cd21f9b37eb2edd08bcdf0d82b55fba55fb8bac215cbb6e96383d97ea934d381

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Size 7.9MB
Sample260729-kdaqbscn21
SHA256 cd21f9b37eb2edd08bcdf0d82b55fba55fb8bac215cbb6e96383d97ea934d381
MD5 4996739f08ff208cb113fbd775665190
SHA1 346b01b935f556d66eb6f4469807661c6ccc5a2c
SHA512 fe10e67ecc606a47b4d3a24bc2d8c2689a4a4991be74e2725cfbc7c9f7b569c73e6da35666f9ee163b06ca566ac8e68ece15602afd2a9de1a4e01fabccb8f363
SSDEEP 49152:v4A+w1GH+zNsGRFpYiUan8Rb281FL6n+M7UxRQO5J6uqQW8v10eyGx4VJFBYwyI7:frzXpkF0J99JITGW45jxvdz4uzBGnLm
TLSH
T1A6868D13F2A501ECD05ED974CF3A56329B317C4A4BB092EF269836E11A75ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
4908	alg.exe
1156	DiagnosticsHub.StandardCollector.Service.exe
3092	fxssvc.exe
4736	elevation_service.exe
3820	elevation_service.exe
3580	maintenanceservice.exe
3356	msdtc.exe
5016	OSE.EXE
3808	PerceptionSimulationService.exe
956	perfhost.exe
1560	locator.exe
2744	SensorDataService.exe
2888	snmptrap.exe
884	spectrum.exe
1000	ssh-agent.exe
2224	TieringEngineService.exe
1224	AgentService.exe
2004	vds.exe
204	vssvc.exe
3304	wbengine.exe
3192	WmiApSrv.exe
2360	SearchIndexer.exe
5708	chrmstp.exe
3736	chrmstp.exe
4612	chrmstp.exe
4808	chrmstp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\spectrum.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\88b7dd35e52bf895.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\java.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3828	chrome.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d8c455d341fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002713475d341fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000032bd415d341fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008499175d341fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002180755e341fdd01	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297873476752239"	chrome.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000007aab75d341fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b196c35d341fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004599a75c341fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005642175e341fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fea2de5c341fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2124	chrome.exe
2124	chrome.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2504	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2124	chrome.exe
2124	chrome.exe
1156	DiagnosticsHub.StandardCollector.Service.exe
1156	DiagnosticsHub.StandardCollector.Service.exe
1156	DiagnosticsHub.StandardCollector.Service.exe
1156	DiagnosticsHub.StandardCollector.Service.exe
1156	DiagnosticsHub.StandardCollector.Service.exe
1156	DiagnosticsHub.StandardCollector.Service.exe
1156	DiagnosticsHub.StandardCollector.Service.exe
6104	chrome.exe
6104	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3824	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeAuditPrivilege	3092	fxssvc.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeRestorePrivilege	2224	TieringEngineService.exe
Token: SeManageVolumePrivilege	2224	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1224	AgentService.exe
Token: SeBackupPrivilege	204	vssvc.exe
Token: SeRestorePrivilege	204	vssvc.exe
Token: SeAuditPrivilege	204	vssvc.exe
Token: SeBackupPrivilege	3304	wbengine.exe
Token: SeRestorePrivilege	3304	wbengine.exe
Token: SeSecurityPrivilege	3304	wbengine.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: 33	2360	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2360	SearchIndexer.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe
Token: SeCreatePagefilePrivilege	2124	chrome.exe
Token: SeShutdownPrivilege	2124	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2124	chrome.exe
2124	chrome.exe
2124	chrome.exe
4612	chrmstp.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 2504	3824	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	85
PID 3824 wrote to memory of 2124	3824	2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	86
PID 2124 wrote to memory of 4388	2124	chrome.exe	87
PID 2124 wrote to memory of 5048	2124	chrome.exe	96
PID 2124 wrote to memory of 5048	2124	chrome.exe	96
PID 2124 wrote to memory of 3828	2124	chrome.exe	97
PID 2124 wrote to memory of 2880	2124	chrome.exe	98
PID 2124 wrote to memory of 2880	2124	chrome.exe	98
PID 2124 wrote to memory of 1744	2124	chrome.exe	101
PID 2124 wrote to memory of 1752	2124	chrome.exe	102
PID 2124 wrote to memory of 1744	2124	chrome.exe	101
PID 2124 wrote to memory of 1752	2124	chrome.exe	102
PID 2124 wrote to memory of 5824	2124	chrome.exe	119
PID 2124 wrote to memory of 5824	2124	chrome.exe	119
PID 2124 wrote to memory of 5936	2124	chrome.exe	120
PID 2124 wrote to memory of 5936	2124	chrome.exe	120
PID 2360 wrote to memory of 5312	2360	SearchIndexer.exe	122
PID 2360 wrote to memory of 5444	2360	SearchIndexer.exe	123
PID 2124 wrote to memory of 5480	2124	chrome.exe	124
PID 2124 wrote to memory of 5696	2124	chrome.exe	127
PID 2124 wrote to memory of 5696	2124	chrome.exe	127
PID 2124 wrote to memory of 5708	2124	chrome.exe	128
PID 5708 wrote to memory of 3736	5708	chrmstp.exe	129
PID 5708 wrote to memory of 4612	5708	chrmstp.exe	130
PID 4612 wrote to memory of 4808	4612	chrmstp.exe	131
PID 2124 wrote to memory of 5232	2124	chrome.exe	134
PID 2124 wrote to memory of 5232	2124	chrome.exe	134
PID 2124 wrote to memory of 5500	2124	chrome.exe	137
PID 2124 wrote to memory of 5500	2124	chrome.exe	137
PID 2124 wrote to memory of 872	2124	chrome.exe	138
PID 2124 wrote to memory of 872	2124	chrome.exe	138
PID 2124 wrote to memory of 5972	2124	chrome.exe	139
PID 2124 wrote to memory of 5972	2124	chrome.exe	139
PID 2124 wrote to memory of 6020	2124	chrome.exe	141
PID 2124 wrote to memory of 6020	2124	chrome.exe	141
PID 2124 wrote to memory of 5236	2124	chrome.exe	142
PID 2124 wrote to memory of 5236	2124	chrome.exe	142
PID 2124 wrote to memory of 2696	2124	chrome.exe	144
PID 2124 wrote to memory of 2696	2124	chrome.exe	144
PID 2124 wrote to memory of 3208	2124	chrome.exe	143
PID 2124 wrote to memory of 3208	2124	chrome.exe	143
PID 2124 wrote to memory of 1260	2124	chrome.exe	149
PID 2124 wrote to memory of 4544	2124	chrome.exe	150
PID 2124 wrote to memory of 4620	2124	chrome.exe	151
PID 2124 wrote to memory of 6104	2124	chrome.exe	156

