8d9f7b5662d405c004ad65f4b5d00486ac0242753bc807c5b25ce00c6ce9491b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Size 7.9MB
Sample260804-3eqgaaac69
SHA256 8d9f7b5662d405c004ad65f4b5d00486ac0242753bc807c5b25ce00c6ce9491b
MD5 08fd2e191c9eaa7b564fdf1d7b6c81e4
SHA1 854eb912f1802ebc392ca8fceaa31ce4b32a2269
SHA512 c1e9865c559b7204a3fa348e3bc1cc5b6ebf85da0b10fd1057a32adf58b15f0508373a1e9dd1ca0f0c4f8bf00c6a7324bafe7a9a4f4c99619f5b494044e6b231
SSDEEP 98304:/rzXpkF0J99JITGW45jxvdz4uzBGVXvYCp3nyG://CFE7I4fBGVTp3n
TLSH
T14F868D13F2A501FCD05ED974CF3952329A357C4A4BB0A2EF269836E11A75ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
536	alg.exe
3440	DiagnosticsHub.StandardCollector.Service.exe
5056	fxssvc.exe
1572	elevation_service.exe
2724	elevation_service.exe
116	maintenanceservice.exe
920	msdtc.exe
1384	OSE.EXE
4176	PerceptionSimulationService.exe
1048	perfhost.exe
4180	locator.exe
3972	SensorDataService.exe
2224	snmptrap.exe
1808	spectrum.exe
3536	ssh-agent.exe
4328	TieringEngineService.exe
3652	AgentService.exe
4868	vds.exe
1252	vssvc.exe
2648	wbengine.exe
2556	WmiApSrv.exe
4828	SearchIndexer.exe
3676	chrmstp.exe
5240	chrmstp.exe
5452	chrmstp.exe
5752	chrmstp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ec8fd09168b29bb.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\javaw.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1404	chrome.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ebfa5c16824dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f89790c26824dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ddeeb5c16824dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000378cb3c16824dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005307a8c26824dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000942664c26824dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c5b2eac16824dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000533ce3c16824dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce2913c26824dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007ddae0c16824dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000209f28c26824dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2784	chrome.exe
2784	chrome.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4660	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2784	chrome.exe
2784	chrome.exe
3440	DiagnosticsHub.StandardCollector.Service.exe
3440	DiagnosticsHub.StandardCollector.Service.exe
3440	DiagnosticsHub.StandardCollector.Service.exe
3440	DiagnosticsHub.StandardCollector.Service.exe
3440	DiagnosticsHub.StandardCollector.Service.exe
3440	DiagnosticsHub.StandardCollector.Service.exe
3440	DiagnosticsHub.StandardCollector.Service.exe
5000	chrome.exe
5000	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4920	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeAuditPrivilege	5056	fxssvc.exe
Token: SeRestorePrivilege	4328	TieringEngineService.exe
Token: SeManageVolumePrivilege	4328	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3652	AgentService.exe
Token: SeBackupPrivilege	1252	vssvc.exe
Token: SeRestorePrivilege	1252	vssvc.exe
Token: SeAuditPrivilege	1252	vssvc.exe
Token: SeBackupPrivilege	2648	wbengine.exe
Token: SeRestorePrivilege	2648	wbengine.exe
Token: SeSecurityPrivilege	2648	wbengine.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: 33	4828	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
5452	chrmstp.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 4660	4920	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	87
PID 4920 wrote to memory of 2784	4920	2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	88
PID 2784 wrote to memory of 3816	2784	chrome.exe	89
PID 2784 wrote to memory of 3216	2784	chrome.exe	99
PID 2784 wrote to memory of 3216	2784	chrome.exe	99
PID 2784 wrote to memory of 1404	2784	chrome.exe	100
PID 2784 wrote to memory of 4452	2784	chrome.exe	101
PID 2784 wrote to memory of 4452	2784	chrome.exe	101
PID 2784 wrote to memory of 5288	2784	chrome.exe	118
PID 2784 wrote to memory of 5296	2784	chrome.exe	119
PID 2784 wrote to memory of 5288	2784	chrome.exe	118
PID 2784 wrote to memory of 5296	2784	chrome.exe	119
PID 2784 wrote to memory of 5392	2784	chrome.exe	121
PID 2784 wrote to memory of 5392	2784	chrome.exe	121
PID 2784 wrote to memory of 5632	2784	chrome.exe	122
PID 2784 wrote to memory of 5632	2784	chrome.exe	122
PID 2784 wrote to memory of 4208	2784	chrome.exe	124
PID 2784 wrote to memory of 3676	2784	chrome.exe	126
PID 3676 wrote to memory of 5240	3676	chrmstp.exe	127
PID 3676 wrote to memory of 5452	3676	chrmstp.exe	128
PID 5452 wrote to memory of 5752	5452	chrmstp.exe	129
PID 4828 wrote to memory of 316	4828	SearchIndexer.exe	135
PID 4828 wrote to memory of 5772	4828	SearchIndexer.exe	136
PID 2784 wrote to memory of 5276	2784	chrome.exe	140
PID 2784 wrote to memory of 3952	2784	chrome.exe	141
PID 2784 wrote to memory of 4376	2784	chrome.exe	142
PID 2784 wrote to memory of 5000	2784	chrome.exe	144

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Users\Admin\AppData\Local\Temp\2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=150.0.7871.187 "--attachment=C:\Program Files\chrome_installer.log" --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater_history.jsonl --initial-client-data=0x2cc,0x2c8,0x244,0x2c4,0x2d4,0x1406c9980,0x1406c998c,0x1406c9998
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbe3bcc728,0x7ffbe3bcc734,0x7ffbe3bcc740
    3⤵
    PID:3816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1684,i,1286653467524157300,3771783165129875391,262144 --field-trial-handle=1996,i,2721830373184542859,6794431432995261683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1992 /prefetch:2
    3⤵
    PID:3216
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1580,i,8610427414434343595,13252880190778411442,524288 --field-trial-handle=1996,i,2721830373184542859,6794431432995261683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1404
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,3612717939853085687,17159321628321366736,524288 --field-trial-handle=1996,i,2721830373184542859,6794431432995261683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2528 /prefetch:8
    3⤵
    PID:4452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,12230658366180959458,7933201863747986718,2097152 --field-trial-handle=1996,i,2721830373184542859,6794431432995261683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:5288
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,11363149267880657796,5232313121818367961,2097152 --field-trial-handle=1996,i,2721830373184542859,6794431432995261683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:5296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4520,i,16765182390811699190,9043911361604325974,2097152 --field-trial-handle=1996,i,2721830373184542859,6794431432995261683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4492 /prefetch:2
    3⤵
    PID:5392
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,10481418308596726367,16166224080358217316,2097152 --field-trial-handle=1996,i,2721830373184542859,6794431432995261683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4744 /prefetch:1
    3⤵
    PID:5632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,1157034404486381980,15460141114577566619,524288 --field-trial-handle=1996,i,2721830373184542859,6794431432995261683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5472 /prefetch:8
    3⤵
    PID:4208
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3676
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2cc,0x2c8,0x2d0,0x298,0x2d4,0x1405755a0,0x1405755ac,0x1405755b8
      4⤵
      Executes dropped EXE
      PID:5240
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5452
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2c0,0x2c4,0x2c8,0x29c,0x2cc,0x1405755a0,0x1405755ac,0x1405755b8
        5⤵
        Executes dropped EXE
        
