1aaaa81931f732efd9272deed046a23802f70bf5b56e8dbbca8a19f93657eb95

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Size 7.9MB
Sample260731-pcwnmaab85
SHA256 1aaaa81931f732efd9272deed046a23802f70bf5b56e8dbbca8a19f93657eb95
MD5 2fa01622b56473b0895c90b60288194e
SHA1 5fcbf3542ddc99578198e43f68e3070cb80bac0c
SHA512 0fb465f76d39aaf1186dbeb5df1505bf97ba146ef5f5838e304cc4ac3d676585d32cfb64b69c12f07ab4dfc2c5fae0081f89c9ace3637fb9be7855cc30b507bf
SSDEEP 49152:74A+w1GH+zNsGRFpYiUan8Rb281FL6n+M7UxRQO5J6uqQW8v10eyGx4zJFBYwyI2:zrzXpkF0J99JI5GW45jxvdz4uzBGQLm
TLSH
T1E2868D13F2A501ECD05ED974CF3A56329B317C4A4BB092EF269836E11A75ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
4468	alg.exe
3108	DiagnosticsHub.StandardCollector.Service.exe
1216	fxssvc.exe
4632	elevation_service.exe
2604	elevation_service.exe
1380	maintenanceservice.exe
3308	msdtc.exe
2560	OSE.EXE
4588	PerceptionSimulationService.exe
2528	perfhost.exe
1824	locator.exe
552	SensorDataService.exe
708	snmptrap.exe
1788	spectrum.exe
4440	ssh-agent.exe
456	TieringEngineService.exe
4580	AgentService.exe
2296	vds.exe
4652	vssvc.exe
2932	wbengine.exe
4464	WmiApSrv.exe
4112	SearchIndexer.exe
5664	chrmstp.exe
1380	chrmstp.exe
4336	chrmstp.exe
5988	chrmstp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d37c535df77cf242.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\javaws.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\java.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5076	chrome.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c5b389d2e520dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf7264d1e520dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e1375d0e520dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c452dd0e520dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c8657d1e520dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000bdbbbd1e520dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e8796fd2e520dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2032	chrome.exe
2032	chrome.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2032	chrome.exe
2032	chrome.exe
3108	DiagnosticsHub.StandardCollector.Service.exe
3108	DiagnosticsHub.StandardCollector.Service.exe
3108	DiagnosticsHub.StandardCollector.Service.exe
3108	DiagnosticsHub.StandardCollector.Service.exe
3108	DiagnosticsHub.StandardCollector.Service.exe
3108	DiagnosticsHub.StandardCollector.Service.exe
3108	DiagnosticsHub.StandardCollector.Service.exe
2288	chrome.exe
2288	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1660	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeTakeOwnershipPrivilege	1984	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeAuditPrivilege	1216	fxssvc.exe
Token: SeShutdownPrivilege	2032	chrome.exe
Token: SeCreatePagefilePrivilege	2032	chrome.exe
Token: SeRestorePrivilege	456	TieringEngineService.exe
Token: SeManageVolumePrivilege	456	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4580	AgentService.exe
Token: SeBackupPrivilege	4652	vssvc.exe
Token: SeRestorePrivilege	4652	vssvc.exe
Token: SeAuditPrivilege	4652	vssvc.exe
Token: SeBackupPrivilege	2932	wbengine.exe
Token: SeRestorePrivilege	2932	wbengine.exe
Token: SeSecurityPrivilege	2932	wbengine.exe
Token: SeShutdownPrivilege	2032	chrome.exe
Token: SeCreatePagefilePrivilege	2032	chrome.exe
Token: SeShutdownPrivilege	2032	chrome.exe
Token: SeCreatePagefilePrivilege	2032	chrome.exe
Token: 33	4112	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeShutdownPrivilege	2032	chrome.exe
Token: SeCreatePagefilePrivilege	2032	chrome.exe
Token: SeShutdownPrivilege	2032	chrome.exe
Token: SeCreatePagefilePrivilege	2032	chrome.exe
Token: SeShutdownPrivilege	2032	chrome.exe
Token: SeCreatePagefilePrivilege	2032	chrome.exe
Token: SeShutdownPrivilege	2032	chrome.exe
Token: SeCreatePagefilePrivilege	2032	chrome.exe
Token: SeShutdownPrivilege	2032	chrome.exe
Token: SeCreatePagefilePrivilege	2032	chrome.exe
Token: SeShutdownPrivilege	2032	chrome.exe
Token: SeCreatePagefilePrivilege	2032	chrome.exe
Token: SeShutdownPrivilege	2032	chrome.exe
Token: SeCreatePagefilePrivilege	2032	chrome.exe
Token: SeShutdownPrivilege	2032	chrome.exe
Token: SeCreatePagefilePrivilege	2032	chrome.exe
Token: SeShutdownPrivilege	2032	chrome.exe
Token: SeCreatePagefilePrivilege	2032	chrome.exe
Token: SeShutdownPrivilege	2032	chrome.exe
Token: SeCreatePagefilePrivilege	2032	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
4336	chrmstp.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 1984	1660	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	85
PID 1660 wrote to memory of 2032	1660	2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	87
PID 2032 wrote to memory of 4180	2032	chrome.exe	88
PID 2032 wrote to memory of 3312	2032	chrome.exe	94
PID 2032 wrote to memory of 3312	2032	chrome.exe	94
PID 2032 wrote to memory of 5076	2032	chrome.exe	95
PID 2032 wrote to memory of 4492	2032	chrome.exe	96
PID 2032 wrote to memory of 4492	2032	chrome.exe	96
PID 2032 wrote to memory of 3712	2032	chrome.exe	97
PID 2032 wrote to memory of 2620	2032	chrome.exe	98
PID 2032 wrote to memory of 3712	2032	chrome.exe	97
PID 2032 wrote to memory of 2620	2032	chrome.exe	98
PID 2032 wrote to memory of 1812	2032	chrome.exe	100
PID 2032 wrote to memory of 1812	2032	chrome.exe	100
PID 2032 wrote to memory of 5952	2032	chrome.exe	121
PID 2032 wrote to memory of 5952	2032	chrome.exe	121
PID 4112 wrote to memory of 5092	4112	SearchIndexer.exe	122
PID 4112 wrote to memory of 5468	4112	SearchIndexer.exe	123
PID 2032 wrote to memory of 5508	2032	chrome.exe	124
PID 2032 wrote to memory of 5664	2032	chrome.exe	126
PID 5664 wrote to memory of 1380	5664	chrmstp.exe	128
PID 5664 wrote to memory of 4336	5664	chrmstp.exe	129
PID 4336 wrote to memory of 5988	4336	chrmstp.exe	130
PID 2032 wrote to memory of 636	2032	chrome.exe	136
PID 2032 wrote to memory of 5304	2032	chrome.exe	137
PID 2032 wrote to memory of 5764	2032	chrome.exe	138
PID 2032 wrote to memory of 2288	2032	chrome.exe	149

