA512 75c9a0d9294f69537011a10e901aff8116b12952675853ab37c5892969755fe1b1969847e95c897fbdfd545726e7d6d9bf1ce7780c258c79824cee734b3323e9
SSDEEP 12288:f4KWUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8D:TWatr0zAiX90z/F0jsFB3SQke
TLSH
T1F455120E32ED20E1E8A36635966445468670BC7123A26BFF31D0FE7F8F356C59539B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/692-72-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/692-84-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/692-78-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/692-80-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/692-82-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/892-168-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/892-170-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1280-419-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1280-172-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1312-522-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1312-528-0x000000000CD30000-0x000000000CD38000-memory.dmp

Download

memory/1312-190-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1312-231-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1312-214-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1312-198-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1864-23-0x0000000140000000-0x0000000140811000-memory.dmp

Download

memory/1864-17-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1864-101-0x0000000140000000-0x0000000140811000-memory.dmp

Download

memory/1864-10-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2240-9-0x0000000140000000-0x0000000140811000-memory.dmp

Download

memory/2240-0-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2240-6-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2240-27-0x0000000140000000-0x0000000140811000-memory.dmp

Download

memory/2264-280-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2264-136-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2544-626-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/2544-444-0x0000000001FE0000-0x0000000002040000-memory.dmp

Download

memory/2544-450-0x0000000001FE0000-0x0000000002040000-memory.dmp

Download

memory/2544-453-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/2632-179-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2632-125-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2632-118-0x00000000005E0000-0x0000000000647000-memory.dmp

Download

memory/2632-123-0x00000000005E0000-0x0000000000647000-memory.dmp

Download

memory/2740-47-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2740-86-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3096-129-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/3096-183-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/3108-491-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/3108-463-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3108-467-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/3272-69-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3272-67-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3272-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3272-160-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3336-180-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3336-466-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3716-98-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3716-102-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3716-92-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3776-164-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3776-389-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3912-88-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3912-167-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4324-480-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4324-184-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4360-420-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4360-497-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/4360-426-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4360-429-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/4412-33-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4412-44-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4412-42-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4728-541-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-546-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-538-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-531-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-532-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-530-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-533-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-535-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-534-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-536-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-537-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-547-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-543-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-542-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-545-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-544-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-540-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-555-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-539-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-557-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-551-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-550-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-549-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-548-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-552-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-553-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-554-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-556-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-559-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/4728-558-0x0000020E32B90000-0x0000020E32BA0000-memory.dmp

Download

memory/5100-58-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5100-369-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5100-367-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5100-50-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5100-56-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5100-147-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5128-476-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/5128-481-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5128-627-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5128-470-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/5272-148-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5272-327-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5272-145-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/5272-139-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/5296-161-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/5296-373-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/5296-158-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5296-152-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5540-41-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5540-128-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5856-175-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/5856-104-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/5856-113-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/5856-110-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/6000-452-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/6000-176-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/6008-363-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/6008-133-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/6008-189-0x0000000140000000-0x00000001401D7000-memory.dmp

Download