        PID:5752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,12898509610951993390,12675396504380539397,524288 --field-trial-handle=1996,i,2721830373184542859,6794431432995261683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5920 /prefetch:8
    3⤵
    PID:5276
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5692,i,952862377129753611,8962695374445836193,524288 --field-trial-handle=1996,i,2721830373184542859,6794431432995261683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5928 /prefetch:8
    3⤵
    PID:3952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5924,i,2654030367059376390,4130914084368917089,524288 --field-trial-handle=1996,i,2721830373184542859,6794431432995261683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5952 /prefetch:8
    3⤵
    PID:4376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5984,i,7154896834177313159,4633723681994076679,262144 --field-trial-handle=1996,i,2721830373184542859,6794431432995261683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5000

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:536

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3440

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:660

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1572

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2724

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:116

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:920

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1384

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4176

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1048

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4180

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3972

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2224

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1808

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2252

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4328

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3652

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4868

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1252

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2648

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2556

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:316
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 378db8c8309c16b544a65d62ff63bd0878d3a751ca378a928e6accb7806d4946
MD5 799150ed5ef59450f7a255e0564874d4
SHA1 8e9483401cee67f31654e3d06cfdf671b3497f77
SHA512 d99c792b37cc751849808421c7494a4a3ee983195301a5d1539688174a7984dccd744253a8a721aea09925ca4dd9f6ad11f867bb6253ef2fbe17e467d3b5aefe
SSDEEP 49152:db+632BuPkFKRrdE6ohmstBhuXjfS4LWxniXvYMLprznyDSga9:j3q6HjBzXvYCp3nyG
TLSH
T1F6D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 cbbb615983a8932d7c4e214f0c2bcdeac242eff2e872c003282a01c619a16bf2
MD5 d60e59e1a77c4ce4a1e0bb50c5f1fcb3
SHA1 57ea06b918395522a0fc69b6c9157d71d26a3fdc
SHA512 50e88edae7c648441a7285d6f1ab3a3234333e6fc2d1297be0f850ad6def1d36e34554907cbe0dbbf2cc18c78261aa8e46ea9335d322400636695853e605e6f9
SSDEEP 24576:7XYfDtczA3X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:etcwXvYMLprznyDSga9
TLSH
T121850128B3E408F9ED27813DCCA28405EA3378954760EB9B03E0996A5F777D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 2efb16e1c2e6804d27a8a0322a991740f36d2a90126f19b4c54c55955a37ff5e
MD5 37bd631bbec9dc22ed7f963852e00cbe
SHA1 886b87e45c3e935717998efb5a6f93331202a607
SHA512 2027373043cf836f6a0f5aee066bd98cf5780db25101d45986dfc9ee6da757a052e80a9e02840d2aeff5d726463517bd961d76d8414889f6c08e9db422b78592
SSDEEP 24576:N0Le5ji0hmxirMqX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:NPji0AcpXvYMLprznyDSga9
TLSH
T198959E15F6788335D073C0B9C5D2A68EED72308657308ACB4286D77C7E6BAE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 afbed6a1ba2504eeda82b74d83eb99c19aab9cff6047fccd30abe3b3f7270251
MD5 11319b5eabb0c4edaaa88ed921617044
SHA1 6561c587e4047e8e9c744f54fcb28a885167f821
SHA512 4ac2017ec88060ffd71afb049da456772772868578af97b109213257e30af0335e21da0bde1e52e475532368109b1d196e87dc72f5cc78a057ae340eb0d34812
SSDEEP 24576:ca7/ezSC6vUyD/aqgrvWE6q8wyuAX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:7/ezSC6vUzPvxHjy9XvYMLprznyDSga9
TLSH
T15A756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7ea4a7ebf73a159896caa4979380b4f5f583adbda4c5f64c7b33e154727c05fc
MD5 4849a00225c6200e29be2ea54e2b3520
SHA1 52ace333a29e8cd23bcde6a0776a85702d842975
SHA512 b6e2f5a2ab07027a54ddda6c6bdfd4a56ec569ec57b7c55ae5170c3a68f5d7ccd7ad481e1f8300d5ddafc538e72729ca17db4d26f8342b23e26b62bb7bc50d4a
SSDEEP 24576:9VbqPb88hv/l+6DX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:9VO88hXl+uXvYMLprznyDSga9
TLSH
T171559E65F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 0ad2339bde9e8045500d6d7bc2d3cea5b995ba526e819b7f9f1fdb424a1ebc10
MD5 7727788101f0de33a4be95a09aa566b2
SHA1 5e92bcd0966833fa7a550a2487d570148cd8844b
SHA512 fbee4ef303c98290f6e2074b1b0032a11fde3488b35cf5e020e51181988981473c8eea428c400a22bcfbe581c459fd9e0ada20df428731c68dbdde08a9dad19f
SSDEEP 24576:0RGX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:DXvYMLprznyDSga9
TLSH
T1CE652314B63C69F7FF2B54364CF5480DA86F2EC44409AE2743A2BADE94FED38E446125