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Users\Admin\AppData\Local\Temp\2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-31_2fa01622b56473b0895c90b60288194e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=150.0.7871.187 "--attachment=C:\Program Files\chrome_installer.log" --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater_history.jsonl --initial-client-data=0x2c0,0x2c4,0x2c8,0x29c,0x2cc,0x1406c9980,0x1406c998c,0x1406c9998
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffebf3cc728,0x7ffebf3cc734,0x7ffebf3cc740
    3⤵
    PID:4180
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1684,i,17049083441414179096,9370058804605329628,262144 --field-trial-handle=1992,i,10238801187356714722,2186200428959923870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1988 /prefetch:2
    3⤵
    PID:3312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1580,i,15939653788857871649,11217673571182945111,524288 --field-trial-handle=1992,i,10238801187356714722,2186200428959923870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2300 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5076
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,16820344899812371735,3666659832841591327,524288 --field-trial-handle=1992,i,10238801187356714722,2186200428959923870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2528 /prefetch:8
    3⤵
    PID:4492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3144,i,13528669613279541007,14511854618760292171,2097152 --field-trial-handle=1992,i,10238801187356714722,2186200428959923870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:1
    3⤵
    PID:3712
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3148,i,10085584473903710446,13569156490265157554,2097152 --field-trial-handle=1992,i,10238801187356714722,2186200428959923870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:2620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4312,i,5478710395289388316,1909041494128185019,2097152 --field-trial-handle=1992,i,10238801187356714722,2186200428959923870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4320 /prefetch:2
    3⤵
    PID:1812
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4252,i,11478621468968865006,16946879717997088412,2097152 --field-trial-handle=1992,i,10238801187356714722,2186200428959923870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4884 /prefetch:1
    3⤵
    PID:5952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,17621911359089682479,16785218722864053200,524288 --field-trial-handle=1992,i,10238801187356714722,2186200428959923870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5844 /prefetch:8
    3⤵
    PID:5508
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5664
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2c0,0x2cc,0x2c8,0x2c4,0x2d0,0x1405755a0,0x1405755ac,0x1405755b8
      4⤵
      Executes dropped EXE
      PID:1380
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4336
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2a8,0x2c8,0x2cc,0x298,0x2d0,0x1405755a0,0x1405755ac,0x1405755b8
        5⤵
        Executes dropped EXE
        
        PID:5988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,17718307099134716305,3017459119217010674,524288 --field-trial-handle=1992,i,10238801187356714722,2186200428959923870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5572 /prefetch:8
    3⤵
    PID:636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,8414236716884141385,2813509199807002688,524288 --field-trial-handle=1992,i,10238801187356714722,2186200428959923870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5648 /prefetch:8
    3⤵
    PID:5304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5676,i,6458286730413674607,1116015591329593884,524288 --field-trial-handle=1992,i,10238801187356714722,2186200428959923870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5920 /prefetch:8
    3⤵
    PID:5764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5548,i,15640984993131976196,10115329421612837491,262144 --field-trial-handle=1992,i,10238801187356714722,2186200428959923870,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4312 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2288