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Users\Admin\AppData\Local\Temp\2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-29_4996739f08ff208cb113fbd775665190_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=150.0.7871.187 "--attachment=C:\Program Files\chrome_installer.log" --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater_history.jsonl --initial-client-data=0x2cc,0x2c8,0x2d4,0x2c4,0x2d8,0x1406c9980,0x1406c998c,0x1406c9998
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbe4c7c728,0x7ffbe4c7c734,0x7ffbe4c7c740
    3⤵
    PID:4388
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,15020576652194656862,8174356906184138,262144 --field-trial-handle=1996,i,7299033371851938626,15890977333286995162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1992 /prefetch:2
    3⤵
    PID:5048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1584,i,15324504540868332171,9539537297878963977,524288 --field-trial-handle=1996,i,7299033371851938626,15890977333286995162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2312 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,16473127554727214230,12885536510083110549,524288 --field-trial-handle=1996,i,7299033371851938626,15890977333286995162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2524 /prefetch:8
    3⤵
    PID:2880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,2279345766369970394,3034175623803250729,2097152 --field-trial-handle=1996,i,7299033371851938626,15890977333286995162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:1744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,6965460987289200340,16992970601443515131,2097152 --field-trial-handle=1996,i,7299033371851938626,15890977333286995162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:1752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4672,i,13958336984299454958,250323900456980989,2097152 --field-trial-handle=1996,i,7299033371851938626,15890977333286995162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4688 /prefetch:1
    3⤵
    PID:5824
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4800,i,700397347688408611,7241613577358049860,524288 --field-trial-handle=1996,i,7299033371851938626,15890977333286995162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4856 /prefetch:8
    3⤵
    PID:5936
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4832,i,17506840186939445789,3435452253257460167,524288 --field-trial-handle=1996,i,7299033371851938626,15890977333286995162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4812 /prefetch:8
    3⤵
    PID:5480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4496,i,15629591504781327547,9521193761765985893,524288 --field-trial-handle=1996,i,7299033371851938626,15890977333286995162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4600 /prefetch:8
    3⤵
    PID:5696
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5708
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2d0,0x2d4,0x2d8,0x2c0,0x2dc,0x1405755a0,0x1405755ac,0x1405755b8
      4⤵
      Executes dropped EXE
      PID:3736
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4612
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d0,0x1405755a0,0x1405755ac,0x1405755b8
        5⤵
        Executes dropped EXE
        
        PID:4808
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4856,i,1202257643588112508,8201870165029214074,524288 --field-trial-handle=1996,i,7299033371851938626,15890977333286995162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5640 /prefetch:8
    3⤵
    PID:5232
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5944,i,14133006386599489473,9453002652843141815,524288 --field-trial-handle=1996,i,7299033371851938626,15890977333286995162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4904 /prefetch:8
    3⤵
    PID:5500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,10298975100955379799,6878863316002580258,524288 --field-trial-handle=1996,i,7299033371851938626,15890977333286995162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5864 /prefetch:8
    3⤵
    PID:872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5672,i,16971069673506508381,9862546877543573756,524288 --field-trial-handle=1996,i,7299033371851938626,15890977333286995162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5656 /prefetch:8
    3⤵
    PID:5972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,8307689964026602291,1227690281381068576,524288 --field-trial-handle=1996,i,7299033371851938626,15890977333286995162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4872 /prefetch:8
    3⤵
    PID:6020
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5812,i,14645216047469266467,5440543873851109184,2097152 --field-trial-handle=1996,i,7299033371851938626,15890977333286995162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5740 /prefetch:2
    3⤵
    PID:5236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4500,i,11906978545661689704,6339707933562443088,2097152 --field-trial-handle=1996,i,7299033371851938626,15890977333286995162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6008 /prefetch:1
    3⤵
    PID:3208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5500,i,5688320484617568708,8482025419430567048,2097152 --field-trial-handle=1996,i,7299033371851938626,15890977333286995162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5772 /prefetch:2
    3⤵
    PID:2696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,3735752330631723376,7254242444219246795,524288 --field-trial-handle=1996,i,7299033371851938626,15890977333286995162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5680 /prefetch:8
    3⤵
    PID:1260
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,8773522963925081577,4256271426856086340,524288 --field-trial-handle=1996,i,7299033371851938626,15890977333286995162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:8
    3⤵
    PID:4544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,8406731427762374033,14948733504618398448,524288 --field-trial-handle=1996,i,7299033371851938626,15890977333286995162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5704 /prefetch:8
    3⤵
    PID:4620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4900,i,3690192851476586016,16416165898303195677,262144 --field-trial-handle=1996,i,7299033371851938626,15890977333286995162,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4572 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6104