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 1d32cbdd2a0d62b3125a93d7a48b7a4515f461fc0e83337be7c53507b12b170a
MD5 ffd45ad9d120aac917a49dad14e94dc3
SHA1 8297fb7f6f62a5bec4026effc86e32bc3be4b907
SHA512 94fcaa365885ad1e1cea0a49438fe000cde9bd0e0e137786a522f5999b1ce6d2ec984eeff9310d07ca5e21a014cfbe5f780b4d1035cd108cd8ef78a75cbc1488
SSDEEP 24576:dJIULX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:dJIULXvYMLprznyDSga9
TLSH
T10485CF3BEE38FCE2C67E4C795A918600E77278704B12A3CBD165830EDE275E45D7A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c110fc87956b5585f37599f19f4fdf2f0f65e31cf1cf9fe55f619fc868c324c4
MD5 588db1bc5f69c030c146f964c87c3c77
SHA1 a742251c226ec715dfc893b2385278e0d5dce29d
SHA512 db9ec180dc63e7052d50460e5177df3bf144a57d15e48e82d9472e911ab0d33d318e86afa5ddb3f44384406bf91e1f532eb0388a160f545128e5b7317a49e8e6
SSDEEP 49152:CQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THV:CQvGAdlCEL8c/yRNw5CQXvYCp3nyG
TLSH
T1D1267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 9c1477e863b7f58233d2fe33c9f98ef8542f1d06d6a0ec938301c272d98c9684
MD5 3bff7eeb87302dc225effdedfab44e35
SHA1 4d47ba3d587cbd7e517947b33dd087dfa3c0e0ee
SHA512 3418ad9ebef6294b2a145526f53850efcbe007bf04ae9455985f7b318a224bb0ab0097256eff59970a2c1de1042e8dbfe921897152155c716ac8468a0c217436
SSDEEP 24576:ZdewsAj5X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:Hlj5XvYMLprznyDSga9
TLSH
T1A485E030FE74E436C77B0CB21B76C70A586D7A604B511AC3E3E88E9E59742D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a55f97a1906cb3e40417ea16775f27086a8f603d059d107feac9cb243c081085
MD5 c10f7c4a6979d7cc62be372b5411bc2a
SHA1 3fac2e56f999f23879e9658d702cab614faa7732
SHA512 2e5f5d3fd47a01e189f49acda0ca4ef7f92f7d3e3545463ab9bf303a2d7b979cfee2d52d40048d4bd10138ca2b6b148e01441396f859298fd38073c18ec11e4c
SSDEEP 196608:SUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHRTp3n:SUEtQevvqc2W1cpV2EI32ph
TLSH
T182474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 946a11b2381d986a29fcaf671a5dda4b5dbbbaeb6737bfcc0e7874ac20600c38
MD5 dc9f51e9412e35c6333b9692aeb94cab
SHA1 194c0dfd940783bca83c26ee77b7ad71cc8a4dbb
SHA512 056de66d38de87f37613816079ddd3d66cfb6b24e272ea69febe543107431439649386b99aefb7e0ab6f43a8971feff8aa3408584fef3cacea7aa4ff57cb4c5b
SSDEEP 49152:FCbRquA/m2yL5zLfFiV+XenmE3/zZXvYMLprznyDSga9:Soq2VjnmkXvYCp3nyG
TLSH
T103D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 aeb4202ab992e0626a8934061e242e71befe72d93de161aeebaec9cd7869300f
MD5 26e8138ab06eb36a6022a7c4cded0a22
SHA1 5d99346cdb67b05f39df27fc602a3f376f3a2d75
SHA512 09a40721c8ab087ef98760f549c095cbeb6bb8f21f4aa5e73c61fb6e2f34c521f57b350fc479c5c4112e1b06e10b392490e32283d527f0ef8af4df7ee350a513
SSDEEP 24576:3AhGLJIFoiwtA5l7S53EX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:3AMyFoiq50XvYMLprznyDSga9
TLSH
T1C0359D80E7F955D4F5B3AA7899B68170EA76BCAA5E31C20F2260D11F0E37E509D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 70d1ddc4c87d67f677772e2f891dbbe43fa0eb530d3e243751c09ea3d202cbac
MD5 1c394d1e9c6e9d9ecfd2084e8b60b2cb
SHA1 56205f68788dd021746c6133113c6a6bc386d1a0
SHA512 53f2318f469121c985c208abc2ede07b5af991abfd6cf3027b67d0f854ac1aa0ec5ae36fa18494f0877203e0909af4712a023220c3fef01ed68ea9aa5e086f26
SSDEEP 24576:6wuoOWdX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:6wDOoXvYMLprznyDSga9
TLSH
T11F85F10572A81CF9EA6781398997C536F7F3B8412A25DB1F03A0C65B6F37321AD1E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 8f3a643ffdc937685647706ca667a7ce186181f0223fc8ec9d4adee1df083f01
MD5 d2d0ec78ed9f6814e619a6ac5355fda6
SHA1 3087c92c25d70779e5ac09b246afba88b1118879
SHA512 753afda8d2da4b2ab5de70266d8c48a1c48b6642959ef1a7b0dd138958ef3e79202f40839192b7c480c438b0d7136e65a1aafd4ee52b1c5a05202952f4ef7088
SSDEEP 24576:IZuyX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:IXvYMLprznyDSga9
TLSH
T13375121932B830FAE667513DCCF14509E7767492173683CF026146AA6FBBED56C3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 403187490d7747a3db01cb8b45c2fd89cf2d7074fba81f91c1416ad7134a0bf6
MD5 d54b5002d56259f1698e2b82ad8c3c35
SHA1 250775a688d476aa680e6acd2126aa191c4b6e2f
SHA512 663880556b8e7de7b0d6427ce8b5553104841d5b7bcf924f7cc0dd157467df2891c7d6eb9c0c78093a697c5bb64ab3592a5cda7c354ce31ebee1f823186bec22
MD5 SHA1 SHA512

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0b2055a5ae6776020e7527d037d0ec75a0f002f1ca3f7fcef3f1486ba1e70a72
MD5 9bb096e46fbe87fa2e053b094fc80571
SHA1 9cae16f56fd46fe98b5156700488c49d47f13d15
SHA512 1d44c6578c58084a033e31fc0212d90ab6465251721e59e09b677fdb209bade304f7f451125e354498fd4c1d8421370c70cf70266ae9a1bc7ace05d65b96e22c
SSDEEP 98304:qQRQyi36YOcPQLvw2gAf+PN3/XvYCp3nyG:BQyiKayX+PNvTp3n
TLSH
T194667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 931ec1cee6c7e9e3e36505a970a9b31833cbcbe72930417029d5cebf62f2d312
MD5 41a49380cfb70b4b8e2fb9568d9e347a
SHA1 10944d6997cacae3969c319abe8d1a7144a8a9f7
SHA512 f25952821525c562d236a30514a6c447fc8a93a27dcbfa2adbd76d392a18e126b6a7831b304f69fa33309c4af2be7ebfdb7b24d04230b8dd6cdd02c90952a4d7
SSDEEP 49152:BB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glnXvYMLprznyDSga9:Xu6JmVxd2dnXvYCp3nyG
TLSH
T17AD59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3676_13430359616263817.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\3676_13430359616263817.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