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4468

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3108

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1588

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1216

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2604

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1380

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3308

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2560

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4588

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2528

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1824

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:552

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:708

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1788

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5024

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:456

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4580

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2296

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4652

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2932

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4464

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5092
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ab88a3b8a9d3eac3665cecd33f823693c366b320f016b8e8bf5c49ce7ae27c1f
MD5 a8b0a5afbcc232ca89fdbcf09a05daa3
SHA1 58e3deefcb808ab1d97875db656d3aabfdaf33a1
SHA512 cd1acc97ba88a18959938e05d95ecdc6c4f65cbc850d8baa8ceb07bbaab510a4d38576bb94c13a035fb2a0597b910a5570e4583e6f39ff38cceb5a30f4c98a5c
SSDEEP 49152:5b+632BuPkFKRrdE6ohvstBhuXjfS4LWxn7Q/lFTjN4:P3q6sjBvLm
TLSH
T10CD58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 9034f42ff7abdc907f9446d593f0ab02f9024fed661c791491580829ef2e7eb1
MD5 ea8549fc56ff174f1a3751be1a3f12ef
SHA1 d2e4e452f0fade43b9941cf26431b9d633f3cd3b
SHA512 5474eb79964a92628f88989529620b69adaafa2b350929ca42ff6a1d6f4eeb7a433207cb3373577751bcd2c2880d97e88c0acfc78183c514d2736e448bb93cdb
SSDEEP 12288:n1XLsswWkxy2lRq2czAwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:1XYfDtczAQnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1FD65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 a4e5cfb5e44c8860d1dd94ee57861a5c4897ffa7b67e67ed2c0a436780f98292
MD5 bc2432737130508ecd805c0ee08b55b6
SHA1 c22950771530e3f6d6a4aba0f5285acae1e4e27f
SHA512 dcd8201d0447df5e4997e2d5a0a054595b1d60ca3ef4f34175558aa790e74e234e8d5b2fa09d27303a284e7b839ade0e73c43e33a4b4a271c133a0cf6046ad58
SSDEEP 24576:Q0Le5ji0hmxGrMTnQ/tbw/2Mkjy6Fr7g0ol:QPji0AIaQ/lFTjN4
TLSH
T12B859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2d6bc6fafa8cee76216d9dc9b3f3ba5d6c5f8da50193d5d683475c648d7592d8
MD5 48052741eb78dd9d75e9043d077b8847
SHA1 40c8e2a87080e404a032c73d224f9139fed8858a
SHA512 c3159d8bb6f51f6c22c44450722b9b43ab71fd2442ec07cbc468480453aeac89b0e2879e47847d05cc7d7808e3b39b806cb68d666e1f6789e5595096ffe836f7
SSDEEP 24576:6a7/ezSC6vUyD/aqgrvWn6q8wyuRnQ/tbw/2Mkjy6Fr7g0oA:t/ezSC6vUzPveHjyOQ/lFTjN4
TLSH
T134755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7647a57d80a7f0e537d58e14f9651d8cb756cf332fc1bda280da98280c305d72
MD5 8b535e48ebdf3cdcee750281c4594f72
SHA1 a76952ebd4e09b33578891d936663f4df965f10e
SHA512 a08189fd188aeba9750c205cf0a7dc758cdf5b3daa1103738c78adb5026adbd4329838133acd983814a41dd47767e82362ced9f18bdb8931200cd403e969b2db
SSDEEP 24576:/VbqPb88hv/l+YcnQ/tbw/2Mkjy6Fr7g0of:/VO88hXl+ZQ/lFTjN4
TLSH
T100559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 c90b3d3c7ddc6f530e544d7d4c1eef1eaa35e7f55f4c370ceff6ba42300c88e0
MD5 578ad88ce6cd2a0085cfe04679762f4f
SHA1 137c736f9b7db844821ec0ea6a7a68a646f2e0d6
SHA512 0a2a55e4d5c109c8b1fb0029b23f52bb43b2b47f8b1897e5c709b18ef2323c149c369c690428151fc6b931202e93747bc452b41d2dd381f8d0714e3ecb5f7388
SSDEEP 12288:BxPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:BxvnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1175523796A14F897FF2B06B15C8284826B7B0EC1BFD4EB4E6B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 ed56b0b7a4e427f746bc4386ffe207225abb3d08b85428add91b98503690e771
MD5 a893528cd19031d19bf94e3f16adcaa8
SHA1 0350663f01dec2522bba2b59ce46cbca40f34f69
SHA512 911dc1e67ea67c2442d01ae27a85e2f0ffe50db53c22bc6522fec3a5c3cb3dbb0198a51856dce3b0c648f3f3efb88c3589324d584af699f685b7f0028bab4c13
SSDEEP 12288:/eBNUbTVO86UUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:/JIU0nQ/tbw/2Mkjy6Fr7g0os
TLSH
T13975CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 924959c82be38c1456a2e21674bae35ea9fcccec5781abca6789466e08aa4d3c
MD5 12d0b92dceaa57a0612ae43b8a45a237
SHA1 8ee3cdc3932a50fbdfdf8c03c0b8844b6728680f
SHA512 4a61f6eb9f2af18e4ea72e3f6ab7dd1a550476990485e0735db1ce913c0dd82299fb3c798821faea166684280f64ba410979a303fb320cac67eccd272d71fdbd
SSDEEP 49152:NQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THi:NQvGAdlCEL8c/DRNw5CGLm
TLSH
T131267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 cb36fc2a96c9023c8cd4ca1dd65e62e117ee01c450a7f4bc546814c317234fec
MD5 0abbe9ab271376f0cc79629d82f877a9
SHA1 d5c1986b00528a69ffa360866d3a32df191df100
SHA512 b6bd8b755bbfaca89d2bc6b185d67c4622d4103ed897296cec79843da62c9c72fab13ad655b927ab8916c702f27855882de39750e8fce08698e1ee55f4d02443
SSDEEP 12288:cAwSfxL/2Dc3sDLLmt0LDQewsAjqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg3:BBewsAjqnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T12175E031FE74E436C77F0DB21B22C706193D6A604FA11AC3E3A88A9D59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3537b194badcaf1269d414bcfd18f02e16077f773c636235ce4e5f4b8e914427
MD5 a6babaa73486c3de1b8a7697834eea4b
SHA1 a25e91aeac9d4fc574db8dac10eb73184ffe1b78
SHA512 21a1cc79af07e2aee868e7c30c455e3d5b997dfead55cb17a370221a983ce3a5f3cd9aa7334fccf725221173d042fea05f1cd18479ecd428beaa5b9217210d21
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH9L:0UEtQevvqc2W1cpV2tI32
TLSH
T1E2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 316ed2451a15d016cb02ae3eb767414dd56fbae076cec3f9a0db078a7212cd9f
MD5 765d556be424c7d739b4e00f9fb00b42
SHA1 2866d8f3ea2bf71bd3e701899ed7611320780229
SHA512 2a7c20540cc53c93d42c552b191bddfb5671be64179871e9e494076b8158ce86544f5129a554d038d1c3a7a01ccf472c9a1bd33047a46356f5bdcc56fe7b964e
SSDEEP 49152:ICbRquA/m2yL5zLfFiV+XenmE3/zKQ/lFTjN4:hoq2VjnmqLm
TLSH
T1EFD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0437f16c8a3368f6db5f8be9c3543775dc711dfa8ad3d2a63c9b4e3634046199
MD5 5178dfc85e2e9e95fe72ebbbba14e904
SHA1 4d82812bf7458b5277c871040d9c2ddec2e123b0
SHA512 00b442cb6e23d9052d50e488a3fcbfa154581f00f61236c242a7d079cb6fc9c944a79ec3cc38d5cad8162700cb6c1d757ad608e9718240dc689a0306b628ef68
SSDEEP 24576:VAhGL3IFoiwtA5l7S53lnQ/tbw/2Mkjy6Fr7g0o2:VAMUFoiq5VQ/lFTjN4
TLSH
T11735AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 bbf60283cc92fc4054756a40384d5653ecce1989dd8799a0098ae096f3b58760
MD5 6054a068009536afbdda9ae2f2c52e50
SHA1 a7b3ba48790a17d4ebf9655bcb8dbc710d2b562c
SHA512 e58846c012ad8a78a31f794b277ead1b47faca18c8f80267972f0d0d3dcd615e906637c045acceca3d32ce71d8094ca2aad2444f77a3e205fa508d87e8abf2bc
SSDEEP 12288:4mw5HEjsChNcBFgl0WDm+ChGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoML:1wu9OWunQ/tbw/2Mkjy6Fr7g0oa
TLSH
T14465F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 0fd4631b24a94596a7a9e97b6b33a2fba26e08a7e1f04d0e360e22f021df5509
MD5 4faaff8dacd8e4dfd8565f1a7d04e214
SHA1 6c738a5e33125760d40a2a99065bec221d587c7c
SHA512 83d46909323b0a177430330848dc51d3394747b4da2262651735531b228713d028e05b8510e2a2c8000533f049437dbd0a92102b6541997e2f2586f251ff2270
SSDEEP 12288:QgZ1Iy6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:nZuLnQ/tbw/2Mkjy6Fr7g0os
TLSH
T12F55126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 49d875191f8eb029f3456c342648cce20b5d46effd58dce8578b877ebc893b11
MD5 c42f25f4215b26b6eb4711aa9923f6f6
SHA1 281f60ffa628cda02d81cc50ced5bc2255210134
SHA512 02d8cf1d41295b23293b35dda823cd4fc1c0f451099298aa09f650d7c301a79ec34610f03b900b8869b52e552f694a116fab70354f05ea061293a587ed65a447
MD5 SHA1 SHA512