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4908

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1284

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3092

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3820

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3580

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3356

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5016

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3808

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:956

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1560

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2744

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2888

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:884

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1000

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2176

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1224

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2004

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:204

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3304

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3192

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5312
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8565fc3ed8ff35a682451b0bab5f14642c2aee3d2d1b49887b8d56a97e014de5
MD5 148463b5595413b81af58de80ad3ef7a
SHA1 613e52345bb3691e4e02de42e7597bdc98b6da95
SHA512 54cb1191c91599338d10dd9e975fe8eab75e6bd733072f5f9cf24138aa84820fc97d79f43fce668ecbb7dbea3fdeb8cda311cb73a910bfd22afb7409c9c2bc35
SSDEEP 49152:ib+632BuPkFKRrdE6ohmstBhuXjfS4LWxncQ/lFTjN4:E3q6HjBgLm
TLSH
T14AD58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 cc62018c4c686d453c24846c5e9a649ca5ff6cb7a4a2cfa0e2cd4ceb6d75a80d
MD5 0fc68ddc6d9f8fcdc4c4b6764bfc6fa1
SHA1 14f3646ed0bf95d3665b58206c0af61db7cc0925
SHA512 38755e0e42fb60413d4e47df37120a8c1b3c2cb7e8d001ab39f65bf897197e7dd7b2638ba05af226e15736ac6950f970ab033d3f76e25995cda3136af3a1ac2b
SSDEEP 12288:q1XLsswWkxy2lRq2czA3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:gXYfDtczAXnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T13D85F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 adc2725d4f1d018656ed5a87d5a83554143bb356cfef5e0d7fbfe09deb90952a
MD5 3931622b6a643cebbed7464df326402d
SHA1 29ad4ee0dc3273a63b5f6cc39470ca04ea064f8e
SHA512 2385f91b3fdf06ad009797492bd685dd9569a66f29a8c9c0926a0a0f46e65bc2c052823697ef67a85d76d27d77ee552e1d48cf30f4b116e65418b14223abe202
SSDEEP 24576:V0Le5ji0hmxirM0nQ/tbw/2Mkjy6Fr7g0o9:VPji0AclQ/lFTjN4
TLSH
T143959E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5bf6b5e05d6c4052bf5b088301a4b67cd73943e48948a8a628636f5ae4e33166
MD5 b12c84aef99b8c50a0e34de76cfca34f
SHA1 da26bfaa9eb43700b8f95867ace19ed25eca7b09
SHA512 d106d3fb40f4eed5a16796cc9169ab9c3813059e66247a0ad6f4bad6782e14a4f58d69087c351fee89de883ec8da168b775b306066f663af5ed49a0d457ad597
SSDEEP 24576:1a7/ezSC6vUyD/aqgrvWE6q8wyu+nQ/tbw/2Mkjy6Fr7g0og:8/ezSC6vUzPvxHjyhQ/lFTjN4
TLSH
T18F755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 c00d16fcd7d994e1e6c0b8d7d5b476595fe9f5a684f79959a661c7cd58deabc0
MD5 70fed9605b2a8ef02248c38f09f3271b
SHA1 3b030699bfa95f4fb6d28546362c0cc4ca340725
SHA512 18d3b0ac4bb89f18b715bd3a4fcb6f4a8ba5965c8090e6ff819191516d0371e07c455797f5100ac7de92699f9f1e72b322de5f0258f2ed56c7025fc013a21afe
SSDEEP 12288:Imw5HEjsChNVBFgl0WDm+CeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMF:lwuoOWBnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T16F75F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 1289d304557fd2502a619535c0e3582e37843722af3a479b8dd5aae20cac8480
MD5 59b6185e9cda84ec00c36dade1884021
SHA1 64be2e03ffb9c65fb8d2004507516768cbfb02b0
SHA512 5667c5e7afb57baffde51810ec3737e7bf151a26e6579dfba41be5c5aa22417bd9722db15855d83770f543ebf6ec6da6edf2c3344029ba7726d9b0a097a87529
MD5 SHA1 SHA512

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2164b440e39a1281f90b08136e4c46c1f4064ca26d33648bedafe6a3545e08e8
MD5 99c028ed93442dd3d1ea013ccc90997e
SHA1 f6ac5bd2ed869648ec0adfbed359716041f3aa78
SHA512 1232e2badcfad249f3a29186769be8279933e59d22f635f1fd0436c3ec59e9c6c3c90306ca605f81f71aab666db32e80d89beda11c60a3d74385cc5d65426d1c
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uf:FQRQyi36YOcPQLvw2gAf+PN3kLm
TLSH
T183666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9a92291093b1447f5f8953b6e0f815974dcbcf78cb50de5e9948e84e144b9287
MD5 cbffab5bcebccb059083e9fcb47275c6
SHA1 8a29f774d99aa01c39f1a09506d6e96338343242
SHA512 3894b1971db49eecc449258a22ccbbe7480375355d1e6681500aa024b7a2087798dfca04e4bde794717f2e3fb8f236f33f10334afba6e548a1ed6a49cb993380
SSDEEP 49152:dB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glHQ/lFTjN4:Du6JmVxd2dsLm
TLSH
T1ABD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4612_13429787340945724.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\4612_13429787340945724.pma
Size 696B
SHA256 da9a8ae0c04da6ceae900796a026f4777895bf149eed2c495fbdae098362f596
MD5 3f5af086a83b749aa34a3aac1b986a0a
SHA1 0e67e17122beec914722d98cef0e669541560ff3
SHA512 0a12749b3971d0023cc1dd4f87113c94cc2c961ef824009c89a32ba24fe51de83357bb0757af7612ffb3a638302f5a298a2fc823dec8d117cf27255d2996191b
TLSH
T153010E49A3144F77CC828D3584FE27412BB0FA501B821BBF7B10724F2E021C9AED9168
MD5 SHA1 SHA512 TLSH