5452_13430359616206170.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5452_13430359616206170.pma
Size 696B
SHA256 dd732f971724c5936259d1b57b75fba75833fbf29c870fa9a4989d00cadc27a7
MD5 839694ac89b23a0b735a42fdd41d2356
SHA1 8a4a6536cb732f5ca1005629e5593b068874ff36
SHA512 62b1a7dd7139865bacf26d8938fc9b9eccfd1b580eb0a1a5011c7fb487728a4ee973e9bcb735ebf1b7d655229efb047b41a937aefb6c298d6f4ee8758b1340ee
TLSH
T124010E4AA3144FB7CC428D3584FE27552BB0FA502F821BBF7B10724F2E021C89E99168
MD5 SHA1 SHA512 TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 4287df53d8ea29a0cc7339232b139fd5419e6f41f02d52519621f661d518d1ed
MD5 84d9933a0da70c6ad5a7147d824fc5c3
SHA1 e37c34f1361333739ebbb1e5c2049bf7ec5c8441
SHA512 177ee943b5e484014508c110f064bce7dc3b974f341537c160879d14a7dc0319f6e7d2badfba9d59fe0363df431be192bba31c4bc37308c1787c55a3e0a3e01e
SSDEEP 24576:1cP4mcvIjkGOxhKP2l71nNKbrh/8KBaX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:aP4m4IpOO67W8KQXvYMLprznyDSga9
TLSH
T11865BE2DABDC0096D0BB913885658A49FAB1742A1F3286CF1160933D7F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 7KB
SHA256 ac7e411c75927430c5860e83cd1b4280fcf7370d534de81ab53f6edc0cacd764
MD5 e06ed4dbea649351423357aae46d1b0a
SHA1 224f78dfb7fcbf1edeceb616f6c243013ed599dc
SHA512 bff8a30a43657d2c384543a0aebb89a1c8429020a9da6f10939d384829b6c3a07686b0a055188973593b75558c0420242622c7fb3544da4f98937db595186d40
SSDEEP 96:TUa6HPGBBY0IZ9hK3dK3kGJedezMkWhK2zK2SE+GSm9e+0:PqkB26BFdZVAS9en
TLSH
T157F19FDA4E03457F3B829F2B338732556D972009C7E855723BDB9215F0CAA65042FABB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 9KB
SHA256 f56ab8bc81bc2c7690151d2ddf3358bb3874db781117ccbd014047a9ce6b410b
MD5 c514e01e28ed76fe6b72da763e535b51
SHA1 9d2bf2086a5aa0bc1149b2963e06ef7749a18984
SHA512 3d73e10a0fb94cc20f8098e797f95c5b7f7e76e46f88c80023cba51f2390ad48f0768726913d1a99ce3b5cadddf42e147304d900e191094fa308ee75e5c3a419
SSDEEP 96:TUa6HPGBBY0IZ9hK3dK3kGJedezMkWhK2zK2SE+GSm9e+5z4IqhK3iK3zbQg:PqkB26BFdZVAS9erB6B
TLSH
T1D512ADDA4E0345BF3B819F2B334732556D9B2009C7E855723BDF9215F0CAA65042FAAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 2679ea0b96f43ded4259ee6860a268fadb58a37d12e7d2bb1fd0c13e50b20120
MD5 f42ffac3aa00d0fe5495aafb0beced4f
SHA1 78479b52f7012c7895b67ab004df0bb519face0b
SHA512 83b673763dc4aef42b427349b50fccdd059330d16cc09a7d460474f06e0016f91fd5cecea8d298d5d6f7322c42a35b8c625f28454ed87a8ac200a2a0b955957d
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5a1a3614b2ac67af0c0117844433c0616d82e922702bd679cb5e237f607fef90
MD5 f9af206f204cd8f9a24f316100804629
SHA1 d52bd3cb6430e8fed64f6028b887e5fa0185b807
SHA512 8e6038b14684f88bbed734d30f40661af0ce4a9e7ad5924d1faa23858c3f722b40673582d86d73114924126706c8e2f26dd904e0b97fc0ef93de629d2f990850
TLSH
T1B2E02BA5C871EC2714F90758A0106B81DB55135B2A81C99B7A3CA01D8FB5A3B4595C1D
MD5 SHA1 SHA512 TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7313eb6c9c9d33425e436ca860f88834c91c1aa12e9932dd48ec5102ac6eedd7
MD5 db9a8578f54f99549d5b9f2f6a734500
SHA1 d6f4aeedd3bb8cbe097098770d1e746ad6bc92f7
SHA512 c0c1be90bfd28f92733ad7ddbac4115925f1f672420275a190c02685d389388f03560b08bbac98f7f652a93d60b746f8600f7b44cb0101d66bc14ef946e2c4bc
TLSH
T112518DF7E7E48A6D851152F4DA256E1FCD3D0A18131D3C62C9D4AE5B83E2872E24178E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 1c21bba5d995bda72a1e1847d28154ad05f6b2b6d429164e3d81eeb9102789b0
MD5 3c7cd144326a75f8c06a2637ecf8c7f5
SHA1 f764ab1d48b18835f1e5e013891a706b447f1b8b
SHA512 ccd93309dffb2f36d66b6a9fdab17bfc4e6525acc55c0bad5e825849e076b038717bd98c879a1d701b78fc429ef46292ebb05c918721cb55b1712b61ebc3a35d
SSDEEP 192:fRFM0SYbRUzlIl4sv7AQ9PRp2IXsb+WNn9C2QpeQy4lHiyIsnAUgtaJ:fRFM0SyzC4HXHXw82Wy4M8
TLSH
T1E432C62DBE15B57B5CDBC22AFA653743D2F3202130901E80EAFC996C24D7ACC226741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 8172965889df66900c7b35fd5f541ffd52764a577b8ee73e314d0954859fb875
MD5 d6f9e8d3630f6c386764b2183805b785
SHA1 e1c7fac53a136fcb9a3297b0c79b0f836e7a6e82
SHA512 91ec38e07e644d9b7d2b4a3decb71918a07895f9fdb2511a1772ae2f3f30c5e55a0e216f4b7c47e96953a506247be5a4f2793580b3d6a0d5cd2592c049d84395
SSDEEP 192:fRFM0SQ4sv7AM9PRp2IXsb+WNn9C2QOiyIsnAUgR:fRFM0SJ4dXHXw82sR
TLSH
T18112612DA919B53B5CCBD62AFA217753D3F2202134902E94E6FC993C25D7ACC2267817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe587143.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe587143.TMP
Size 3KB
SHA256 6dedadf692c2b21f6a1a6175bcd08d6682d75c654750e10704fc7ee9542ed634
MD5 20e7f1c4eb5de29ebaa1990c9b281bef
SHA1 4cf977f3c2ed6e5ec1081de936f727243957855b
SHA512 7bf8cb8615253bf3d9c017c898adb94a57a85cb35d480f211e3e9efa7b1ba0955fa76b71ef78de9920617ee2ab904d209234de7f17f82ac6121c1eda141809da
TLSH
T1BA611018E4A04CAB0DF57BB575790B81FEA2477B1185780B3D7E06CD4F7286B8241F6A
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 4c42406bd80cff63d6f39c51149fab1e4524ab12b2e06272ccff8b39e3717a99
MD5 e3d98d1158b0268b204620763bdd3161
SHA1 e1c7376afb0e8f648d30a169d7d195b295c98c04
SHA512 2b3b129c9c6c953b2f5b740c76012442cff2192655607841d56d57687f3b3e33bfce1c06b8671b5e9e8e27db5885b3fa79021eee98a2e1bfc35cd42825355431
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcMIpXODyJ+ErU3MrHGRxCJZM:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97pq
TLSH
T1D572FA676C488E7B0F94C6CCD8267B4FADF5024B65E9C86452FA582903D5BCB11052FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 53966a15480612299f90e97c6d0afee0a75f98982b0803e492fcd55a0c47d6de
MD5 fc5a7de00f1f03542a25336f4761398b
SHA1 5903f7b9468d4aae6ffa8b07f868e1ac2d0c9f62
SHA512 381355a995c23a6c24d4042a971eeb3fa5c2a86a4517037401bef65381eb081c257ebf4226d3a52ffe05ac9017bfba8cde15d9d8780b03f40a0975b1ac7979ce
TLSH
T1EAB012048002A141C04202F02696648872145F11A70A1B0143E07922CC3526180141E2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c956.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c956.TMP
Size 96B
SHA256 61d5a6b0d52e6ccf0d0cd18f1546c3f8e2c74b4d1a679fe6b0e47449dfe18bbb
MD5 ca80a092f068e2a3cfe132931d6e2dea
SHA1 303d801c7468924d101ec805132622eccfdbba17
SHA512 5cdcf09fd5d412f15f117a3682cb280f86b2e6c724d4893f7c3daff8b84b733626d812222e7a712f0dff04f79e103dfb4d27ee64306b0246c4841ab9083ac2cc
TLSH
T1E6B00269C102B252D04203B029959AD8F161FF27C6031216D2E85B6ADC256714929260
MD5 SHA1 SHA512 TLSH