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ebc63168a1b022ea10a40f68234abb54822a7ab8623d3767732d8b88dda741d1
MD5 138e4d76a4077e9f127a9ca535a3955e
SHA1 a30b050f7bdb4d5d792f8ca53440732e03872fcb
SHA512 036f3cafa009c92b0c66a019d06178e4b45488cc643dc21bc0e52f7e9836cea4cdbd47d3f033ba8d18079ec5f79d6d7295188b2ba231b676ade0cb3eb57dca21
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U2:DQRQyi36YOcPbLvw2gAf+PN3rLm
TLSH
T1D6667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e6f224438248e3723d3051c6c31d64ccc320054e7cae5a2cc05c711e88ea36a6
MD5 a3bec930cbbbd9e0dc6653afec18e417
SHA1 eceeb985be87cbbcfc7aeceb829c0e89f2054b76
SHA512 e489ee71f68443e7913b1b0735b53360087fa7aa64273b758a2650675b828bf762ba390b27de9b8b2e9440f3ead16f878646d717600a4e39bf5aa26bfd26a80b
SSDEEP 49152:LB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glAQ/lFTjN4:du6Jmdxd2dTLm
TLSH
T133D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4336_13429973529238300.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\4336_13429973529238300.pma
Size 696B
SHA256 da9a8ae0c04da6ceae900796a026f4777895bf149eed2c495fbdae098362f596
MD5 3f5af086a83b749aa34a3aac1b986a0a
SHA1 0e67e17122beec914722d98cef0e669541560ff3
SHA512 0a12749b3971d0023cc1dd4f87113c94cc2c961ef824009c89a32ba24fe51de83357bb0757af7612ffb3a638302f5a298a2fc823dec8d117cf27255d2996191b
TLSH
T153010E49A3144F77CC828D3584FE27412BB0FA501B821BBF7B10724F2E021C9AED9168
MD5 SHA1 SHA512 TLSH