Submit Download

5708_13429787341002347.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5708_13429787341002347.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 326c11b17f32c74eb37b97092c859532278150cd9ca8337f394a1fd0c00aa7cf
MD5 844065b39e7e7a1fb1fb9eb52e0ab41c
SHA1 a37cddf795ad51372a1e42ea3e854e9a0fa91aa6
SHA512 4c953870801a5f17803cbaaad7a6679919c1e60c40acb479205bdb83de05969c43eccf662879f7954d0afc8c5372d8b0ab82efbd11a71a702da22e503c8fd26f
SSDEEP 24576:vcP4mcvIjkGOxhKP2l71nNKbrh/8KBknQ/tbw/2Mkjy6Fr7g0oi:kP4m4IpOO67W8KOQ/lFTjN4
TLSH
T16D65AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 7KB
SHA256 a7ecd744214a03edfea4d88ae614797cb6ee16e98b90e14fbf654909c5f02b67
MD5 d0e25acb9f89738e81a649e91024011f
SHA1 9ee68f3ae564d459d01cdadc264f7fb17d934ad7
SHA512 55ab4d2db3f2daf83a267020a39639954531c648f5d2320310530f940edd0df17fa20ddf232f4219c3918e9b93e2ef06062afcc4250b11cc57cac4e2cf937ed4
SSDEEP 96:XbaqLL32mxmwLThK3FK3Iii7OCFK/IIB1hK2DK2mgVWM28I0GD0:mmCm3+NhKPRgSnGg
TLSH
T1D2F19DAE9E42486F3BC1DB2B336365515E7B201AC7D898723BDBD105F0CAA65001F6A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 9KB
SHA256 28d3ef914cf4aebfd10b9eef841cca995f416b3025714eeb9e44373dcc6fd966
MD5 4e524d41620e80be63771df81e3502ef
SHA1 951f11068505ca2e7241922dad3f3ede17555abf
SHA512 f965cb208217d9d038f3c65c9288906c723b774a7bb88124753ccbba0056cf7747f1918b4b687830b294dba87a79bf13126a5647fcf94b3823cd292f5497c9f0
SSDEEP 96:XbaqLL32mxmwLThK3FK3Iii7OCFK/IIB1hK2DK2mgVWM28I0GDqP7wdLLadIhK3l:mmCm3+NhKPRgSnG7fUD
TLSH
T1DF229FAE9E02486F3BC19B2B335365516E7B3019C7D898723BDFD106F0CAA64015F6A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 2607de90f2293e5dc2145f6fcd437367df06b92c4cbd1178a397aeb171104cc7
MD5 79378c146f4914f6234384b7eac7b9c4
SHA1 c322f25f1eed4cacf423af69f92ef8925dd9a767
SHA512 244c38de19e19e6192d713fff9b9bdaeccc164f4339325c09055650b4d82894c3b77b392bcbc565f9d2c22ab1e325b03719962a3d6397b8271b54314cda6c45f
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1f2d4b4e7dd420b3c87c001433c6c78ee8b8970890f222c7182d98853df7ddf9
MD5 faca6a4e559b427e51e7563fac1ab286
SHA1 a8999c223105c1623d8bc0f732ec6d8d42e4fe57
SHA512 6acb49181557019abf0b9cec0bc3544bae85a24659b790209a77905723558840288e4356ce8887d8a57a12d0463ff2012aeee425d6b3ccce5af2cbd3eee6ff1c
TLSH
T12AE02BBAC961EC3B18FE07587051874AE620135B2A90894F7A3C950C8FF0B3A674581C
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\service_worker_bin_prod.js
Size 131KB
SHA256 5b83ed539c1e9c2769e4e3cd4aa397a66bdd6cfa763e230414c0a885a350903a
MD5 8b795eb263421a7d53c5d4a95646bc45
SHA1 4e48ea3d490b84aa4260a74217ed414bef6b6ad8
SHA512 fb78511b7a274d3c280da40341f19fcd3c2455f6132c41f3e46696e458126a3cec6b27d41b28b2398c622c435a3bb93a2f731fe3e8ed453d365c042b71b8b0dc
SSDEEP 3072:JXNTunelO5KQOpZgLJqVPgbcBJptE/ml/3y7:JAPJOrgmptE/mlP0
TLSH
T17AD3DACCB7A5B4224363A5F5002F010BB23AB8AAE44C85A8F188D9E97D7546D4737F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 76b3f06a163f47e968c997de9e35d60b64d1566311f63816224d8431227ec9bd
MD5 5a13463060b3ff0f2e847068116277ae
SHA1 3092c2f160d298140052fef105f88146023a8a2a
SHA512 1ae949cfda05aa9f02cb4c8c339703385a4915895316619762ccb855d348136334aaf8d9adfbb4e0b336b47b4485c89d3fac0cbd6110b67a8a27f5e22e2b104c
TLSH
T10A518EF7C7D8857D890196F8EB252E1FDD2A0A58532C3C66C8D8AE5F53E2876D20064F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 d0e66c35986a4bd440e02285c2658b281042ac246dc292587f4d059a4ae32977
MD5 7d24612b14a374d2d50599f11c54a4c0
SHA1 d5cf20d5e6109fc9fc82a77c486adddf663512e1
SHA512 84efeb82c3049235b168bad8d2e004b44a3fefef8ccbd203f470610157e7c8e0daf87b4450abba3b7c40075b7e227fab8864fdb8e2ba9f0548fbeb3960275377
SSDEEP 192:sRQyKE46v7F9PRp2lXsb+WNn3U2puiyIsnAUgR:sRTKE4WnXyXwk2tR
TLSH
T1E412811EBE18A57B5CCBC22AFA617253D2F2082176D42D84E6F88A6C14D77CC3327407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 eec1227b916b80d7694f1d00591546698e396b933b962c9894769141bf3cb508
MD5 f9adb554fb92427d8a90fc6170e96c7e
SHA1 61eb8dbfdea02bc0a1c811b5b73511b5094b5937
SHA512 98a6942e36dc8e2b2d1241160dda84718e68b62e8cc791f967a041c4ab14a812a7c893415354ab78b61195d30702509debe7f41db5b07b6dfc82de27c3912fce
SSDEEP 192:sRQyKqiVxlJV46v7b9PRp2lXsb+WNn3U20k4H2HeFqiyIsnAUgE:sRTKbVXJV4WVXyXwk294H2UjE
TLSH
T14B32C42EAA14A97B9CCBD219FA667B57D2F2142172C41E80E6F8CA2C15DB7CC3317417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 99d551b4623706365bcf6f14ad9ab418a8e32097f405d5858f112c5464c4c1c3
MD5 ca26ff6852e413adc04011c64a2a1ba5
SHA1 1ca4bf451ea13f6431fd19190ff15d3a948d45b0