Submit Download

ff689ede-4ad1-4e0b-873c-32c98ea1021c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ff689ede-4ad1-4e0b-873c-32c98ea1021c.tmp
Size 12KB
SHA256 f84e2e93e6ad7843554e4f0505ddc927544e6f1b953360729fbeef196c79442d
MD5 4905adaad36e21c2583243e040fd5d22
SHA1 9451ee93771398c472c9dbdf52e4f71e4a687a58
SHA512 450adf6053cd7bc71599c20df0fe2cc07b4c1d76753f899c78c702158128cc79dece8c30aa307720b2036ca30a8e3f1fe8f4de09dd85a06974a1cd06f0c1ca06
SSDEEP 192:fRFM0SYbRUzlIl4sv7AQ0tPRpXIXsb+WNn9C2TpeQy4lfiyIsnAUgraJ:fRFM0SyzC4CVXYXw82by40e
TLSH
T1DA42C72DB911B97B5CD7D229FA657B53D2F3202130901E80F6FC996C25E76CC225741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 872a8892c49a53349f37dd306e7340762bd0bbc0da08e7d9e0c8990035954b4a
MD5 df53175288116f4f3a3daff846857bd9
SHA1 144919437f07069eb5f8875a4ffefe3a78462498
SHA512 6c5655f1feb73d09f6b142a6af662fa0881e1bfbd338ae83042e93359717d244215928500afb16f0f2b9265de6c3f73a27de86b6c1e5483f05e4e73148d95e08
SSDEEP 3072:7mcR34VhBkaITupmQwi90EZqsE38JBrk7NGEwqfd7NtZL8cHQRZEQ6Spsb:7mVVUaITEmQhw38JBrkBjwqZ/ZLW3Exb
TLSH
T11E341237EFC31E334DC0CE756A130F47BBBA499DD074E7019C6A3B5369428A2BA42499
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 c5fb2606110af1079e1d3b7ae77766c312a21be1405786f7017cf54d37ee0a91
MD5 946af7ffcd2340e2cda679f1b1a21bd5
SHA1 9d00e511d0774b9e9284fa21cd994b525cc56c20
SHA512 5992b718dd27327544f368316e1fa59e647e6247f88928fa2593d2408352fa9b918d412f37912bbcaf28ef2c6a742a328996567923338199da087a1098c57ac2
SSDEEP 1536:CmyyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjt:hgqfd7NtZL8cHQRZEQ6SpsS
TLSH
T1FDC30237ABC21F339E83CB74B5130FD797B644A99034D301ABAD37EB6883595648249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 1fdd450681c965877a79fd9af32739f9d82378ab89e0adc2c5f982ad609bc4e7
MD5 d7e7a1371d340bb8e49a937ba9cfce30
SHA1 d5bb1392cebf588eb976f3e8684e6696ae9b7d51
SHA512 ab1710701b9c2217e7b43bb5cbd7b7df85eb029ebbe4450e69a1894a9d3864bf9dea2741b578f60f2550c574fb9c72fd7625fbbcfaa12062434a64a59ac53e13
SSDEEP 1536:bYLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:sqfd7NtZL8cHQRZEQ6Sps3
TLSH
T120C30237ABC21F339D93CF64B9530FD697B644A99030D301AAAD37EB7C93591644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 34fd3a0008dc166b6afe065ea0538e9703d55d0cc07854c3c15033b7dc9eb78e
MD5 85e9d542b7da90e33a27933e3c599c48
SHA1 25b509814906383760892782c38814c278fe23b2
SHA512 e8750e595756e9344098d37071f272483e1ed213716eac1057497a572fa02f67470de5b966ed945e672490b1d9b889f845484f1caaf1c88e720f2b3763c28bf5
SSDEEP 3072:kicR34VhBkaITupmQwi90EZqsE38JBrk7NGEwqfd7NtZL8cHQRZEQ6Spsb:BVVUaITEmQhw38JBrkBjwqZ/ZLW3Exb
TLSH
T1AD341276DFC35E334DC0CE756A230F47B3BA0998D074D7419CAE6753AA42CA2B64249A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 6cf2e8bfd48f98e97dee4e002c485ce081635425764f82b4d3396ff889a6a13c
MD5 097c3beb18958ac3a5c00bbddbc82dde
SHA1 b640e27b5710313e6bb08b8394d7d5722311b619
SHA512 a0fdf005afe7535ea492040376c35ec240e07ebd7124c2402190de27f5f3cea5368f476310884badc323321fd09046446d96948842e9b091836f4f9e0c67b166
SSDEEP 3072:dmcR34VhBkaITupmQwi90EZqsE38JBrk7NGEwqfd7NtZL8cHQRZEQ6Spsb:dmVVUaITEmQhw38JBrkBjwqZ/ZLW3Exb
TLSH
T12C341277EFC31E334DC0CE756A230F4BBBBA499DD074E7019C6A275369428A2B5424A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec8fd09168b29bb.bin