Submit Download

5664_13429973529413793.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5664_13429973529413793.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 697e7ad3699410fcf9c443735399cff70c276d8634ebcc0ccc124cbd54f97381
MD5 e63efe56c5988829a0bf0d98f64daf11
SHA1 58238dd4b11e587c3fa41b17b55a2292e8a84c16
SHA512 ddbd873e9e492ba7854178a97e5b2710dd13140706b00da40042262e68e5e20f8b4ae61eaffb6062d08aaa0c31a33e7a1de540822c001d2243e6c30390019a7b
SSDEEP 24576:zcP4mcvIjkGOxhKP2l71nNKbrh/8KBDnQ/tbw/2Mkjy6Fr7g0op:IP4m4IpOO67W8KhQ/lFTjN4
TLSH
T1D565AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 7KB
SHA256 73d06438f3a5e6a418172d0e7c6bbc1bfb9e16929c88182d5715c23ce7f4b3d4
MD5 8d63b6e801428d126a3c640654c8049a
SHA1 a367e20d696cbbd940aacf62e1b4e00191c6ab3c
SHA512 711fa43413ab390ff67fd7ef621afc34cba95e151a8f1512c2d4489e64583af5acb25bf8a6926f22b3e2ced5d4fb791ae654e3600773f6fa1e845657f391a967
SSDEEP 96:THapn9cfpYpkCohK3ZEK3TzjLrSphKq83bhK2hK2kq32+uj/mKH8:WJCpNiEezjnahqrioKH8
TLSH
T1A7F19CAA9E02446F3BC1CF6B339335656E5B200AD7E894723BDBD109F0CEA65011F5A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 9KB
SHA256 596b8b7b5afd0709e1de6769b34295e71347adbf1b24353570cc6f6190dad19f
MD5 80a3551cf0150f1748c65c167c5e736d
SHA1 e55cdc6620806736db2cc291852ca6bedf86c542
SHA512 b117650c5f844613f093b5c5ab42578d6e9ff8ae9637a1fe6f3c1f24f66a6fb5364efc56e6917e0daad96c3e6b43476d6dceffa0ecc52c0a25c5c91c083ec460
SSDEEP 96:THapn9cfpYpkCohK3ZEK3TzjLrSphKq83bhK2hK2kq32+uj/mKHDYkDfhK3pK3hq:WJCpNiEezjnahqrioKHXm8q
TLSH
T124128CAA9F02446F3B81CF6B329336656E6B200AD7E464723BDBD145F0CEA65001F5E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 f46e987b393cd6609db2cfb81579623e6c1ff06cd5d0bb36f4f71348130de12b
MD5 37aee978b623a4a7825596a618a1dfde
SHA1 d7fcbead61319a98385cd4a3418cdc496d781a38
SHA512 b612325b6d6695670405a660640e2eb9f75d9065559194886b0ca8b67700037a92093fff9fe8eae3977455db1ae834eaff016ea1090be69bb683328dd3352109
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 95dbf2f1973dc807f1f35d4c29becc006136b5c5913dcf3cdb120a9447e680ae
MD5 39467b5263c9b1b527ae5f84773dcdb7
SHA1 58eb1caf4873ce36d837d4d0fa5f4d9c007e2e27
SHA512 fe79a18824b5af2a50cd0bc84e353485c1a3963b0aa746e35dbadc635ae2b9c1b4d87d55df34f0997abc01926055a9cfb263907c30decc1d299f576b380efe60
TLSH
T19AE02BAECC21AC2719FD471964554B49E751135F2A80598F363D9109CFB063746DAC6C
MD5 SHA1 SHA512 TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 59698b023541ac94e6896f282ace6fe4be9237916c178386ed26b612be21856b
MD5 73d81465e89fcaea7bb6dd3239073989
SHA1 bc9241af7c596fffa28aae51185fe4d6819aca44
SHA512 315743b69ea17ced31c39188800a0575c2c6420a70743bafa7d23c789f69dd9849cd3e6b2ace70fa029846c6bddb1be7bd6726c6bb86cb90dae322f4b8902512
TLSH
T150416AB3C7D8857D891052F4BA156E1FCD2D0E24535C3D5AC8D8AE0F63E68B5E20058E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 68a246459622a83f112dee09af146d1a0d05f48afb5122e7a75f0d70bab062aa
MD5 db3f1a68c29099a25fff95cab1ba7bbc
SHA1 230f16fd205c3c30b0bf192e26c0b4a717a02af9
SHA512 63ae533fddd43b97ade40d755d9f44ccd4c6e2a1e6acec4fe67da6b434a16f8c29e5dec9c2a3b0392d42eadde8d3ed56740d1f337aec99d83172dea943598a4e
TLSH
T13C416AB3C7D8857D891052F4BB156E1FCD2D0E24535C3D5AC8D8AE0F63E68B5E20058E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3595199ef0e367175af47fb6975d622b409a30d0e2df93bd58779ca92eb11824
MD5 6b03cb81df4e77dabdb9959b0e76d3dc
SHA1 4c9c5423e3afa44feef67531fdeab2f8d2bba3eb
SHA512 d062fde650dfc232029477cc32ddc6d103f08945f50c7323988ef5246937c1187637a08503d298969204dd34910d8b11c03c90d59a03187505eb7a6aed231224
TLSH
T18351ABF3D7E48A6EC95156F4DB256E1FCE390A14431C3D6688D4AE1B53F2872E20138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 e9ae3d02479969bbec4d2276f02bc0216e844299265fad41428ea1a1d41d3d68
MD5 8ccd1bcd2d7d1de75f4434031a564a16
SHA1 49c861aaa601b30c406e5285169fc870044af8ee
SHA512 4b811806b77d7786b80b4ed76a5f5ad1ca79c15f38633cfd132468db0d8ef8442f24ed9f16d339af41fc2fc3b09b3de5e7ee503c020ac942f072a008d8083e30
SSDEEP 192:bRjPk82Q61v7I9PRp2oXsb+WNnQ/29L28eUSHvbaaTiyIsnAUgR:bRjPk/FAXjXwY212GSjazR
TLSH
T16C32956EAD14693B5DCFD22AFE263A57E3F4102172C01D44E6FC862C29DB5DC222781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 15ec67b619a14a0054bce5603c2263961348000b4ae12b7da458c28b7d0294d2
MD5 e5082478d996d774b0e58a846c4c6c6e
SHA1 e6c3ffd58ad241b938fd506c404aaf11decfae71
SHA512 e208a904e9b57f0ed3c0edd9fdc62c1b649de0e8544b0771688f26502ec5cf3b9eed5fd7404bdba2c6f5e2d077449ea563988b6a05cc22bc46ecfc61865bcb27
SSDEEP 192:bRjPk82Q61v70vPRpsoXsb+WNnQ/2DL28eUSHvbaPmTiyIsnAUgraJ:bRjPk/F6XxXwY2H2GSjaPfe
TLSH
T1FF42966EAD10693B5CCBD22AFE267E57D2F4103172902D44E6FCC61D29DB5CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4206e40879be7c89e8fb80577a370b07007d1023e5722863cb9fe07cf2fb091d
MD5 6d8a2c5d6203d12953b16ddd6fac2c1f
SHA1 249142a49a3b66963c943e7f56086e47b50bf211
SHA512 9b369f2a1a833fbc23ec63a9aa68f817ebcf514d429fee652ab432ba6597fb7f9b2bacf484edf7b4ceb03235a442e70ea23f8a5ce84a7d3b8426dcc21fd2e82d
SSDEEP 192:bRjPk82Q61v709PRp2oXsb+WNnQ/29L28eUSHvbaaTiyIsnAUgtaJ:bRjPk/FEXjXwY212GSjaz8
TLSH
T10A32A66EAD14693B5CCBD22AFE267A57D2F4103171C42D44E6FCC62D29DB5CC221B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5856d5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe5856d5.TMP
Size 3KB
SHA256 9c815dbdca5de73b12ef02fc1884494aebc2630ed8f18c18f88eef235a5caaca
MD5 a4e63742265c9fc4baea61374a1aaaab
SHA1 59b83bd43e8acbeea1b455872a78a001bd3bcfa3
SHA512 a362e58cd9357ee53b44019654146112af0751237d349933df0090a959be7fc310c50a3e3b0670bdf4fbb16d25a15f1c72a08bd8981c2a5f0ad4f8adb95be114
TLSH
T107612E5DC0B44CB71DB277B678BD0B85FA60123B159028167E7E4ACE4F75D278084FAA
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 de3b3c0057a9087a245481765dd3a3216836dc526dde854519cb400fb611d7d4
MD5 d871acf5d48655a3bdbcb6fc9255b97c
SHA1 2a0a6ae6c11f3f534b404eb7ce2a1575e744d8d9
SHA512 483cc0071138fd9c40824ee90f6bba114d569d98e26e8fe9a7f05c428244d43465a03ba564bfa354bd1c61ef56cda05afee2d341f595db1de7b4b0a9fe8d344f
TLSH
T162B0128284529501C00203F4115254C87114DF10EA0E170543E06D728825560C4181E0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589b8f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589b8f.TMP
Size 96B
SHA256 d127e02cd210382b78a6481503e3aeabcb4ebde9037675525d419b154606d0d2
MD5 5f0fca03bbc59e1bf8040fd3df0bb38c
SHA1 09aaf5256c38f9254801c45b888203494662a975
SHA512 072af9e643f4ec3be275d899a7b5bf5361a080a56f42db22c04cff27b900a9c05f0e8fa3c97050ce04bbf4f5b3cb33d3abcb7054d2c83548ac055556425a64e1
TLSH
T199B02200C0022302C00203B0388880CCB220CF3AEF232203A2E00E2AEC3022000200B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 7122951cd92baaf7c95823f05b25ac610cac5500129b06cb2835761cd5a2f9c3
MD5 68e9d1e601fb2e1f21b3516f7467e053
SHA1 55794d22b61b5b9fb187f2b1ddab086cad4bb949
SHA512 0530c5d96f63c425813e9356215a7c3889cefebd60b6736c99894408a09516b8f8901193480677ddfa005f03ddef518d2fd4b98a9828767841852d17f2486b63
SSDEEP 3072:QGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:bm7Rkm1tYpBeh2BAoK
TLSH
T159C3123B5D65E9779979B70EB08E0B1F1EF149A2D920DE92C8D86B0437E97CD0A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 bbfed36a144c33da0529f4503ef453029c7640fa9c18662ce4a3c88350a59063
MD5 a321797189327aad6e9675cf85fffe83
SHA1 5e6e4154e0f6e17376220a908f1c6810d61a1695
SHA512 263e5ac7ed6ccaa1e39110c97aff8bfad122bad22e4ebc65967b82d5a07e9850f93f8f21f42074a601db57656dca5e214abcfdc84568db138c213d510cb40ae7
SSDEEP 3072:AGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMj:rm7Rkm1tYpBeh2BAoj
TLSH
T1CFC3123B5D65E83759B5BB5EB08E0A1F1EF149A6D920DE52C8D89F0833E97CC0A05E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 b0e5a079cfedd92034e27c3d9d87dc423569104ce7977ccbb259c82f893c9ddf
MD5 447565c1ac7ade39a26ddbba50d029ad
SHA1 ba1800edf6d219a843dcdcdb7773ee3ecc32a746
SHA512 db557b4c8553e26517b464539e936dc42e93568574ca1856886dcaea866ac2a166ad838db614ec415cfabcf7eff54b2877a39c5fb2961c6227b0115039b0feda
SSDEEP 6144:2etHfDL0L3IFrHNE37LHWuPom7Rkm1tYpBeh2BAox:7HfPm+rY7ZPr9oBGcAox
TLSH
T1A034122E2D70AC7AD964BB1EF00A392F1CF1E953D11C9D658CD469046FEF7990A0AD38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 78498efcde67d80b84465e90644bedf207d3481e1ecf484b940239e287e00f63
MD5 244b14958893ae986b4027294c6ba8f6
SHA1 00d35f074867e83fc1187cdc7783501b581b16a4
SHA512 a634b2910c26a59837fdba07b7b0921251dc94f3fb00bcf3d188a970b11b4d52ef8ff246e9ce6a1af34fef2b68fe8eeb83fb39bde156e27e96f97eac9a91fc34
SSDEEP 6144:btHfDL0L3IFrHNE37LHWuPom7Rkm1tYpBeh2BAox:ZHfPm+rY7ZPr9oBGcAox
TLSH
T1E434121A2D70AC7AD968BB1AF04E292F18F1E893D11C9D658CD499046FEFBDD0609D38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d37c535df77cf242.bin