SHA512 5b429dbec8bc31ad71b1d769a4ee6a128826d1428a183514e1f6bda6440a8e968e5c5c4a150c19cf8fd9965ba5be640f64380abddcfc57a5b96ca55e6399a542
SSDEEP 192:sRQyKuiVxlJV46v7bCPRp7lXsb+WNn3U2Ak4H2HeFQiyIsnAUgE:sRTKXVXJV4WUX5Xwk2Z4H2UhE
TLSH
T15242D42EAA14A97B9CCBD229FA657B57D2F2242172D41D80E6FC8A2C15DB7CC3317017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe588587.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe588587.TMP
Size 3KB
SHA256 c14b274f55dba116641a4a2b8f20bf465c66f99103845f98176802b5d543dbf2
MD5 3d5af0e311c3183a6037b89bbfd4df0a
SHA1 51d63a27c98a36af77f809343179c1035f3af6cd
SHA512 1899b0551f0c70d4610bc4c1874970c40fbcb786100967d054bac81236f79727c7d70c441f3fa854cce3677e0d7e7352409b082aa9761117e01632e3f7962d34
TLSH
T10B614158C5B84CBB4DF97774787A1B81F921113B06101C0A3ABE498C2F779AB8084F99
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 df3f3d7e8eb52eb11376e73179228426d3d2d5efef9c19d4d305887505e18b02
MD5 cf7fedf8f7d2c16e2ee32aeccb0d6abd
SHA1 c0965f169b36b690aaf700b8f80359944a908774
SHA512 0f7e0c7f513e4fbb8754c44a17604a17a368e18bf06088e8c92d246667c4707e4e019b978bfef2975410552144093cebfb7ef11074676b8e4908dde7b23f6a1f
SSDEEP 192:ee14K6IW7KxkXqK4I40pUZNCgVLHrKHfFKslEK2cXzKD/Ty+ErUkKN9H9IB3Wh/+:/1jbW7KxkXqKf/pUZNCgVLH2Hfgslqcx
TLSH
T16F32C727948D9A3F4FECD55CDC526F4F6DB1029272780C2896FB9C0403A97CE115A1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 067b17ccb0f342c53ef01f4cc41b6ad47e1105c1b32f902a1fecc59a190f9ad8
MD5 4752328e48654a17857a67376f87f34d
SHA1 8b144229695201af6b8d92db6266511bea198c0b
SHA512 1a45e36999d6948f8f0548582367441eccb31815444acd9e94da403366d7284a9bdb729eccaf94107f25e6a5cd01330ada370431a4115d2288c37b7cc4c7bbf2
TLSH
T1DDB0120880871761EA8082701305504422909E71A060170393F05AA5CC430E452A6114
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 b592038056b5947ec8d0cac9a6a65338debe140fa1b199a57965f67f3680c5f2
MD5 d91bc03a36a783c3288143b79dcc40ab
SHA1 da90ce380b3e9f66f7aeb1c1391599020e109dd9
SHA512 d0440556c50c739df2699f28e18c5e4d85cdbf271a01ed43f0282d90f0df1bd6f82b2b02c929065fb45315cb0ff24e8e5604441f7567c7b4dbc9786b0ffc0917
TLSH
T1F1A0021255C48A73DD484274766147C52AD349547D92531754A7168C985F1C1C155540
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 8f717db45eabde9979003151d10dd7d8705e6816f0beabfc9984a33c24a5ab1e
MD5 e1e45c9c97ba66438351ec4e6909ea3d
SHA1 886f8ff42297a76fb76827c93b8906297cd1cb82
SHA512 e70b5b3b62c1d2df75fefe9c6e28706fa471bf3aa371e2771145f720289e0e1191df010cf40364f12e59c47986091f13c8cdda6a141f7a681a27815cb2abaedb
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 8086f538192f350447959d51e3cb6bd7eebc1d106fe0b99c0bb546f3e6597711
MD5 a276efef216a49d2c9c9e2f9f08b288c
SHA1 75b71c57acc0f611691df4808aa72f5fcc956340
SHA512 5658079c864af8928664194d15b0fbd31ee5250adcafc6a1b8b85eb1dea23a47ff2e76f356b76b153af46fd615ddd677f404e8a9d650508fd7952934092d07d0
SSDEEP 3072:gGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:Lm7Rkm1tYpBeh2BAom
TLSH
T15EC3123B5E71E9775979AB4EB08E0B1F1EF14AA2D930DA42C8D85A0437FA7CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 955517891ee209e1e93b115b2d57b04ae8816b4ea12fbe05589bcc85c64697c0
MD5 8c82c6d3f10d232d5b8083f0447c09cd
SHA1 e4aef42126574013e60c0582e3d3d8269acb7c7b
SHA512 6e90b39a5fd15a0b74b0b7e4c93a499be9174beff4195dcd96360681ad46c2ecdc11a9f2e3643fb2b5832a682cc9cca331a77c74fac040cf6225f9c902f0026b
SSDEEP 3072:XrGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMH:Xym7Rkm1tYpBeh2BAoH
TLSH
T1DDC3123B5E74E8765DB9BB1EB08E0B1F1EF14AA6C920DE52C8D45B0433EA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 749faa6e721b07af40dab109c40e0a2a53e797f22e79bd60d68248c410210cd8
MD5 ce84b06ef6cb19d0b608979d36582457
SHA1 c0ebd9d94ad7924a2149f5c168d6accef69aea2a
SHA512 7b40c8aa2097b0de8228ee088f653fc0f692bdc1a01cd65d01b05f5c3decab94548dec89d7375b54c3573cfc268822728e4191f34714b83ec35009cd7ea6cab6
SSDEEP 3072:clGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMH:csm7Rkm1tYpBeh2BAoH
TLSH
T1E1C3123B5E74E8365DB9BB5EB08E0B1F1EF14AA6C920DE52C8D45B0433EA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 50ee1f23484ea1a6173f2062cf3f6304719ac9671f4db407b119e5f0efbd3d68
MD5 c1ddbe2e14e4fceffe7ba6bfc3650b32
SHA1 9b9d4de7b1d9a3a0eace29224452574b4bb05ac9
SHA512 c2a0173e4923f03c49f7eb12ac164af2add80d4819e52d81796e30fdc1bf287f41071514cc0028c06828fbf990403ee06651fdf4b913fea6dc56035cc1e62da1
SSDEEP 3072:93zGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMH:hKm7Rkm1tYpBeh2BAoH
TLSH
T135C3023B5D65A8364DB5BB0EB04E2A1F0DF19BA7C924DE45D8D86E0433EE78C1E09934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf198a5a-7d35-4096-8499-6d0283b477c5.tmp