Path C:\Users\Admin\AppData\Roaming\ec8fd09168b29bb.bin
Size 12KB
SHA256 299235dbcfdd7ed0db903cb1ae136a9fffce727499d2449f754a4cdb504a776f
MD5 460d3cf2e37623d11df20d81d1e90920
SHA1 2f887d5147fbcdd29bee89fc34282cf01ca0e6d4
SHA512 0eeaac025d4a368e6a793a60b4dbbea8d735b2d4732d301c9dca9c670d31a041ce25cc80e4dd1eed21154477d3352ea48aa0a3c28541c2a018af31413c12cc43
SSDEEP 192:pgdEyvQcFyAb597DgqypD9IpVuYR93TJW2XLpPO1gw+teltMv/UT0TIwc62IFutS:7yv2AbPfgTGVRZWc2YtAtuMiIcm+0c1
TLSH
T15942B02A029B4163272B98F72BD9BBCC20F6F81B975FFCC64A486581045C375F891F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 ae19e9bca503593cdee6250c31ed41ededb56f58f483549df979658edb518053
MD5 1a4eb2d4232cbcfd4f411857742eb843
SHA1 1a27857866bc97b841061fe7dd8906fa27db1bb6
SHA512 44ca26876d7fc50222b5d608a6304dcec478582ae0d05744a2d80c4f1b5a16aa2a34bd3d1c14c7cc9982f227df32eb0401e932aaf2cdb4d3632e93a75b4785f2
SSDEEP 12288:VSLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj0:VSX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1CB652314F63C6DBBFF3A64314CF1840C782F3BD449099A5B6382669EA5FED78AC42116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ae0ac918cb04f9ddc357b249b6442dd313d8f7b058cb9a5329cf997b12629f16
MD5 2146c68c501912280d65bdb41aaa2d4b
SHA1 2da40cd4d609713a73a31f96c26ef84397054103
SHA512 7322b23e372bbce8b4fa0b1799f62df182e1dcbb6b43cc8c332a847d9a68744706b21026c84bfee5d8ea021657bf6d5055752b33f681344448d29a66860168da
SSDEEP 49152:da0h2GEkuAe73q3pp46zwwQ8XvYMLprznyDSga9:da0hNYG4JwRXvYCp3nyG
TLSH
T1CC85AF1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1191853D3F37DE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 8123e5902101db6e2dd71ee00702e49dec3900c9263662c6975996e3fecb635d
MD5 2d4b297f2563293cf88da641ccaaf010
SHA1 5d23967029602622c11fc88e285c01edf2451148
SHA512 f15f286125900f45baef289fbed4802420f6e6818c5a21311745652ea48dd16dda8288cf4d534a31382a3f607f1af32e9c8dd9926bc65dbadc65e604efd9a256
SSDEEP 24576:xhbHjPFX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:xhbHjNXvYMLprznyDSga9
TLSH
T1BD75023D26BC20E9F632A17D89A1450AD732B865071193EF13D282BE4F7BEE85C35B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 2c096a1bd8cb9c701a21099608be001404eb07f779d41d28ac700fe3f59fddd6
MD5 3a32bc74de5fbe896dd3976aaf9a16b6
SHA1 463d38415451f3bad1303b90efa21019104ed558
SHA512 26a5fae9cc9d01a262479a6f86a22181fe9fd8b4e79ee4bc6eeabe3a20277e043bdf132c7d6dba473258e40e6eed2c9c3e9318d7bb841aa200adc3e7f61a147e
SSDEEP 24576:f3YgnJcRTk4yti+R5dBR/dX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:fIgnaTk46pBR/dXvYMLprznyDSga9
TLSH
T16345BF2DF2B910B9D8AAD136450147B5FB71782D1F209ACB0170C538AF1AEE89E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 873e73145a9f56c809c73c6f4c8426f19541ac9772ea9153c746ab6b719de26e
MD5 459d4ed459f354a3d017c668cad5e4fa
SHA1 e8c446813f38667654ac17b5dd474397f84e39a1
SHA512 c65b2a77bcab79ed42ffee23b30da817025a7f211f9eb1987d10e03f08125aa9765747b4e622848b0af6b71b093619b36d4ff7afcf613c947ef0d0c6f6ee5cc4
SSDEEP 12288:dmLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:dmX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T146652304B13D69FBFF2A503A4CF1440CA85E3BC4070A5AE712D3A59EA6FFEF96856114
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 72d9acd52bf67819d1d6af0554834708da9226f67a14409b327f78eeb64771f6
MD5 1f8ce4a8d8cf9e9fb6fa65824f0e810b
SHA1 6b089a9856eb952bbfdba7c55a9bc7f6f8d97635
SHA512 3f04df36b8a3e018df6b961d8fd2bc1e350dd860652566020ccfdf55b0112b630f30e83e7acc7f92d49b90bef4a0d36159dde68287d19c0ab042c358f01bba2e
SSDEEP 24576:8pL3UT3X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:8pL3ULXvYMLprznyDSga9
TLSH
T17A95F114F7A800F9ED2B913CC8B28916E672749D0724E7DF03A94A6A1F637E54E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 6c059908090f1cb3ed6fe284e72057f413e451505f78b689a56d72200aed120d
MD5 db570a9d1954b2dadee175c3b1d7ee39
SHA1 0d8cf46fc9ce54bb25e47bdf5df3cabaf30ace99
SHA512 738a60d4a7268512d33651635c41f7aac31ff6bde912549f9957eba91ba8b63a05021bd243892718b62cca0940ad46b3141c23d18b710838100c0d3553b0fb9c
SSDEEP 24576:EOrX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:EOrXvYMLprznyDSga9
TLSH
T18175021936BC20F5E636A13D8992420DD77678A5071257EF02D081BE5FBBFF86C3A621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4fe6ed34225139d53b86194145721e928400ffb869af1a5959a91d19ac39bf55
MD5 f43731668822b2485a04f16c28467a6a
SHA1 348fcb06901d838d6ee53aeba632ce5ab86fa2b9
SHA512 07e06a5836a7f9dea848150ea936640e72edcf34367a583bbe869d081990b93755d8d15bdc30393f373539f516a6372a54841f695d9b13edc8c8fb263b39aae5
SSDEEP 24576:L7NM9YqZqmWMUkPjZM48Mv6bEhsCX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:L7cBWMpPjN8DbEhlXvYMLprznyDSga9
TLSH
T18F659E2E6BAC81E5D577D13DC9E28205F6B2B4611B318ACB1162833E6F37AF44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 96f1f80114965bf778075298d87e573817e07496b934f494e99895490345ddfa
MD5 c15c9949ecd433cf36c0522e13ae7d32
SHA1 6a8fc4ec9a6834be547b2f8595e47757621e4d51
SHA512 ee0242235ac3e08e9f13037622b1c69ff229f5e19cd94c2ba85e8ce34577438e4ca59b05c3c8e2ffc6baa768ca4e188b5073bc6fb6736fc94853bffff22a2950
SSDEEP 49152:sF2YuHNETovAvNYf8kmiXvYMLprznyDSga9:J6BCf8krXvYCp3nyG
TLSH
T13E857D2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF0255862E1F33AF45D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 d0c8728aabd81eab051d0a58c26af262b83a589c6d3f9a27918432e101b5482b
MD5 583e49b8c3c10ea5c67e7cd63cdf18fb
SHA1 ef4f6300f46816bb1de9dbc64e7f8936d4abc46a
SHA512 ab7b2c55b635007574f6bd472b79566d639445acc56f45527b3712d106d10d1e83cd2fe90195f43e77a2313e456245bc4a7977bbbb5b9f5510f647bd9c0289aa
SSDEEP 24576:uAFs06+Omlf3NXEbTofX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:nFs060lVXucXvYMLprznyDSga9
TLSH
T12965AF2F62AC00D5D07ED17E8997C91AF6B1746307255ACB0260867E7F6BEF81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 9a3377a7105d05bff0f060616003ecd9c6fc186533bbf1a7d96a707d4e644047
MD5 b3f070a01fec327af086aacfa6ff3038