Path C:\Users\Admin\AppData\Roaming\d37c535df77cf242.bin
Size 12KB
SHA256 f74fe008bfb356b52d1ff5b3f5bb5e9272f2e20f01d8800bfc667b47133545d0
MD5 6f4aefb602abf74eb935030edc61fcf3
SHA1 b55a266f25b9c3e3932eea9741355a79f367d2d1
SHA512 d253c36aad23b2b8297365edbaa011c615610bbfba71402fb5f51a24058babbee05501927c2dc51ff2df6e430969233130879bf47c92dd9dfeb83f7073def7ae
SSDEEP 192:6mOKKZlY7HrkXv5U5EhlG7rG5HUj1kqkCIfmI+EeddEVW5zGScXy5zsh6:4JKHrlChlbaZYCI+I+EOEVlCs4
TLSH
T16342BF2CC4701C03C1E150A63956A9A5FDE62122ECF7A6C5A78B5FA9D84CCFEC5932D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 00a366e6b423d1d8910c5695b40052a04956472a851a65f35501fa3cd86d78ff
MD5 6bb1025beeeec5063c3c4bc522f2c27c
SHA1 bc7f220e36cdff98784f2b23c988c79ddec57fea
SHA512 72089a8dc0ef135a66873eed87071d212464123113bc2115232339a06e9c4cb6daa104d85db9949679fd1392b1b517ffd06b98a89ade9ded232c67e57003d8d3
SSDEEP 12288:r7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:rrnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1365523796668F94BFA3B16B04882C151673F0EC5BF90D78FBB08222D967C3D40EA6745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 2fa0f7029c8f42f1b28b60a0cbd4b4b02a4c8473e83139118b9a1a61d3a07f25
MD5 054efd0453f3e53837aae7e38b98e220
SHA1 c90423cb7ad31842152f9b549ce2c529451a143f
SHA512 268e717b684acd0573d5e9e358423bfe3438cb8520bfe0aafed393b7af318760943350bf79dcb950ce722b34c072b1403a2b16e36f71ef6e415f3dc6e51c955b
SSDEEP 49152:ca0h2GEkuAe73q3pp46zwwQtQ/lFTjN4:ca0hNYG4Jw9Lm
TLSH
T189859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 62e3cfce41dfa7e0f7939993f59879c4a3868025fcaa3032429718f2300627ae
MD5 1567b7d6e2fc7c4200f3cd3cc9625977
SHA1 c00d360a1f907d2ac7660cc13ed94d72d0b8a1f7
SHA512 697e0237a20a53765fd8c48259431733249ac29bb4852eace168055f58b9bae24d2230613fc53fc541d6a6ce0900cd328a18047a75fcaca6929b6d58cbcf62b4
SSDEEP 12288:ehbHjfXGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:ehbHjPmnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1AE55027D26AC30DAF63692BD88928546D7327C552B11A3DF2381823D4F3BBE40D79B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 1642cd0f8e36d189d5a0b143754bd3699fcaf94a728d5691313dd7e7b6239ca2
MD5 68c5cae234f2af192955322d974b3037
SHA1 c52fa4d7af54d29ef2d6eaceaaebc46982c7b803
SHA512 3b655a4fa3a10060b6704b3a37ecf39f915bc1ed099270a964dedb37c158632eaddb3321da29f701488dab46946085f00f0b10012bec9da814f594f8669363b1
SSDEEP 24576:Y3YgnJcRTk4yti+R5dBR/unQ/tbw/2Mkjy6Fr7g0oq:YIgnaTk46pBR/uQ/lFTjN4
TLSH
T17A45BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 1045146e2083ff3c2b4656fcd6ccc86cae8952004414992a2f5b8cc73e722cbd
MD5 a3bdc44cf53268f4c7ded07bf6a901ab
SHA1 e1cf0ec27188c0e06a356d6c9ce976a9fa7ee822
SHA512 9ddbdaecb4c77fb995d93b46156cdfc50922d53535e07cb5cda3203cada1351a7dd0c6444c939cf6f5e6e20fb877086959c88201de1724062f1b38128dfca4d9
SSDEEP 12288:TvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:TPnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1C95523687614F98BFA2706F54C838146673B0EC17FA1A7CF7B482229967D3D41AF6780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 094b2dca95dd482e3418964234bed5df67290c91d5f1069e63384354489fc981
MD5 7711984849c19acc154f41d6a9f2413e
SHA1 0a240a1613dfd0bde2b092ad81373acefd89b95d
SHA512 6b65aa26cd86909f072f79b3b7f04686df6485238f6ca45f8dce243721c40671dae68b56b2137371bab591855f75fb066f253cc18ee1d3ac2725377b263395bf
SSDEEP 12288:sObCA4LWOsvAYFTwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:RqL3UTQnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1B775F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 ffbf761e710db255ffdcc0de8bacd835b491e0a395306c099e0556b10ced2599
MD5 0439a2f34d7e8989f5f5869baa63d41a
SHA1 fd8456fe0910f8c60061d8eb4acb0fb36fc8cdaf
SHA512 cbce40c5a62ab138db39ff5e7786bc58608096bcb825ec81ac26b1ad5b891099131ffee5c9a8b222051ed36ec710079da3a4db6e75c09814092270b47101bafa
SSDEEP 12288:zpFtfO0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:VOUnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1D455022D36EC60E6E536527C89838249D37278921B6253DF0780817E5F7BBF85C7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8501573102a13cb3173528b256c81f1abacbc564c72665ece52a331f10d03719
MD5 dd76a8f57155b59cab3f80b4dc31590b
SHA1 250aea8ae7129b51d7ea53a304c31b73c0ba235e
SHA512 2270abf9bedaf1b05d56fe4d3fab59089cdaa7137930cef1620395be1ec80ac5dcc6ec17cd58f69b20fa29a9693da290653f2e9711c75849a05b519fb25abfd8
SSDEEP 24576:N7NM9YqZqmWMUkPjZM48Mv6bEhsbnQ/tbw/2Mkjy6Fr7g0oJ:N7cBWMpPjN8DbEhGQ/lFTjN4
TLSH
T14B659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 6ea05482ec231f99bb0b45db856f957ebd4f1808cde105d11698c3c9a95e28cb
MD5 e470da6c0cd0b929349a5469a17ad0da
SHA1 d531161a2bfb8c9344f48ab7f4fc3a7b92ab433a
SHA512 2185e114ea37c158b245ee956d4f969e6c2a57d3148e4133caf9d42947e0e92e1972a27ecef6dc1ba3ad992a7f86b005c88bb7c54fa7b498649d98fd5b3f2a09
SSDEEP 24576:dW6BApg2YuyuNDYTabvcdvNYf8km1ZnQ/tbw/2Mkjy6Fr7g0of:dF2YuHNETovAvNYf8km7Q/lFTjN4
TLSH
T1E6857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 3467379dddb32cab9d1c93ae575e740dc81d5ec27f381348744fdbe3efbcacd9
MD5 f9d655d3e7eed308a3b2daa3fa2ecf2b
SHA1 2dd08e65e66babfcf1fd9b5d50542961b26ed3d9
SHA512 bf39dcc045cb41df95afbe673dadaf82dfba3df4149014be0c9d7fa7633f89bbc24bd141178465335f609c8aa713edc7e5e2a838528216f9419f635a42405959
SSDEEP 24576:nAFs06+OmlfkNXEbToonQ/tbw/2Mkjy6Fr7g0oQ:AFs060lwXuNQ/lFTjN4
TLSH
T1B265AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 9f89c6a5a2968fbf35598f85364c6cd9274a2034f18e8c417c7a5b57a87cc05c
MD5 b2894ddc39857ab7189dc694d51d1942
SHA1 2636a0b4dfe6a0377a5d39ef4e2f7194487b6c93
SHA512 31adf396a62f1e47638cb1699584d25cee45335fe4cef087cceb604ba20e4d610f5e9040f51904f5ad2610fff347f324a1de3ade53b422efc4ad2bc8bfbad27b
SSDEEP 12288:zCJnJ5D3VkrqzxLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:OJnJ5D3WaNnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T15975D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c7a103f448d32506df72a8320ed8330bcfb50b4b98e6adcde71f9030b761f6c1