Path C:\Users\Admin\AppData\Local\Temp\cf198a5a-7d35-4096-8499-6d0283b477c5.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b2d2b28d-1abd-41d2-9dab-e62d39f87aeb.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2124_1232072787\b2d2b28d-1abd-41d2-9dab-e62d39f87aeb.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2124_1323694217\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

88b7dd35e52bf895.bin

Path C:\Users\Admin\AppData\Roaming\88b7dd35e52bf895.bin
Size 12KB
SHA256 773702d84fa76be3fed91eed008eed1bfb6399e8b28940e10a21e4851ceb72dc
MD5 ac1afc21181aa17981827ad8e77c7f18
SHA1 2b813ad66f7c2feaaa43507063d7f351b4898a5a
SHA512 f60e45d563199188afb08ec82986deac0e1d4a07443a180750dcb0e51079f5380a850fcd4c6624ca7f53bd6e8ac8b103cae5ab1553c8489f4620ff1826d12fc6
SSDEEP 192:rwc7DruRjr58sulJeBPzgfWRK6Sa1CausqceTBxs8XTNpu1bnc8v1uClOvKor9sg:LYuuWQK6SBsq7PTqDcs15bor9tp
TLSH
T1D442BF036D6DA95B3E4AD21284174CACEFD0764BE4A6C8A33283836DB11757EFCD8224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 1f22b2b6b6b61e6c4bddc46d073c6a01e01cd59a263fcc066261b5e0f804a5be
MD5 25fc5678e27508ee63b251887ada1ab2
SHA1 38dd7d7036b63414be6d89f21b1f94a2d551f433
SHA512 247051ae31c15d4f1e8672ed3e5060ca25dd896fa4200db0ca76c4a6fcf1a9c2bd0e5af3ab2c1494ebe6037eb1d61ffa36f9c13066ed6683a5f91a547b4ff8a9
SSDEEP 12288:fMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:fMnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1F76523696768F94BFA3B06B05882C151673F0EC5BF90D38FBB08222D963C3D01EA6745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 b3e1704b62c441e3cf35ea5db5d1f7ef910153033bb0f34bb1e508ffb91469e7
MD5 0b42e8485dc5586b189a94071f7364bc
SHA1 76e39c858a4a0737b495a7985c92eb82e4ecbc4a
SHA512 f358387b7719d14f28addfda584bb9e1291f4881797324b81a49c7edbb1045a4279119aa2769111a1e1531d7caaab86096acd3f7b58211a7e096f3650113a39f
SSDEEP 49152:5a0h2GEkuAe73q3pp46zwwQiQ/lFTjN4:5a0hNYG4JwSLm
TLSH
T140859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 08dd9225acfcb5c6b071806b626a36d1bcd5bb00a4cc19e126bbef6ec954fe30
MD5 70404e92145c4134bdbe03748421fcaf
SHA1 98e116815b50a8ecc7b83d184d7676a1a1bdb9ce
SHA512 76b7ef675904fd709446c541bc59c4e0e7f9fe637d71431b7ec4140106533f9e11e1463b5958fe72b92f9e7ba713a98ad9664997946700740b4f795b7c1dc2eb
SSDEEP 12288:4hbHjfXpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:4hbHjP5nQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1D165027D26AC20DAF63692BD89928546D7327C552B11A3DF2381823D4F3BBE40D79F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 a944ef098a6f8fee5dc40b4c0fef51acd84572e72952346945c29723cb083979
MD5 20cc341a7990f68a78b1d83e209b87d8
SHA1 401cda78528bdf2279917a84daa768cb85f943eb
SHA512 b79a69f7e1b72970d607ce839b8586496178f1b6efbdc78cca561b08e971ea3dd337175c6193da99b28827a68bf8c1da550016a9f95cd568f5b782270ab60ff9
SSDEEP 24576:u3YgnJcRTk4yti+R5dBR/BnQ/tbw/2Mkjy6Fr7g0oZ:uIgnaTk46pBR/BQ/lFTjN4
TLSH
T18545BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 2c4e9aa3d9a92fb0d47516970ffedd194fbeb487cb717cd20b5555304a8214da
MD5 215faf868a43a6ada227d64b60677b31
SHA1 864e66ac145eb731fbec83ae7ceb3488eafd8c72
SHA512 bbd8d759df362c940e403479d98a62d8c61a50dfdcbc55f3bf8ea40ce367b6b1d988e69180e7cfeeee2abfe7ee20bcc66c5299a68a46b602bb9de3839eeb5578
SSDEEP 12288:X4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:X4nQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1316523687618F98BFA2706F54C838546673B0EC17F9193CF7B482229967D3D41AFA780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 44a395119e325192dc12e904b634fb9fef7ffd2ab9e8103624ad829d44e7b382
MD5 4707cfab9498437d83016231b02e380f
SHA1 d7cc9d83beb61aec540957e963037506cac01099
SHA512 1dd38b7d684d45000c1b42cfb75a7ea80bf1bb2a75dce1aa47104a2476905f9f43aa36f5596121f9d55569a3e482fae65962bf475d81a0443c39d17c4f14c3cf
SSDEEP 12288:oOb9A4LWOsvAYFT3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:FpL3UTXnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T17485F155F7A450F9E92B813CC8A28616E772789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 754a0c4a984b742db444489c9339eef60eadbda0c1e5d7382bec5da4b43cb991
MD5 08f1dd7b228815cf7ed62e6787a0ed10
SHA1 0141c5b559f8244b6a28f41f44dfea2b22f0d35b
SHA512 0bfef158d26169409dce7f6ed2cbd7bf872803b158484813430503c967a181f277015c040a1e2281a96c40cdc61a93ccfda3f56da4427542af8953cd1bf79c5a
SSDEEP 12288:XpFtpOjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:7OTnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T11D75022D36EC60E6E536527C89838209D37278921B6253DF0780817E5F7BBF85C7AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fd0558855b24756c8fc8a77ed0305114262bb3676102aa5c5edb56fa67cc5756
MD5 bc3b900b9b7c74e8aa3f3b60764286d7
SHA1 5f2cb5b0fb449a3405e0ba35805dce7ed1db9cd9
SHA512 2c9119ae33d817b83b1826652083c1fba25e7992a5bef417ce08d2997d4afb09b2b246141948d6dbdc15d5b288c4e1bd6c5a039868f346f4f26d5b6a8f0eecd2
SSDEEP 24576:u7NM9YqZqmWMUkPjZM48Mv6bEhs8nQ/tbw/2Mkjy6Fr7g0oK:u7cBWMpPjN8DbEhZQ/lFTjN4
TLSH
T12C659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 818bba9101831a5ed56f2ef4b16646fb5124d32605fcf23c1679e5c0484efdb2
MD5 36d1189080dcfd3dd17f8c51ca0c044a
SHA1 e43a9230a21e8077f36eaa1d1ec6e74caebe3935
SHA512 c96f3fa28be19722cef699b06ddb9ac33b71ebf4e62ebe32075d5f9071cacc6531e186a10ea2ce8f3437a35deb34d3fe169262c7942cec717fc9836ef12c6d3b
SSDEEP 24576:TW6BApg2YuyuNDYTabvcdvNYf8km1GnQ/tbw/2Mkjy6Fr7g0oc:TF2YuHNETovAvNYf8kmcQ/lFTjN4
TLSH
T1EF857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 173c56514eef0b53e606857034a9cb202f5dd27e839036c0916d1f9342686488
MD5 f0d106713bf1ae5d2360739f49c38993
SHA1 d3cd4a5e96e5c1a32b3dc7e831946678770a199f
SHA512 7b86eb75ad762f5fa109a52328fafaa671f4442c91fc208c1119041318ad56e7e2b0d6eac8a008c80a25c34751c42158fe9d4e563f5ff9bece582305f97070e1
SSDEEP 24576:ZAFs06+Omlf3NXEbToPnQ/tbw/2Mkjy6Fr7g0oR:eFs060lVXuCQ/lFTjN4
TLSH