SHA1 3c6c7d4bec5ea702be930a9f092e5c8c6114fa07
SHA512 a733ff330f02b7168fa496a07a1b79278276c96687d4604541e5eb09cf80b939ecce104017d48a4c2fb6e758a586354fb39d650404fbf4b116647c7869ce04c6
SSDEEP 24576:KJnJ5D3WXcX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:KJnJ5DGXcXvYMLprznyDSga9
TLSH
T13085D02CD2A810F8E477C274819A1B46FE72387D2F226AC724B4D5357F16EE0A979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a68bd87393da6f836552d77262a4a9ef2856b2129757717efd2e665fa71cf731
MD5 cb30ab3205d1e55d403ce1d31b28750a
SHA1 d372a3f046104a35fbafc6c1f6b9c79d7121940e
SHA512 1623ff843f452c0eee663d7dc1630acb21075140331ebb2481de038f3cf7e7d2120b1894a99dae1b3123ad7422fe3a4f3466bf8867aa3f2326b9768b66205d99
SSDEEP 49152:vg06DIKdwc+eQnSt65aVuXvYMLprznyDSga9:oYXvYCp3nyG
TLSH
T184956C15B7EA5294E9B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D835B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 9c87d7f495bd286fdf00a1baf22c53f571a275860578769aeee4473d52fa9c51
MD5 0c7043d73961faf9a86c49cc52f2d932
SHA1 3532de161cce96ff7464f3a8bd6488c490b77dcb
SHA512 70af3650d9b2c6f532fe3ee6dbde6f7db26b37cabddc56ca799b4327b393cf7ec7b52a4eb169c4b03677af61e7acd4a8e3d909f2cf3e36262af73195af283346
SSDEEP 24576:WnEX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:WnEXvYMLprznyDSga9
TLSH
T16175022D776C70EAE626903D88A18509D376F0A5171267EF12D1C27E4E7BEF92C39610
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 76eb11ec569a7cb9e89fb4adc1441d121cbfdb0e0fd6bab5e550a06013fc9bd9
MD5 fa55bc0de8dab2b6a242184035af1597
SHA1 42d5c743ddedca7f71f63e8dcdcca5de00db5105
SHA512 8f06ff3f2952a36457852f34124295e5e1c65286528af79f66b978e93451db0fc7b0c59edf8892c2bc0548aaa5efdbfe90c77f1a7bb0e0dc0453e48ef1e93ad3
SSDEEP 24576:vIyVX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:vIMXvYMLprznyDSga9
TLSH
T17775120473A864E5EB3A01398DB24148993ABC604F1597EF52D1E63FAE7BFE4AC31711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 510069a257e5ca2b918e741e522ab6f0fee707025dd559e2b3ec66315ae38124
MD5 fe9789f87345ac6fafe8b59a6216a9d5
SHA1 6b67317acfae07a49add80a05be25083bd41668e
SHA512 7a570cb26f0361f3653a2e398785668bf2a8f5324a58cc72d1e1c604047d9dcf6d5f882fe5cd81ae98c1a2cdf33fb6a9ec9be2eb63d59a7afd1b52a91f9250c7
SSDEEP 12288:uy7LD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:X7X7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1F4652318713D79FBFF26503A4CF04808A46E36A407096AFF12D2E5BEDAFFDA96452114
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 3f2cd708711b09c780dd0741413b15d06495b950d7769f5e04a29c0aff3a87f4
MD5 67f0fe805a3df495b9ecad43a65e5690
SHA1 5c6d02ade8c114ebb5a1f0dd6428f35ebe163f94
SHA512 2d9c1a13e034913ffd9c6fe9e31ef6024b603d4655ca5dd3926877a08175cb7d028609e85f73e1ec6e53d9c2fea04a80a5a30b69fa17b0fbd78b0c39c1f11a38
SSDEEP 24576:iQ9MxZKdcz9dw3KX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:iVKZKXvYMLprznyDSga9
TLSH
T11D557C2DABF9059AE177D23594A250C3A633B4311B35D6CF2448D03D4DBBEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 14ebcbe55d70ee1a530333f39e44af775e1250fd2ad7c93a6cf0408dad8ed3d1
MD5 8abada4227a86f6c97bcc1ed862bbaba
SHA1 3f25b58ffc6a7ae7dd926022a07a6ef35cb0bce9
SHA512 f38afb1e7e8ea6482babd188209f07ef29c383c49a82f6ec2bb3b60e9d08d9f858b73baa3ac70007addd7adb43de5951bf6f0102d719e9c86d969cca8cddcbce
SSDEEP 24576:TyocDAp5X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:2ocDAp5XvYMLprznyDSga9
TLSH
T12B85E01FB76D40E2E136813C89858649E773B0705B2257DB5292C33E8E7BAE9BC35B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 fa61a7dd8c875c60cb6dcb99741df5e7579af213812ccc747a090106806a8e04
MD5 eaa97bc9046078749f990f8db9c4b865
SHA1 3fdd3ebd6a10b5424a9c039cdc5a2062a8e119af
SHA512 529238a0ca2114c6d5ede22d772a082b5ad2b81e27019b11bfce66f809931229d659d74e29e289af41c1cd988a23c0496cfc2f9ed7e89a05e395a3e442e33fc2
SSDEEP 49152:AWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK5XvYMLprznyDSga9:y0zuNI3XvYCp3nyG
TLSH
T191A57C3DA2BC00A9D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a78b2fb27cb8157614824e6c29dd8afb75d11c4dc9133401b5e3dbd3e97b31d4
MD5 5c90e5eb8f31aac0bd2d3f46218e48ed
SHA1 8d979a9513ce457854cbabced8234b420f0d6b2b
SHA512 9faddff840713137e158418a401c8ad2ebc3056a22c133982a6ccb02dc4b6e5c05361955429dd0944be294fc75a7995797ff49ccac7139c55d1ab06ef4a0bf2b
SSDEEP 24576:k1QT7EcpfxR+N5AWAz3ooiYtjMqbgX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:ZTDxR+N5YzTfjMLXvYMLprznyDSga9
TLSH
T1E555B02EA7F815E9D17EC5798A23C506FA727861033193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 19b8fcaced24647032ce3032f4140551c444787faeea757fcbe2c5e45fae92c5
MD5 a6b9d7a6e96f11218863fd092af5f8b5
SHA1 86fe81594da9c79fcc3411df098c493fa31eb7f5
SHA512 da8b023902804f6d3163c63ccf19f618e05f5c96c5b9eca5a3b128bba9e893c6f644c20b24f4bd1132c3768b3309427a6f64df5a8b6d530dd03badfff7322c21
SSDEEP 24576:5TMdOz0FFS+imSLkX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:T0K+imSLkXvYMLprznyDSga9
TLSH
T11485E13EA36D14F5E53BC17D9A538906E57234610322A6DB06D0C1BD3FABEE47939B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 e50ab12dd7e055c59e4e5849e624d77acf9e59da895ac9e783b1023550dd4c77
MD5 4bcd41de5c2d8d45bea55c7f92525ee7
SHA1 8d47670bd8b98f598060f0be8943ff4b155cf5f1
SHA512 32d691b1d5b7b7e9443e866d29e0f04d3949196e9515eb1c9807e7c93daa65d84719d993d872b55d4d8f71b9f4d0051f1e56d19d7da4940b7051530f6e083cc7
SSDEEP 12288:D4K3LD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:v3X7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1EA75120C73FC34E5FA3291398DB60109957578A503156AFF22D1C5BE8F7BAE8A835712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/116-78-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/116-72-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/116-83-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/116-80-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/116-85-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/536-136-0x0000000140000000-0x0000000140269000-memory.dmp