MD5 7da94dd896f43edecf7d8a5a07d9a5f6
SHA1 5207f81bc207fac4cbd85a391d4e92da329c48f7
SHA512 7a22f2cbe52803e87973a4bdf1ff1e230ff077a0e20f7f34d8b8c7cc898727f89cfd8db723fd86421bb54ffb9e633137b67a207dca798e6f69f80be0eafd7ad8
SSDEEP 24576:yEPghm6/7IIXdwcXrif7qQncjlP65i3VuunQ/tbw/2Mkjy6Fr7g0oy:Fg06DIKdwc+eQnSt65aVnQ/lFTjN4
TLSH
T1E4955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 90a5b4e1bd56f666c4d062f4619eba5efd4af19bf91baccb986a2b0d562f1fb5
MD5 da9d09249982661ea492d979c724be8a
SHA1 4e135aeea27f1e0f228d153121d1c5826edfffc5
SHA512 63e49fa9ca8f4729dece153db2edbf489cf68b367cc38c47c13f4a744e6a14133a82e38ace3f85e0a85e954e1af3bd113ff2c3fcbcdac1ee938ca78026b611aa
SSDEEP 12288:pEP3RSJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:6SZnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1C155126D37ACB0DAE52A517D88918145D373F4A12B5267EF2680823D8F7B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 1220a97999f4f9f40562346f932b3591531ea2e8a06ca2fa8d95d79912bfb4db
MD5 78fce29a34f3748b9a148eb39e498ff9
SHA1 907c00c1603906601cc5442c069ee20fe324d730
SHA512 0f92b1258f9f318eb6f43388ea548d65300082509ea0b85d59fea9698709a99169768f1a03bc51764271776d30520002c47cd3480a18069c2b23983bd164cb51
SSDEEP 12288:GjkyWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:GIy2nQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1036512186398F4CAFA7A06788DA381919B367C506F2193DF6280F23E9F3A3D45D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 8bd31bf25dacd74a45c1b6945dae5f75ee09f85d7e62190ea12eb2bd9828af78
MD5 7d5045a7c0db85fc19741772abb59339
SHA1 f081da7c08a4ff36e7ca961b13002fb996ecc53f
SHA512 3110ab764dc280b19c7495baa5368b2d431525114cfcf8bfad708f2566d4998539e98de14f5a6a874057fabcd96c4215870012a0e71e62001ff2ec748f9b6daf
SSDEEP 12288:x0EGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:eknQ/tbw/2Mkjy6Fr7g0oX
TLSH
T15755236C2624F89BFE2706F448928582973B09C17F9167EF36C46239CB7D3D416B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 c75c6b613e4456c7caec058a547ccbaa3ca4c4eacaaea5c5a59110517f7c1d7a
MD5 471986dfd27a96491d3236dbf973bcc6
SHA1 1647d0d3542be8bc8db490063f6a94b1ff19dd8b
SHA512 ad2108180eec1ded8f5a67d8a919ec9a5405f0484f634002688bd5a1cdd13a16a7c4fa8a35779b78bd44c9f5136e66cb4b95405d07ca000fa1e3e0f9b5afd336
SSDEEP 24576:FQ9MxZKdcz9dw3znQ/tbw/2Mkjy6Fr7g0od:FVKZzQ/lFTjN4
TLSH
T177558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 77c434f74f495fd76c913eaa6796c4dd16dd0fb45741cbd950ea8b4fe4ab6d96
MD5 bb133c74da66e9bc1abeb9e9d2c9c720
SHA1 e6f3f956fa20e4a0c80ffa40e1fd2cb8555cb873
SHA512 34f9632659fbc08752ccf58d8b1f6cd51491bfcfc2837cee585fccecc0be342c51821573212ae902a82da72141832bd6db3544b13781ea6f592f091c6254e79d
SSDEEP 12288:6yoKo20Rple9pqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:6yocSApqnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T14965E01FBB6990A2E136813C88818745E773B4706B6267CB6681C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 5ad78810c8fcb8bfa4121c1bdea75414bfc3e4419b37d8db9c98935ea97e3e0e
MD5 b3507c110cce6e4257e8f230d26bb1a5
SHA1 c0bf763cbc6a7baa314d5a08167fe51ebc5b6727
SHA512 6ff8047b862ce07348f0badb864a4c5fa5edc6805fe9709f041fd5d2c719ad789aa2c24dbccb4aa10fc19965264ba63a71a59308d01396065e45ecb5f2b672a3
SSDEEP 49152:SWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKqQ/lFTjN4:E0zuNIjLm
TLSH
T126A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a2cf6ed81df105a5a3a5ebdc290cc8a849fe19c1d72b713df1f352abe30cd6d4
MD5 9d147dd98ae76142fe0be2af6022f9e9
SHA1 ec8cc40ba984c657838d20e3a3a36f0ae270da23
SHA512 b9e536ee77f42a6fd1527de862dcbd8c2717e8bdee68804be6258cd78074e0d6b5fc36d5c86069c8ec187530b84461fc511cf5dfa84ff01db7c08e5571a4dd5e
SSDEEP 24576:n1QT7EcpfxR+N5AWAz3ooiYujMqbxnQ/tbw/2Mkjy6Fr7g0oV:aTDxR+N5YzT4jM0Q/lFTjN4
TLSH
T18A55B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 be8c86bc1e5f06c8050c702287783dfdd939bfd9100be3a0e4b7a3284fbccc92
MD5 c0ad32f98ec03190725fc94a29802c39
SHA1 2125d7850d3dd31d8e3875c5ff7cf41db471c4f7
SHA512 5a4d312158ff61ed9bb683d5bc453065568d0eb83e47fb734f6d0f721cbadf4f8b3b231e44d3bdad3136c29100a2572297360ea2c18eb34f5d9013029c42f42a
SSDEEP 24576:+TMdOz0FFS+MmSLFnQ/tbw/2Mkjy6Fr7g0oU:K0K+MmSLFQ/lFTjN4
TLSH
T1B575E17E636D14E5E53BC27D9A438906E67334620322A6DB0690C17D2F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 85dd4e5e87d7e734f71036e6ea3e2448d8f32744e34e36bcd749c9b4e493d48c
MD5 780f092250be6c16d52c5996afa28575
SHA1 d054573c9a8395e3d0fea36038e6911cefb6ec85
SHA512 9d369b56935dda60f75cafb1ce49ed2f70b436865ae7252a3e49c943ce3d7f79eb02d8dd76d8f1cdd06908b78109c2eb3aab0c0f9df9b4ca517034461198ff5b
SSDEEP 12288:04TwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:rQnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1DF55122D23E8B4DAF93352B48962414697327CA2276167FF36C4C63E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/456-450-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/456-185-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/552-209-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/552-154-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/552-410-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/708-385-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/708-158-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/1216-47-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1216-104-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1380-103-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1380-85-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1380-92-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/1380-617-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/1380-101-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/1380-86-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/1380-486-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/1380-472-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1380-465-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1660-121-0x0000000140000000-0x0000000140811000-memory.dmp