T13F65AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 73f1ca3989ccd508990f52380a7739704d45a0d845ea79ba16c084d5d1834ac1
MD5 c3228eec330efdee9c40e6e8d6f5b025
SHA1 8d185310c17c28df69bab48101372f5f8b955f3c
SHA512 048e609dcfa26573a5ae907dadc646e72bd1c5f869a14d4c0d6e3b43c8c10f3d0ecb9f6ae1aa837adb11aee88609d5d2e689fb00e6c2b2776b86b02fbc07972e
SSDEEP 12288:nCJnJ5D3VkrDzxcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:CJnJ5D3WXCnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T10F85D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 8a738b3e48769286510167716167cb402cbce0ca005ff2ff6bdc5b5764a89461
MD5 3cd971bba40c265548afc231663febc6
SHA1 24ba2bb98b5bde2de8e81b91c2138c1035866d69
SHA512 6d40287cdd036f0a599c4b65091a870a46074095aeb69411048d3b5c1e87bc3013ec2a9602689cf4c9ff73c663590e2a157b953138c639cfb5ae0ce6d8757b1f
SSDEEP 24576:kEPghm6/7IIXdwcXrif7qQncjlP65i3VuBnQ/tbw/2Mkjy6Fr7g0oh:rg06DIKdwc+eQnSt65aVwQ/lFTjN4
TLSH
T10A955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 97a32378474278a63f721af1238a8c1f6e4832812e816eb840e92cbb5e3927b5
MD5 d24377aea4c3d516d05b07ae7a1fe4f2
SHA1 c65943572531261a311b64b09866931eef7a9999
SHA512 02db67602bcdeff386b2b50ccfeee64fddf3a879c72038e3ea55c3a31ad7efe1e31a07e185069fcea77bbf1ca2835838eb9308a5c1755570ac0de068f6a168f9
SSDEEP 12288:FEP3RnSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:GnSnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T17965126D37ACB0DAE52A517D84918145D373F4A16B5267EF2680823D8F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 c1fe455a3c88605334ef6291c71bd77a9d385db3166e52cf4ea1f55898b71359
MD5 fcfd165003a80156383873547e21b622
SHA1 3e42b6772086ad8760471d693bcd58fc9d3d0157
SHA512 67a9b0517b1b8b4f8cb8d66360c10ba2ef86c579983848d0c3b3fbf2da4d57db4ca7a4ede8273e1e6af7c0705979a596770cb9b5ea598057ea1078648b6cbfb3
SSDEEP 12288:bjky5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:bIyJnQ/tbw/2Mkjy6Fr7g0of
TLSH
T19F7512186398F4CAFA7A06788DA381919B367C506F2193DF6280F23E9F3A3D45D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 2afb68609a9f40c8bf9332594a00be4ec11eca8958ff29aac2c3c1faab374bb7
MD5 60fc1a471237636fa6b3a8734fb1dee7
SHA1 ec1d3db5cbe6a1de4b2cd387de90e98cecf5b47d
SHA512 27baf68752cb815fc3a0e20f27072c03fe572f3d7e9db2fc55c6fb29552699663b8edb620a9b50cb47acdb5816d856b4876a8a6718a21703e4d5922a9c251636
SSDEEP 12288:EyzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:RjnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1D965236C2625F89BFE2706F448928542973B0DC17F9167EF36886239CB7D3D416B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 e676fd141772208865180967431c00d27050e13a52aaf22b988e8815e829969c
MD5 af35d102411718f8c7ddad3143af8e0c
SHA1 aeab7434e4331eb1e3362edc8c9b4439271b9d59
SHA512 03177ce6f72f1b17f1ae0effa3be87f5886671d4b8ee0e9305ceb88a68a174f6d6bfa1ad88a5f891f332e379fcb460d0f93d87eff768354fffb468e8b113e0c3
SSDEEP 24576:MQ9MxZKdcz9dw3UnQ/tbw/2Mkjy6Fr7g0o+:MVKZUQ/lFTjN4
TLSH
T1AE558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 136e4bba109517268eb4dab7770cf0cae011d2e0282b8c7f05a5581a78263ac4
MD5 929c14308481d36051204f81e51a4063
SHA1 cbf244e64ec9a126be476357374a84d0207a2a42
SHA512 87b4973ded04dfad57384d10ed85738bbecc8a143989bde992c68dd307b71c54654844139e3b99e298ecaa2cd0b69e9a261f8cd47fa3f9e8cdff38cd4986991e
SSDEEP 12288:7yoKo2JRple9pVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:7yocDAp1nQ/tbw/2Mkjy6Fr7g0o7
TLSH
T19275E01FBB6D90A2E136813C89818645E773B4706B6253CB6681C33D8F77AE87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 8b194b24c942dd33e7e0cb3e88a4a477454c7f69b8937eb41efcf792348c1872
MD5 49720a8fe78387d3bb0e4290f12027c3
SHA1 109dc49ef973711ed93aee8f8ec42e0cd5657150
SHA512 b5eb2e68be647758d9e28bdf71b4c890c3b148ac67281d0fbee667a7506cac8d74e588b6bc29c450029f5cf65ce3b8724aa7b38f77eb8cb683a0ab83b5a5c8fa
SSDEEP 49152:0WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK1Q/lFTjN4:e0zuNI8Lm
TLSH
T163A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 87fc4ee690c5b83113293141b86b716364da4d091a17430ec1c232f82aab19de
MD5 6f60315c54628482943f540decc798fc
SHA1 5e8b40a4d44e95b73d0001d3a53e9c07662d587c
SHA512 78749ab0d07afaf5d70285fc5be0526d6a5fc43e38378f27441c8f4bf7083b5707e016b2b2ca7368c776b6db5d7d638a690c8cd0942b790afd094e4e80995e2a
SSDEEP 24576:E1QT7EcpfxR+N5AWAz3ooiYtjMqbenQ/tbw/2Mkjy6Fr7g0ov:5TDxR+N5YzTfjMzQ/lFTjN4
TLSH
T1E855B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 d9c5f85a037edbfb90b8ca2747f6fb0741edc2caf6ed43e3e9ea075abf1f97a8
MD5 cf4cc92a62027571cd8cc3a2ee5f6e30
SHA1 16a92f687f21ec5b1c10f6b8c0db5d65b0711d05
SHA512 e32dc5b0dd37bc8038a36737bb097c088778b7b3f0cb0dad8080372e1468cc82a8fe95b29c214c706c8432179ef68a82ea3cd45e6441145b519d15e80c81a44f
SSDEEP 24576:oTMdOz0FFS+imSL6nQ/tbw/2Mkjy6Fr7g0oG:g0K+imSL6Q/lFTjN4
TLSH
T17385E17E636D14E5E53BC27D9A438906E67334620322A7DB0690C1792F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 a83c12a6a29bc1076217b71a5a8636e7344087ce7e8fef21d89a0ce2d2430074
MD5 be147404292303704dc68e71221999b3
SHA1 321d70522ec4c47fee47b57e655f29071e43dac8
SHA512 66b1da541d203d3454ec74cffd7f1ca6f445b2fbe10ca63210b141177dfac6a34aa06272b390e02a09676f1377f410ef23faf9ee0371bcb80f5e378cb704869d
SSDEEP 12288:E4K3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:CXnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T10665122D23E8B4DAF93352B48962414697327CA2276167FF36C4C63E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-200-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/204-502-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/884-164-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/884-404-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/884-172-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/884-170-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/956-203-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/956-148-0x0000000000710000-0x0000000000776000-memory.dmp