Download

memory/536-30-0x0000000140000000-0x0000000140269000-memory.dmp

Download

memory/920-91-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/1048-134-0x0000000000740000-0x00000000007A7000-memory.dmp

Download

memory/1048-137-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/1048-197-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/1048-129-0x0000000000740000-0x00000000007A7000-memory.dmp

Download

memory/1252-194-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1252-474-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1384-102-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/1384-94-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1384-100-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1384-189-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/1572-144-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1572-146-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1572-56-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1572-58-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1572-50-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1808-166-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1808-329-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1808-164-0x00000000005E0000-0x0000000000640000-memory.dmp

Download

memory/1808-158-0x00000000005E0000-0x0000000000640000-memory.dmp

Download

memory/2224-155-0x0000000140000000-0x0000000140255000-memory.dmp

Download

memory/2224-297-0x0000000140000000-0x0000000140255000-memory.dmp

Download

memory/2556-500-0x0000000140000000-0x0000000140285000-memory.dmp

Download

memory/2556-202-0x0000000140000000-0x0000000140285000-memory.dmp

Download

memory/2648-485-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2648-198-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2724-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2724-70-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2724-67-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2724-178-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3440-41-0x0000000140000000-0x0000000140268000-memory.dmp

Download

memory/3440-33-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3440-42-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3536-179-0x0000000140000000-0x00000001402C1000-memory.dmp

Download

memory/3536-176-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3536-170-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3536-393-0x0000000140000000-0x00000001402C1000-memory.dmp

Download

memory/3652-185-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3652-187-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3676-463-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/3676-452-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/3676-458-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/3676-522-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/3972-396-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3972-151-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3972-206-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4176-193-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/4176-126-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/4176-115-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/4176-121-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/4180-148-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/4180-201-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/4328-182-0x0000000140000000-0x00000001402A1000-memory.dmp

Download

memory/4328-404-0x0000000140000000-0x00000001402A1000-memory.dmp

Download

memory/4660-20-0x0000000140000000-0x0000000140811000-memory.dmp

Download

memory/4660-88-0x0000000140000000-0x0000000140811000-memory.dmp

Download

memory/4660-17-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4660-11-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4828-521-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4828-248-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4828-214-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4828-230-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4828-207-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4828-529-0x000000000CAD0000-0x000000000CAD8000-memory.dmp

Download

memory/4868-460-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4868-190-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4920-0-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4920-28-0x0000000140000000-0x0000000140811000-memory.dmp

Download

memory/4920-10-0x0000000140000000-0x0000000140811000-memory.dmp

Download

memory/4920-6-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5056-89-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5056-47-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5240-477-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5240-472-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5240-540-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5452-490-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5452-486-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5452-515-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5752-505-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5752-492-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5752-498-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5752-629-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5772-541-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-568-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-573-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-572-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-571-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-565-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-575-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-576-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-550-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-546-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-577-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-578-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-579-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-566-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-567-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-574-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-569-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-570-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-556-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-542-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-543-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-545-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-544-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-547-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-548-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-549-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-551-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-552-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-553-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-554-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download

memory/5772-555-0x0000019B8E3C0000-0x0000019B8E3D0000-memory.dmp

Download