Download

memory/1660-6-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/1660-0-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/1660-10-0x0000000140000000-0x0000000140811000-memory.dmp

Download

memory/1788-169-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1788-412-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1788-161-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1788-167-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1824-204-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/1824-151-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/1984-123-0x0000000140000000-0x0000000140811000-memory.dmp

Download

memory/1984-21-0x0000000140000000-0x0000000140811000-memory.dmp

Download

memory/1984-17-0x0000000001FF0000-0x0000000002050000-memory.dmp

Download

memory/1984-11-0x0000000001FF0000-0x0000000002050000-memory.dmp

Download

memory/2296-471-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2296-193-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2528-141-0x00000000006D0000-0x0000000000736000-memory.dmp

Download

memory/2528-148-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2528-200-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2528-146-0x00000000006D0000-0x0000000000736000-memory.dmp

Download

memory/2560-113-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2560-119-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2560-124-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2604-76-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2604-69-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2604-77-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2604-181-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2932-501-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2932-201-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3108-32-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3108-40-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/3108-41-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3308-109-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/3308-188-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/4112-235-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4112-210-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4112-219-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4112-252-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4112-531-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4336-483-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4336-477-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4336-496-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/4336-517-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/4440-182-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4440-173-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4440-179-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4440-427-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4464-525-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4464-205-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4468-26-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/4468-134-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/4580-189-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4580-191-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4588-196-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4588-126-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4588-135-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4588-132-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4632-107-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4632-105-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4632-67-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4632-56-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4632-50-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4652-488-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4652-197-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5468-533-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-554-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-551-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-550-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-549-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-548-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-542-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-541-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-540-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-539-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-538-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-555-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-558-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-557-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-559-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-532-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-560-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-561-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-556-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-552-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-553-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-543-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-545-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-546-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-547-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-544-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-537-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-536-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-535-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5468-534-0x00000280FCD00000-0x00000280FCD10000-memory.dmp

Download

memory/5664-523-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5664-461-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5664-452-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/5664-458-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/5988-626-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5988-502-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5988-490-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5988-497-0x0000000000750000-0x00000000007B0000-memory.dmp

Download