Download

memory/956-151-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/956-143-0x0000000000710000-0x0000000000776000-memory.dmp

Download

memory/1000-176-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1000-182-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1000-185-0x0000000140000000-0x00000001402AB000-memory.dmp

Download

memory/1000-427-0x0000000140000000-0x00000001402AB000-memory.dmp

Download

memory/1156-41-0x0000000140000000-0x0000000140252000-memory.dmp

Download

memory/1156-33-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1156-42-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1224-193-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1224-191-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1560-154-0x0000000140000000-0x000000014023E000-memory.dmp

Download

memory/1560-207-0x0000000140000000-0x000000014023E000-memory.dmp

Download

memory/2004-489-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2004-196-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2224-465-0x0000000140000000-0x000000014028B000-memory.dmp

Download

memory/2224-188-0x0000000140000000-0x000000014028B000-memory.dmp

Download

memory/2360-238-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/2360-213-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2360-255-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/2360-1128-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2360-1158-0x000000000CB10000-0x000000000CB18000-memory.dmp

Download

memory/2360-222-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/2504-23-0x0000000140000000-0x0000000140811000-memory.dmp

Download

memory/2504-17-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/2504-112-0x0000000140000000-0x0000000140811000-memory.dmp

Download

memory/2504-11-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/2744-157-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2744-394-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2744-212-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2888-382-0x0000000140000000-0x000000014023F000-memory.dmp

Download

memory/2888-161-0x0000000140000000-0x000000014023F000-memory.dmp

Download

memory/3092-47-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3092-87-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3192-782-0x0000000140000000-0x000000014026F000-memory.dmp

Download

memory/3192-208-0x0000000140000000-0x000000014026F000-memory.dmp

Download

memory/3304-204-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3304-546-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3356-98-0x0000000140000000-0x0000000140262000-memory.dmp

Download

memory/3580-79-0x0000000001820000-0x0000000001880000-memory.dmp

Download

memory/3580-86-0x0000000140000000-0x000000014027E000-memory.dmp

Download

memory/3580-83-0x0000000001820000-0x0000000001880000-memory.dmp

Download

memory/3580-73-0x0000000001820000-0x0000000001880000-memory.dmp

Download

memory/3580-81-0x0000000140000000-0x000000014027E000-memory.dmp

Download

memory/3736-475-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/3736-477-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/3736-1129-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/3736-469-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/3808-125-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/3808-136-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/3808-131-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/3808-199-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/3820-184-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3820-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3820-70-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3820-67-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3824-6-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3824-0-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3824-24-0x0000000140000000-0x0000000140811000-memory.dmp

Download

memory/3824-9-0x0000000140000000-0x0000000140811000-memory.dmp

Download

memory/4612-491-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/4612-487-0x0000000001FE0000-0x0000000002040000-memory.dmp

Download

memory/4612-481-0x0000000001FE0000-0x0000000002040000-memory.dmp

Download

memory/4612-514-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/4736-50-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4736-58-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4736-56-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4736-121-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4736-114-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4808-525-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/4808-500-0x0000000001FE0000-0x0000000002040000-memory.dmp

Download

memory/4908-150-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/4908-28-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/5016-109-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5016-103-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5016-113-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/5016-195-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/5444-1213-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1204-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1219-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1218-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1217-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1216-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1215-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1214-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1221-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1212-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1211-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1210-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1209-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1208-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1207-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1206-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1205-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1220-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1203-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1222-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1197-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1198-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1199-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1202-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1223-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1224-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1225-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1226-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1200-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5444-1201-0x0000013B2F550000-0x0000013B2F560000-memory.dmp

Download

memory/5708-520-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5708-468-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5708-462-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5708-456-0x0000000000510000-0x0000000000570000-memory.dmp

Download